I. Introduction

Lending apps have become common in the Philippines because they offer fast loan applications, digital onboarding, electronic contracts, and quick disbursement. However, many borrowers later discover that these apps collect and process large amounts of personal information, including names, mobile numbers, valid IDs, selfies, device information, employment details, bank or e-wallet accounts, contact references, location information, and sometimes even phone contacts or media access.

Because of abusive collection practices, unauthorized contact of references, public shaming, excessive data collection, and harassment by some online lenders, many borrowers ask: Can I delete my lending app account and demand that the app delete my personal data?

Under Philippine data privacy law, the answer is: yes, a borrower has data privacy rights, including the right to request deletion, blocking, removal, or destruction of personal data in proper cases. However, the right is not absolute. A lending company may be allowed, or even required, to retain certain information for lawful purposes, such as enforcing a valid loan, complying with accounting, tax, anti-fraud, regulatory, audit, or legal obligations, resolving disputes, or complying with orders of government authorities.

The legal issue is therefore not simply whether the user can press “delete account.” The real question is: What personal data must the lending app delete, what data may it retain, for how long, and what can the borrower do if the app refuses or continues to misuse the data?

II. Legal Framework

The principal Philippine law is the Data Privacy Act of 2012, or Republic Act No. 10173. It protects personal information and sensitive personal information and gives data subjects rights over their personal data.

Other relevant laws, rules, and principles may include:

Rules and issuances of the National Privacy Commission;
Civil Code principles on privacy, abuse of rights, damages, and human dignity;
Cybercrime laws, if harassment, threats, hacking, identity theft, or online shaming are involved;
Consumer protection rules;
Securities and Exchange Commission rules for financing and lending companies;
Bangko Sentral-related rules if the entity is a bank, financing partner, or regulated financial institution;
Anti-Money Laundering, tax, audit, accounting, and record-retention obligations;
Rules on electronic evidence and electronic contracts;
Contract law, if the loan agreement is still outstanding.

A lending app is not exempt from data privacy law simply because the borrower owes money. Debt collection must still be lawful, fair, proportionate, and respectful of privacy rights.

III. What Is Personal Data?

Under Philippine privacy principles, personal data generally includes information that identifies or can reasonably identify an individual.

In lending app transactions, personal data may include:

Full name;
Nickname or alias;
Date of birth;
Address;
Mobile number;
Email address;
Government ID numbers;
ID photos;
Selfies and facial images;
Signature;
Employer or business information;
Salary or income details;
Bank account or e-wallet details;
Loan amount and repayment history;
Credit score or internal risk profile;
Device ID;
IP address;
Location data;
App usage logs;
Contact references;
Phone contact list, if accessed;
Messages or uploaded documents;
Collection notes;
Call recordings, if any;
Complaints, dispute records, and communications.

Some of this information may be sensitive personal information, especially government-issued identifiers, financial information, health-related information if collected, and other data requiring higher protection.

IV. Lending Apps as Personal Information Controllers or Processors

A lending app or its operating company may act as a personal information controller if it decides why and how personal data is collected, used, stored, shared, or deleted.

It may also use personal information processors, such as:

Cloud service providers;
Credit scoring providers;
Collection agencies;
Payment processors;
Customer service providers;
Identity verification vendors;
Analytics providers;
SMS, email, and call service providers;
Outsourced technology providers.

Even if a lending app uses contractors, the lending company may still have obligations to ensure that personal data is processed lawfully and securely.

V. The Borrower as Data Subject

A borrower, applicant, guarantor, co-maker, contact reference, or person whose phone number was uploaded to a lending app may be a data subject.

As a data subject, the person has rights over personal data, including rights commonly understood as:

Right to be informed;
Right to access;
Right to object;
Right to rectification;
Right to erasure or blocking;
Right to damages;
Right to data portability, where applicable;
Right to file a complaint with the National Privacy Commission.

The right to delete a lending app account is mainly connected with the right to erasure or blocking, but other rights may also apply.

VI. The Right to Erasure or Blocking

The right to erasure or blocking allows a data subject to request that personal data be blocked, removed, or destroyed in proper circumstances.

This may apply when:

The personal data is incomplete, outdated, false, or unlawfully obtained;
The personal data is being used for an unauthorized purpose;
The data is no longer necessary for the purpose for which it was collected;
The borrower withdraws consent, and there is no other lawful basis for processing;
The data is being processed unlawfully;
The data subject objects to processing, and there is no overriding lawful ground;
The data was collected excessively or disproportionately;
The lending app continues to use data after the loan relationship has ended without valid reason;
The data is being used for harassment, public shaming, unauthorized contact of third persons, or abusive collection;
The law or regulator orders deletion or blocking.

This right is sometimes casually called the “right to delete,” but legally it is more precise to call it a right to erasure, blocking, removal, or destruction of personal data, subject to legal limitations.

VII. Account Deletion vs. Data Deletion

It is important to distinguish between deleting an app account and deleting all personal data.

