If an online lending app has started calling or messaging your family members, friends, coworkers, or other contacts about your loan—or has sent shaming messages, threats, or manipulated photos—you are dealing with practices that Philippine law strongly prohibits. These tactics often involve secretly accessing your phone’s contact list and misusing personal data in ways that go far beyond normal debt collection. This article explains your rights under current Philippine law, why these actions are illegal, and the practical steps you can take to stop the harassment, protect your privacy, and seek accountability.

Common Illegal Practices by Some Online Lending Apps

Many borrowers report similar patterns. Apps require broad permissions during installation or loan application, including full access to your phone contacts, photos, location, or social media accounts. Once installed, some operators harvest these contacts and use them to pressure third parties into convincing you to pay.

Typical violations include:

Repeated calls or texts to people in your contact list demanding they settle your debt or face consequences.
Public or semi-public shaming through social media posts, group messages, or altered “wanted” posters tagging or messaging your contacts.
Threats of harm, arrest, public exposure, or other consequences that the lender has no legal authority to carry out.
Contacting people at unreasonable hours (commonly late at night or very early morning).
Using profane, insulting, or intimidating language.
Disclosing details of your loan to unauthorized persons.

These actions are not legitimate collection methods. They violate core principles of data privacy and fair treatment.

Your Rights Under the Data Privacy Act of 2012 (RA 10173)

The Data Privacy Act of 2012 (RA 10173) is the main law protecting personal information in the Philippines. It applies to any individual or organization that collects, uses, stores, or shares personal data—including online lending apps.

Key principles include:

Lawful basis for processing — Personal data may only be processed with valid consent or another specific legal ground (such as necessity for a contract). Consent must be freely given, specific, informed, and evidenced in writing or electronically.
Purpose limitation and proportionality — Data collected for one purpose (for example, assessing a loan application) cannot be repurposed for harassment or debt shaming. Collecting an entire contact list is almost always excessive.
Transparency and data minimization — You must be clearly informed what data is collected and why. Lenders cannot demand unnecessary permissions.

Your phone contacts contain personal information not only about you but also about other people who trusted you with their details. Processing that data without their consent (or a valid legal basis) violates their rights as data subjects too.

The National Privacy Commission (NPC) has issued specific guidance, including Circular No. 20-01 (as amended), that directly addresses online lending. It prohibits apps from harvesting or using phone and social media contact lists to contact third parties for debt collection or to harass borrowers or their contacts. Many apps have already faced NPC investigations, cease-and-desist orders, and referrals for criminal prosecution because of these exact practices.

As a data subject, you have enforceable rights to be informed, to object to processing, to access and correct your data, and in many cases to have data erased. Violations can result in administrative fines (often substantial), orders to stop all data processing, and liability for damages.

Protection Against Unfair Debt Collection and Harassment

If the lender is registered with the Securities and Exchange Commission (SEC) as a lending or financing company, SEC Memorandum Circular No. 18, Series of 2019 applies. It explicitly prohibits unfair debt collection practices, including harassment, threats, public shaming, contacting or disclosing information to third parties (except authorized guarantors), calling at unreasonable hours, and using obscene or abusive language.

The Financial Products and Services Consumer Protection Act (RA 11765) further reinforces that financial consumers must be treated fairly and that their privacy must be respected during collection.

Even when these civil or administrative rules do not fully apply (for example, with unregistered operators), criminal liability can still arise under the Revised Penal Code:

Article 282 (Grave Threats) — threatening to commit a crime against a person.
Article 287 (Unjust Vexation) — any act that annoys, irritates, or vexes another without legal justification, often used for persistent harassing calls or messages.
Related provisions on coercion or light threats.

When these acts occur through apps, SMS, or social media, the Cybercrime Prevention Act of 2012 (RA 10175) can also apply, allowing authorities to investigate digital evidence and coordinate with platforms and telcos.

Step-by-Step Guide: What You Can Do Right Now

Preserve every piece of evidence immediately.
Take clear, full-screen screenshots of all messages, call logs (showing numbers, dates, and times), app permission screens, loan agreements, and any social media posts. Ask affected contacts to do the same and share copies with you. Save everything in multiple places (phone, cloud backup, external drive) because some apps delete conversations automatically. Note the exact wording of threats or shaming messages.
Send a written demand to stop.
Email or send a formal letter (keep proof of sending) to the app’s support address or registered office demanding that they immediately cease all contact with you and your contacts, delete any unauthorized data, and confirm compliance in writing within a short deadline (such as five to seven days). This creates an official record.
File a complaint with the National Privacy Commission (NPC).
This is usually the strongest and most direct route for contact harvesting and data misuse.
- Download the current Complaint Affidavit form from the NPC website.
- Fill it out in detail, naming the app or company (use whatever identifying information you have), describing exactly how your data and your contacts’ data were processed without proper consent or in violation of purpose limitation, and explaining the impact.
- Attach clear copies of your evidence.
- Have the completed affidavit notarized by a notary public.
- Submit it by email (scanned PDF) to complaints@privacy.gov.ph, by courier, or in person at the NPC office.
  The NPC can investigate, order the lender to stop processing data, impose fines, mediate a resolution (including data deletion), and refer serious cases to the Department of Justice for criminal prosecution.
Report threats and harassment to law enforcement.
For grave threats, persistent harassment, or cyber-related acts, go to your local Philippine National Police (PNP) station or directly to the PNP Anti-Cybercrime Group (ACG), which handles many online lending cases. You can also approach the National Bureau of Investigation (NBI) Cybercrime Division.
Prepare a notarized complaint-affidavit with your evidence. The ACG can trace numbers and accounts where possible and coordinate with service providers. Provide reference numbers from any NPC complaint so agencies can work together.
Complain to the SEC if the lender is registered.
Check the SEC website to see if the company holds a Certificate of Authority as a lending or financing company. If it does, file a complaint about unfair collection practices under SEC MC 18-2019. Submit through the SEC’s channels (often via email to the Financing and Lending Companies Division or designated complaint addresses) with your evidence. The SEC can sanction the company and its responsible officers.
Consider civil action for damages if needed.
You may have a claim for damages under the Civil Code (Articles 19, 20, and 21 on abuse of rights, or quasi-delict). For smaller claims, small claims court may be an option. The Public Attorney’s Office (PAO) provides free legal assistance to qualified indigent clients.
Protect yourself and your contacts going forward.
Uninstall the app if possible and revoke permissions through your phone settings. Inform your contacts what happened so they can block numbers and report incidents too. Be extremely cautious with future loan apps—legitimate ones do not need full access to your entire contact list for basic credit decisions.