A. Account Deletion

Account deletion usually means the user can no longer log in, apply for loans, view records, or use the app. The account may be deactivated, closed, disabled, or anonymized.

B. Data Deletion

Data deletion means personal information is removed, destroyed, blocked, anonymized, or made inaccessible in a way that it can no longer be used to identify the person, subject to lawful retention.

A lending app may delete the account interface but still keep backend data for legal, accounting, regulatory, fraud-prevention, or dispute purposes.

Thus, a borrower should specifically request both:

Closure or deletion of the account; and
Deletion, blocking, or restriction of personal data that is no longer legally necessary.

VIII. When the Borrower Has No Outstanding Loan

If the borrower has fully paid all loans and has no pending application, dispute, chargeback, investigation, or legal case, the borrower has a stronger basis to demand deletion or blocking of data that is no longer necessary.

The lending app may still retain some records if required for lawful purposes, such as:

Accounting records;
Audit trail;
Regulatory compliance;
Tax records;
Anti-fraud monitoring;
Proof of loan contract and payment history;
Complaint handling records;
Legal defense in case of future disputes.

However, the lending app should not continue to use the borrower’s personal data for unnecessary marketing, harassment, profiling, excessive monitoring, or unauthorized sharing.

If all obligations are settled, the borrower may demand:

Account closure;
Deletion of app profile;
Deletion of device permissions and unnecessary collected data;
Blocking of further collection calls or messages;
Removal from marketing lists;
Deletion of uploaded contacts or third-party contact data, if unlawfully or unnecessarily retained;
Confirmation of what data will be retained and why.

IX. When the Borrower Has an Outstanding Loan

If the borrower still owes money, the lending app may have a lawful basis to retain and process certain personal data to enforce the loan.

This may include:

Borrower’s name;
Contact information;
Loan agreement;
Payment history;
Amount due;
Billing and collection records;
Valid identification documents;
Fraud-prevention records;
Communications about payment;
Legal and regulatory records.

A borrower generally cannot use account deletion to erase a valid debt or prevent lawful collection. The right to delete data does not extinguish the loan obligation.

However, even if a loan remains unpaid, the lending app must still process personal data lawfully. It cannot use the debt as a license to:

Harass the borrower;
Shame the borrower publicly;
Contact all phone contacts without lawful basis;
Threaten criminal cases without basis;
Send humiliating messages to relatives or employers;
Post the borrower’s photo or ID;
Use personal data for unrelated purposes;
Access device data beyond what is necessary;
Retain excessive data indefinitely;
Sell or share data without lawful basis.

The borrower may not be able to demand deletion of all loan records while the loan is outstanding, but may demand that processing be limited to lawful, necessary, and proportionate purposes.

X. Consent Is Not the Only Basis for Processing

Many lending apps rely on consent because users click “I agree” before using the app. However, under data privacy principles, consent is only one possible basis for processing.

A lending company may also process data because it is necessary for:

Performance of a contract;
Compliance with legal obligations;
Legitimate interests, subject to rights and safeguards;
Establishment, exercise, or defense of legal claims;
Protection against fraud;
Regulatory compliance.

Therefore, even if the borrower withdraws consent, the lending app may still retain some data if another lawful basis applies.

But the app should explain what data it will retain, why it will retain it, and how long it will be kept.

XI. Withdrawal of Consent

A borrower may withdraw consent for certain processing activities, especially those that are optional, excessive, or unrelated to the loan.

Examples of processing that may be objected to or withdrawn include:

Marketing messages;
Promotional loan offers;
Access to phone contacts;
Access to media gallery;
Location tracking not necessary for the loan;
Sharing data with unrelated third-party marketers;
Profiling for new offers after account closure;
Use of personal data for purposes not disclosed at collection.

Withdrawal of consent should be made in writing and should be specific.

However, withdrawal of consent may not stop processing that is necessary to service or collect an existing loan, comply with law, or defend legal claims.

XII. Right to Object

A borrower may object to processing of personal data when the processing is based on consent or legitimate interest and the borrower has legitimate grounds for objection.

For example, the borrower may object to:

Use of data for marketing;
Sharing data with collection agents not properly disclosed;
Contacting references for purposes beyond verification;
Processing data from phone contacts;
Automated profiling that affects loan decisions;
Continued use of personal data after account closure;
Repeated collection messages that go beyond lawful collection.

When a borrower objects, the lending app should stop processing unless it has compelling lawful grounds or the processing is needed for legal claims.

XIII. Right to Access

Before demanding deletion, a borrower may request access to personal data held by the lending app.

The request may ask:

What personal data do you hold about me?
What data did you collect from my phone?
Did you access my contacts?
Did you upload my contact list?
Who did you share my data with?
What collection agency has my data?
What is the purpose of processing?
What is the legal basis?
How long will you retain the data?
How can I request deletion or correction?

The right to access helps determine whether the app collected excessive or unauthorized data.

XIV. Right to Rectification

If the lending app holds wrong information, the borrower may demand correction.

Examples:

Wrong name;
Wrong phone number;
Wrong employer;
Wrong loan status;
Wrong amount due;
Wrong payment posting;
Wrong delinquency status;
Wrong identity document;
Incorrect contact references;
Misleading collection notes.

Incorrect loan or identity data can harm a borrower’s reputation, credit standing, and legal position. The borrower should request correction in writing and attach proof.

XV. Right to Damages

A borrower may claim damages if the lending app violates data privacy rights and causes harm.

Possible harms include:

Reputational damage;
Emotional distress;
Loss of employment opportunity;
Harassment by collection agents;
Exposure of private information;
Public shaming;
Identity theft;
Unauthorized contact of relatives or employer;
Financial loss;
Legal expenses;
Anxiety, humiliation, or mental anguish.

The right to damages may be pursued through appropriate legal proceedings, depending on the facts and forum.

XVI. What Lending Apps Commonly Collect

A lending app may collect data during registration, loan application, verification, credit scoring, disbursement, repayment, and collection.

Commonly collected data includes:

Name;
Mobile number;
Email address;
Address;
Date of birth;
Civil status;
Nationality;
Employment details;
Monthly income;
Employer name and address;
Bank account or e-wallet details;
Government ID;
Selfie;
Loan purpose;
Contact references;
Device information;
App usage;
Location;
Payment behavior;
Collection history.

The app must collect only data that is necessary and proportionate for legitimate lending purposes.

XVII. Excessive Data Collection

A major issue with some lending apps is excessive data collection.

Examples of potentially excessive data practices include:

Requiring access to all phone contacts;
Uploading entire contact list;
Accessing photos or media files without need;
Accessing SMS inbox unnecessarily;
Collecting location continuously;
Recording calls without proper notice or basis;
Accessing social media accounts;
Collecting data about non-borrowers;
Collecting unrelated sensitive data;
Retaining data after account closure without justification.

Borrowers may object to excessive collection and demand deletion or blocking of unlawfully obtained or unnecessary data.

XVIII. Contact References and Third-Party Data

Many lending apps ask borrowers to provide references. A reference may be contacted for verification or collection-related communication, depending on the privacy notice and lawful basis.

However, lending apps should not abuse reference information.

Improper practices may include:

Calling references repeatedly;
Disclosing the borrower’s debt without lawful basis;
Threatening references;
Shaming the borrower through references;
Contacting people not listed as references;
Using uploaded phone contacts for collection;
Sending defamatory messages;
Harassing employers, co-workers, neighbors, or relatives.

Third-party contacts are also data subjects. Their personal data should not be collected or used without lawful basis.

XIX. Phone Contacts and Device Permissions

One of the most controversial lending app practices is requesting access to a borrower’s phone contacts.

Access to contacts may be problematic because it involves personal data of many people who did not apply for the loan and did not consent to the app.

Borrowers should check app permissions and revoke unnecessary access.

A deletion request may specifically state:

Delete any uploaded phone contact list;
Stop processing contacts collected from my device;
Do not contact persons not expressly provided as references;
Identify any third parties to whom my contact data was shared;
Confirm deletion or blocking of non-essential contact data.

If the app collected contacts without proper notice or lawful basis, the borrower may have grounds for complaint.

XX. Collection Harassment and Data Privacy

Debt collection is allowed when lawful, but harassment is not.

Data privacy issues arise when collectors:

Send messages to the borrower’s contacts;
Disclose the debt to relatives or employer;
Post the borrower’s photo online;
Use the borrower’s ID in threats;
Send defamatory messages;
Threaten public exposure;
Use abusive language;
Pretend to be police, lawyers, or court officers;
Share screenshots of loan details;
Contact references excessively;
Use personal data to shame or intimidate.

The borrower may demand that the lender stop unlawful processing and delete or block data used for harassment.

XXI. Deleting the App Is Not the Same as Deleting the Account

Uninstalling the lending app from a phone does not automatically delete the account or personal data stored by the lender.

Uninstalling only removes the app from the device. Data may still remain in:

Lending app servers;
Cloud storage;
Collection agency databases;
Customer service systems;
Loan management platforms;
Payment processors;
Analytics tools;
Backup systems;
Regulatory records;
Audit logs.

To request deletion, the borrower should send a formal request to the lending company’s official contact channel, data protection officer, or customer support.

XXII. App Account Closure Procedure

A lending app should ideally provide a way to close or delete an account, especially if the borrower has no outstanding obligations.

The process may include:

Logging into the app;
Going to privacy settings or account settings;
Selecting account deletion or closure;
Submitting a written request;
Verifying identity;
Confirming no outstanding loan;
Waiting for processing;
Receiving confirmation of closure;
Receiving explanation of retained data, if any.

If no account deletion feature exists, the borrower may send a written request.

XXIII. What a Deletion Request Should Contain

A borrower’s request should be clear, specific, and documented.