Special Considerations for OFWs, Foreigners, and Harassed Contacts

Overseas Filipino Workers and Filipinos abroad can file complaints remotely by emailing scanned, notarized documents. If you need someone in the Philippines to represent you, a properly executed Special Power of Attorney is usually sufficient. Enforcement can be more challenging when operators are based abroad, but Philippine authorities have acted successfully in many cases because the harm occurs here.

Foreigners whose data was processed in connection with Philippine lending activities enjoy the same protections.

People in your contact list whose information was used without their consent are independent data subjects. They can file their own NPC complaints and police reports. Coordinating with them strengthens everyone’s cases.

Common Challenges and How to Handle Them

Many lenders use temporary or spoofed numbers, disappearing-message apps, or foreign servers, making immediate identification difficult. Provide every detail you have—the NPC and PNP can investigate further.

Some borrowers hesitate because they feel ashamed or fear retaliation. Remember that the illegal tactics are separate from any legitimate debt obligation, and reporting helps stop the same practices from harming others. Government agencies receive thousands of similar complaints and treat them seriously.

Processes can take time—weeks or months for initial NPC action, longer for full investigations or court cases. Keep copies of all reference numbers and follow up politely. Mediation at the NPC sometimes produces faster practical results, such as orders to delete data and stop contact.

Frequently Asked Questions

Can an online lending app legally access and use my entire phone contact list?
No. Harvesting and using contacts to pressure or shame third parties violates the Data Privacy Act and specific NPC guidance. Even if the app asked for permission, broad or buried consent for this purpose is generally invalid because it is neither specific nor proportionate.

What if the messages or calls come from different numbers every time?
Document every incident with screenshots showing dates, times, and content. The pattern itself is evidence. Authorities can still investigate the app or operator behind the activity.

Do I have to keep paying the loan while I complain about harassment?
Your basic obligation to repay a valid debt usually remains unless you have separate legal defenses (such as contract issues). The privacy violations and illegal collection tactics can and should be addressed independently through NPC, SEC, or criminal channels.

How long does it take for the NPC to act on a complaint?
Timelines vary. Initial review and possible mediation can occur within weeks to a few months. Full investigation and orders take longer depending on complexity and cooperation from the lender. Many similar cases against online lenders have resulted in concrete action.

Can my family members or contacts file complaints too?
Yes. They are data subjects whose personal information was processed without consent. They can file their own NPC complaints and report any threats or harassment they received.

What penalties can the company or its officers face?
Possible consequences include large administrative fines, cease-and-desist or data-processing ban orders from the NPC, sanctions or fines from the SEC, and criminal penalties (imprisonment and fines) for responsible individuals under the Revised Penal Code and related laws.

Do I need a lawyer to file with the NPC or police?
You can file initial complaints yourself using the required affidavit forms. For more complex cases or to pursue damages, consulting a lawyer or the Public Attorney’s Office is often helpful.

What if the lending app is not registered with the SEC?
Unregistered operators can still be held liable under the Data Privacy Act and criminal laws for threats and harassment. The NPC and PNP handle many such cases.

Is there protection if I report in good faith?
Good-faith reports to government agencies are generally protected. Truthful complaints supported by evidence are unlikely to result in successful counter-claims against you.

Key Takeaways

Harvesting and misusing your phone contacts to harass you or third parties is a clear violation of the Data Privacy Act of 2012 and NPC rules specifically targeting online lending practices.
Registered lenders must follow fair collection standards under SEC rules; threats, shaming, and third-party harassment are prohibited.
You have strong, practical remedies: document everything, send a written demand, file with the NPC for privacy violations, report criminal acts to the PNP Anti-Cybercrime Group or NBI, and complain to the SEC when applicable.
Strong, organized evidence is the foundation of any successful action.
These illegal tactics harm many Filipinos; reporting helps protect your dignity and contributes to broader enforcement.
You have clear rights to privacy and respectful treatment. Taking documented steps puts you back in control of the situation.

The National Privacy Commission website (privacy.gov.ph) and the PNP Anti-Cybercrime Group channels are good starting points for forms and current guidance. Act promptly to preserve evidence, and reach out to the appropriate agency with your documented facts. Many borrowers in similar situations have successfully stopped the harassment and obtained relief through these channels.