It should include:

Full name;
Registered mobile number;
Registered email address;
Account ID or loan ID, if available;
Statement that all loans are fully paid, if true;
Request to close or delete account;
Request to delete, block, or restrict unnecessary personal data;
Request to stop marketing messages;
Request to stop sharing data with third parties;
Request to identify retained data and legal basis;
Request for confirmation within a reasonable period;
Copies of supporting documents, such as proof of full payment;
Contact details for response.

Do not send unnecessary sensitive documents unless needed for verification.

XXIV. Sample Request to Delete Lending App Account

Subject: Request for Account Deletion and Erasure or Blocking of Personal Data

Dear Data Protection Officer / Privacy Team,

I am [complete name], registered in your lending app under mobile number [number] and email address [email].

I request the closure and deletion of my lending app account. I further request the deletion, blocking, removal, or restriction of processing of my personal data that is no longer necessary for the purpose for which it was collected.

If any personal data must be retained for legal, regulatory, accounting, audit, fraud-prevention, or claims-related purposes, please identify:

The specific personal data to be retained;
The legal basis for retention;
The purpose of retention;
The retention period;
The persons or entities with whom the data has been shared;
The safeguards applied to the retained data.

I also withdraw consent to receive marketing, promotional offers, or unnecessary communications and object to any processing of my data for purposes unrelated to my account, loan, or lawful obligations.

Please confirm in writing once my account has been closed and unnecessary personal data has been deleted, blocked, or restricted.

Thank you.

[Name] [Mobile number] [Email] [Date]

XXV. Sample Request When the Loan Is Fully Paid

Subject: Account Deletion Request After Full Payment

Dear Data Protection Officer / Privacy Team,

I am requesting deletion of my account and personal data in your lending app.

My loan under [loan reference number] has been fully paid as of [date], as shown by the attached proof of payment. I have no pending loan application, no outstanding balance, and no unresolved dispute.

Please close my account and delete, block, or anonymize personal data that is no longer necessary. This includes unnecessary app profile data, marketing data, device data, contact data, and any data collected from my phone that is not legally required to be retained.

If you will retain any records, please provide the legal basis, purpose, retention period, and safeguards.

Please also confirm that my personal data will no longer be used for marketing, profiling, re-loan offers, or sharing with third parties unrelated to legal retention purposes.

Respectfully,

[Name]

XXVI. Sample Request When the App Contacted Phone Contacts

Subject: Demand to Stop Unauthorized Contact and Delete Unnecessary Contact Data

Dear Data Protection Officer / Privacy Team,

I object to the processing of personal data obtained from my phone contacts or from persons who did not consent to be contacted regarding my account.

Please immediately:

Stop contacting persons who are not lawful parties to my loan;
Stop disclosing my loan, alleged balance, or personal information to third persons;
Delete or block any phone contact data uploaded from my device without lawful basis;
Identify all third parties or collection agencies that received my data;
Confirm the measures taken to prevent further unauthorized disclosure.

This request is made without waiver of my rights and remedies under Philippine data privacy law and other applicable laws.

[Name] [Date]

XXVII. What the Lending App May Lawfully Retain

Even after account deletion, the app may retain some data for lawful purposes. This may include:

Loan contract;
Payment records;
Billing records;
Tax and accounting records;
Audit logs;
Fraud-prevention records;
Regulatory compliance records;
Complaint records;
Legal case records;
Evidence needed for claims or defense;
Transaction records required by law;
Records needed to prevent duplicate or fraudulent accounts.

However, retention must still comply with privacy principles. The app should retain only what is necessary, for a lawful purpose, for a reasonable period, and with appropriate security.

XXVIII. What the Lending App Should Delete or Stop Processing

The borrower may have a strong basis to demand deletion or blocking of data that is:

Excessive;
Unnecessary;
Unlawfully obtained;
Used for harassment;
Used for unauthorized marketing;
No longer needed after full payment;
Collected from phone contacts without lawful basis;
Shared with unauthorized third parties;
Inaccurate or misleading;
Retained indefinitely without justification;
Processed beyond the disclosed purpose;
Used to shame, threaten, or intimidate.

Examples include uploaded contact lists, marketing profiles, unnecessary device permissions, duplicate ID copies, and information unrelated to the loan.

XXIX. Retention Periods

Philippine data privacy law does not allow personal data to be retained forever simply because a company wants to keep it. Data should be retained only as long as necessary for the declared, specified, and legitimate purpose, or as required by law.

A lending app should have a retention policy explaining:

What data is retained;
Why it is retained;
How long it is retained;
When it is deleted, anonymized, or archived;
Who can access it;
How it is secured;
What happens after account deletion.

Borrowers may request a copy or summary of the retention basis applicable to their account.

XXX. Data Minimization

Data minimization means collecting and keeping only personal data that is necessary and proportionate.

A lending app should not collect or retain excessive personal data merely because technology allows it.

For example:

A lender may need identity data to verify the borrower;
It may need repayment records to manage the loan;
It may not need to keep the borrower’s entire phone contact list after verification;
It may not need continuous location tracking after loan approval;
It may not need access to photos or files unrelated to the loan;
It may not need to retain marketing data after consent is withdrawn.

Data minimization supports account deletion and data erasure requests.

XXXI. Purpose Limitation

Personal data must be processed only for declared, specified, and legitimate purposes.

If the borrower gave information for loan evaluation, the lender should not automatically use it for:

Public shaming;
unrelated marketing;
sale to third parties;
harassment campaigns;
unauthorized credit blacklisting;
disclosure to employer;
disclosure to relatives;
unrelated profiling.

If data is used beyond the original lawful purpose, the borrower may object and demand deletion or blocking.

XXXII. Transparency

A lending app should inform users about:

What data is collected;
Why it is collected;
How it is used;
Whether contacts are accessed;
Whether data is shared with collectors;
Whether data is used for credit scoring;
How long data is retained;
How users can exercise privacy rights;
Who the data protection officer is;
How to file a privacy complaint.

A vague or hidden privacy notice may support a borrower’s objection to processing.

XXXIII. Security of Personal Data

Lending apps must protect personal data against unauthorized access, misuse, loss, disclosure, alteration, or destruction.

Security measures may include:

Access controls;
Encryption;
Audit logs;
Secure storage;
Staff confidentiality;
Vendor controls;
Limited access by collection agents;
Data breach response;
Secure deletion methods;
Regular privacy and security review.

If a lending app leaks borrower data or allows collectors to misuse it, liability may arise.

XXXIV. Data Sharing With Collection Agencies

A lending company may hire collection agencies, but sharing borrower data must have a lawful basis and proper safeguards.

The lender should ensure that collection agencies:

Use data only for lawful collection;
Do not harass borrowers;
Do not disclose debt to unauthorized persons;
Protect data securely;
Delete or return data after engagement ends;
Follow privacy and collection rules;
Do not use borrower data for unrelated purposes.

The borrower may ask the lending app to identify collection agencies that received personal data.

XXXV. Data Sharing With Credit Bureaus or Credit Information Systems

Lenders may report credit information to lawful credit information systems where allowed by law and regulation. However, reporting must be accurate, lawful, and proportionate.

A borrower may request correction if the report is false or outdated.

Deletion may not always be available if the reporting is legally authorized and accurate, but the borrower may challenge inaccurate or unlawful reporting.

XXXVI. Account Deletion and Credit Records

Deleting a lending app account does not necessarily delete all credit history.

A paid loan record may still be retained or reported for legitimate credit, audit, or regulatory purposes. However, it should not be falsely reported as unpaid, delinquent, fraudulent, or unresolved if it has been settled.

A borrower should request a certificate of full payment or clearance when a loan is paid.

XXXVII. Certificate of Full Payment or Clearance

Before deleting the account, the borrower should request:

Official receipt;
Statement of account showing zero balance;
Certificate of full payment;
Loan closure confirmation;
Confirmation that no further collection will be made;
Confirmation that collection agencies have been informed.

This prevents future disputes and supports the deletion request.

XXXVIII. If the Lending App Refuses to Delete the Account

If the app refuses deletion, ask for a written explanation stating:

What data will be retained;
Why it must be retained;
The legal basis;
The retention period;
Whether the account can at least be deactivated;
Whether marketing can be stopped;
Whether unnecessary data can be deleted;
Whether third-party sharing can be restricted;
How to appeal or complain.

A blanket refusal without explanation may be challenged.

XXXIX. If the Lending App Has No Delete Button

The absence of an in-app delete button does not remove the borrower’s rights.

The borrower may send the request through:

Official customer service email;
Data protection officer email;
Privacy notice contact channel;
In-app help center;
Registered office address;
Formal demand letter;
Complaint channel of the regulator.

Keep screenshots and proof of submission.

XL. If the Lending App Ignores the Request

If the app ignores the request, the borrower should:

Send a follow-up;
Preserve proof of the original request;
Document continued messages or data misuse;
Stop unnecessary app permissions;
Uninstall the app only after preserving records;
File a complaint with the National Privacy Commission if warranted;
Report abusive lending or collection practices to the proper regulator;
Consult counsel if harassment, threats, or reputational damage occurred.

A privacy complaint is stronger when the borrower can show written requests and the company’s failure or refusal to respond.

XLI. Filing a Complaint With the National Privacy Commission

A borrower may file a complaint with the National Privacy Commission if the lending app violates data privacy rights.

Possible grounds include:

Unauthorized collection of phone contacts;
Failure to honor deletion or blocking request;
Excessive data collection;
Unauthorized sharing of data;
Harassment through personal data;
Disclosure of debt to third persons;
Failure to provide privacy notice;
Failure to respond to access request;
Failure to correct wrong data;
Data breach;
Processing after withdrawal of consent without lawful basis;
Retention of data without valid purpose.

The borrower should prepare evidence.

XLII. Evidence for a Privacy Complaint

Useful evidence includes:

Screenshots of the app permissions requested;
Privacy policy screenshots;
Loan agreement;
Account deletion request;
Email replies or lack of response;
Proof of full payment;
Collection messages;
Messages sent to contacts;
Call logs;
Names and numbers of collectors;
Screenshots from relatives or employer;
Social media posts, if any;
Proof of emotional or reputational harm;
App store listing;
Screenshots showing no deletion option;
Any data access response from the lender.

The more specific the evidence, the stronger the complaint.

XLIII. Complaints to Other Regulators

Depending on the type of lender, complaints may also be directed to other regulators.

Possible concerns include:

Lending company registration;
abusive collection;
unfair debt collection;
threats;
excessive interest;
misleading loan terms;
unauthorized online lending operations;
violation of financing or lending company rules;
consumer protection concerns.

Data privacy complaints and lending regulation complaints may proceed separately because they address different wrongs.

XLIV. Harassment, Threats, and Criminal Remedies

If collectors use threats, coercion, defamation, identity theft, or cyber harassment, data privacy remedies may not be the only remedy.

Possible legal issues include:

Grave threats;
light threats;
unjust vexation;
grave coercion;
oral defamation;
libel or cyberlibel;
identity theft;
illegal access;
unauthorized use of personal data;
harassment under applicable laws;
civil damages.

Borrowers should preserve evidence and seek legal advice if threats are serious.

XLV. Can a Lending App Contact Your Employer?

A lending app may collect employment information to verify income or identity, if properly disclosed and lawful. However, contacting the employer to shame, threaten, or disclose debt may violate privacy and other laws.

Improper employer contact may include:

Telling HR that the borrower is a delinquent debtor;
Sending humiliating messages to co-workers;
Threatening termination;
Misrepresenting legal consequences;
Sending the borrower’s ID or photo;
Demanding salary deduction without authority;
Calling repeatedly to cause embarrassment.

The borrower may object and demand cessation of unauthorized disclosure.

XLVI. Can a Lending App Contact Your Family or Friends?

A lending app should not freely disclose loan details to family or friends unless there is a lawful basis. A reference contact does not automatically become a co-debtor.

Improper conduct includes:

Telling relatives the exact loan amount;
Calling friends not listed as references;
Sending threats to family members;
Posting in group chats;
Sending borrower’s photo to contacts;
Asking contacts to shame the borrower;
Claiming contacts are liable when they are not.

A borrower may demand that the lender stop processing third-party contact data and delete improperly collected contact information.

XLVII. Can a Lending App Post Your Information Online?

A lending app or collector should not post a borrower’s personal information online for collection.

Public shaming may involve:

Posting the borrower’s photo;
Posting ID documents;
Posting debt details;
Calling the borrower a scammer without basis;
Posting in Facebook groups;
Tagging relatives;
Sending defamatory captions;
Creating fake wanted posters.

This may trigger data privacy, cybercrime, defamation, civil damages, and regulatory complaints.

XLVIII. Can a Lending App Keep Your ID After Account Deletion?

A lending app may need to retain a copy of ID for a lawful retention period if the borrower took a loan or completed verification. However, it should not keep ID copies indefinitely without justification.

If the loan was denied or the application was abandoned, the app should have a clear basis for retaining or deleting the ID.

The borrower may request:

Deletion if no loan was granted and retention is unnecessary;
Restriction of access if retention is legally required;
Explanation of retention period;
Confirmation that the ID will not be used for marketing or shared with collectors unnecessarily.

XLIX. Can a Lending App Refuse Deletion Because of “Company Policy”?

A company policy is not enough by itself. The policy must be consistent with law.

If the app says it cannot delete data because of company policy, the borrower may ask:

What law or regulation requires retention?
What specific data must be retained?
How long is the retention period?
Can unnecessary data be deleted?
Can the account be deactivated?
Can marketing processing stop?
Can access be restricted?
Can data be anonymized?

A lawful retention policy must be specific, reasonable, and proportionate.

L. Can You Delete Your Account to Avoid Payment?

No. Account deletion does not erase a valid loan. If the borrower owes money, the lender may retain and use necessary data to collect lawfully.

However, the lender must still respect privacy and collection rules.

A borrower should separate two issues:

Debt issue — whether money is owed, how much, and payment terms;
Privacy issue — whether data is collected, used, shared, retained, or disclosed lawfully.

Even an unpaid borrower has privacy rights.

LI. Can You Demand Deletion After Paying the Loan?

Yes, the borrower may demand deletion or blocking of unnecessary data after full payment.

The lender may retain certain records for lawful reasons, but should stop unnecessary processing.

A strong post-payment request should include:

Proof of full payment;
Request for account closure;
Request for deletion of unnecessary personal data;
Request to stop marketing;
Request to stop sharing with collectors;
Request to delete phone contact data;
Request for retention explanation.

LII. Data of Loan Applicants Who Were Rejected

If a person applied for a loan but was rejected, the lending app may not automatically keep all personal data forever.

The applicant may request deletion if:

No loan contract was created;
Data is no longer necessary;
Consent is withdrawn;
Retention is excessive;
The app collected sensitive data unnecessarily;
The app uses the data for marketing despite rejection.

The app may retain some anti-fraud or application records for legitimate purposes, but should explain why and for how long.

LIII. Data of Persons Who Never Applied but Were Contacted

Some people receive collection messages because their number appeared in another borrower’s phone contacts or reference list.

These persons may demand:

Information on how their number was obtained;
Deletion of their contact data;
Cessation of collection messages;
Blocking of further processing;
Identification of the borrower, where appropriate and lawful;
Complaint if harassment continues.

A person who is merely a contact or reference is not automatically liable for the borrower’s debt.

LIV. Data Portability

In some cases, borrowers may request a copy of their personal data in a structured or commonly used format, especially if processed electronically and if the legal requirements for portability apply.

This may be useful for:

Reviewing loan history;
Checking payment records;
Disputing wrong balances;
Transferring records to another financial provider;
Supporting complaints.

This right is separate from deletion.

LV. Automated Credit Scoring and Profiling

Lending apps may use automated systems to evaluate credit risk. These systems may rely on personal data, payment history, device data, or behavioral data.

Borrowers may ask:

Is automated decision-making used?
What categories of data affect credit scoring?
Was my application rejected based on automated processing?
Is there human review?
Can inaccurate data be corrected?
Can unnecessary profiling data be deleted?

Automated profiling must still comply with fairness, transparency, and proportionality principles.

LVI. Cross-Border Data Transfers

Some lending apps may store or process data outside the Philippines through cloud providers, foreign affiliates, or overseas vendors.

Cross-border processing is not automatically illegal, but the lender must ensure that personal data remains protected.

Borrowers may ask:

Is my data stored outside the Philippines?
What country or provider processes it?
What safeguards apply?
Are collection agencies abroad involved?
Will deletion requests be honored across all systems?

Account deletion should address both local and foreign processors, where applicable.

LVII. Data Breach Concerns

If a lending app exposes borrower data through hacking, leaks, employee misuse, or collector abuse, a data breach may occur.

Signs of possible breach include:

Unknown persons contacting the borrower about loan details;
Loan information appearing online;
ID photos being circulated;
Contacts receiving messages from unknown collectors;
Unauthorized accounts created using borrower information;
Spam or phishing after loan application;
Data sold or shared without consent.

The borrower may demand information, mitigation, deletion where appropriate, and may complain to the National Privacy Commission.

LVIII. Practical Steps Before Requesting Deletion

Before requesting deletion, the borrower should:

Screenshot the account page;
Save loan agreements;
Save payment records;
Secure proof of full payment;
Download transaction history;
Screenshot privacy policy;
Screenshot app permissions;
Save collection messages;
Revoke unnecessary phone permissions;
Update passwords if needed;
Identify official company contact channels.

This prevents loss of evidence after account closure.

LIX. Practical Steps After Requesting Deletion

After sending the request:

Save proof of sending;
Wait for response within a reasonable period;
Follow up in writing;
Record any continued marketing or collection;
Ask for written confirmation of deletion;
Ask for retained data details;
Check whether app login is disabled;
Monitor contacts for continued harassment;
File complaint if ignored or if misuse continues.

Do not rely only on verbal promises from call center agents.

LX. What to Ask the Lending App’s Data Protection Officer

A borrower may ask:

Who is your Data Protection Officer?
What personal data do you hold about me?
What data did you collect from my device?
Did you collect my phone contacts?
Did you share my data with collectors?
Which collection agencies received my data?
What is your lawful basis for retaining data?
How long will you retain my records?
What data can be deleted now?
What data can be blocked or restricted?
How do I opt out of marketing?
How do I file a privacy complaint with your company?

The answer should be specific, not generic.

LXI. What if the App Is Unregistered or Suspicious?

If the lending app appears unregistered, fake, or abusive, the borrower should be more cautious.

Practical steps:

Do not upload additional IDs;
Stop granting unnecessary permissions;
Preserve evidence;
Check the company name and address;
Request deletion in writing;
Report abusive practices;
Watch for identity theft;
Notify contacts not to respond to harassment;
Monitor bank and e-wallet accounts;
Consider replacing compromised IDs or accounts if serious misuse occurs.

An unregistered or illegal lender may ignore deletion requests, so regulatory and legal complaints may be necessary.

LXII. If the Borrower Used a Fake Name or Wrong Information

A borrower who provided false information may still have privacy rights, but the lender may retain data for fraud prevention, legal claims, or investigation.

Providing false information may create separate legal risks. Account deletion should not be used to conceal fraud.

A borrower in this situation should seek legal advice before submitting statements that may be used against them.

LXIII. If the Borrower Is a Victim of Identity Theft

Sometimes a loan account is opened using another person’s identity.

The victim should immediately:

Request account freeze or deletion;
Deny authorization in writing;
Request copies of documents used;
File a dispute with the lending app;
File a police or cybercrime report if needed;
File a privacy complaint;
Notify banks or e-wallets if accounts were used;
Monitor credit records;
Demand correction of any false credit report;
Preserve evidence.

In identity theft cases, deletion is important but so is correction and investigation.

LXIV. If the Lending App Uses Your Data After Deletion

If the app confirms deletion but later sends marketing, collection, or shares data, the borrower should:

Save the later communication;
Send a demand for explanation;
Ask what data source was used;
Demand deletion from third-party processors;
File a complaint if repeated;
Seek damages if harm occurred.

Deletion must be effective, not merely symbolic.

LXV. Data Deletion From Backups

Companies may retain data temporarily in backups even after deletion from active systems. However, backup retention should be limited and secured.

A good deletion response should explain whether data remains in backups and when it will be permanently purged or overwritten.

Backup data should not be restored into active use unless legally justified.

LXVI. Anonymization as an Alternative

In some cases, instead of deletion, the lending app may anonymize data so it no longer identifies the borrower.

Anonymized data may be used for:

Statistical analysis;
risk modeling;
product improvement;
compliance reporting;
fraud trend analysis.

True anonymization means the data can no longer reasonably identify the person. Merely removing the name while retaining phone number, ID number, or unique device ID may not be enough.

LXVII. Deactivation vs. Deletion vs. Blocking

These terms differ.

A. Deactivation

The account is disabled but data may remain.

B. Deletion

Data is removed or destroyed, subject to lawful retention.

C. Blocking

Data is retained but no longer actively processed except for limited lawful purposes.

D. Anonymization

Data is transformed so it no longer identifies the person.

A borrower may request deletion, but the lender may respond with blocking or restricted retention for legally required records. The response should be explained.

LXVIII. Demand Letter Through Counsel

If the app ignores informal requests or continues harassment, a lawyer may send a demand letter.

The letter may demand:

Account closure;
deletion or blocking of unnecessary data;
cessation of unlawful processing;
identification of third-party recipients;
proof of full payment recognition;
correction of false data;
deletion of phone contacts;
stop to harassment;
damages or settlement;
written undertaking of compliance.

A demand letter may be useful when the harm is serious or continuing.

LXIX. Civil Remedies for Damages

A borrower may consider civil action if misuse of personal data caused harm.

Possible damages include:

Moral damages for humiliation, anxiety, or emotional distress;
Actual damages for financial loss;
Exemplary damages for oppressive or malicious acts;
Attorney’s fees where legally recoverable;
Injunction or other relief in proper cases.

Civil action depends on evidence and applicable legal grounds.

LXX. Criminal and Administrative Exposure of Lending Apps

Depending on the acts committed, a lending app or its personnel may face:

Data privacy complaints;
administrative penalties;
regulatory sanctions;
criminal complaints for threats, coercion, or defamation;
cybercrime complaints;
civil damages;
suspension or cancellation of authority to operate;
complaints against collection agencies;
complaints for unfair or abusive collection practices.

The proper remedy depends on the specific facts.

LXXI. Borrower’s Responsibilities

Borrowers also have responsibilities.

A borrower should:

Read the privacy policy before applying;
Avoid granting unnecessary permissions;
Provide accurate information;
Keep loan records;
Pay obligations according to contract;
Communicate disputes in writing;
Avoid ignoring legitimate notices;
Request full payment certification;
Use official channels;
Preserve evidence of harassment;
Avoid making false complaints;
Exercise privacy rights in good faith.

Data privacy rights should not be misused to avoid lawful debts.

LXXII. Practical Privacy Checklist for Lending App Users

Before using a lending app:

Check company name and registration;
Read privacy policy;
Check app permissions;
Avoid apps requiring unnecessary contact access;
Do not upload more documents than needed;
Use strong passwords;
Save all loan terms;
Avoid borrowing from suspicious apps;
Check interest, penalties, and fees;
Know the data protection contact.

After using a lending app:

Save payment proof;
Request clearance;
Revoke app permissions;
Request account deletion after settlement;
Opt out of marketing;
Monitor contacts for harassment;
File complaints for misuse.

LXXIII. Frequently Asked Questions

1. Can I delete my lending app account in the Philippines?

Yes, you may request account deletion or closure. You may also request deletion, blocking, or restriction of personal data that is no longer necessary or is unlawfully processed.

2. Does deleting my account erase my loan?

No. Account deletion does not extinguish a valid debt. If you still owe money, the lender may retain necessary data for lawful collection and legal purposes.

3. Can I demand deletion after fully paying my loan?

Yes. After full payment, you have a stronger basis to demand deletion or blocking of unnecessary personal data, subject to lawful retention of certain records.

4. Can the app keep my loan records after account deletion?

Yes, if retention is necessary for legal, accounting, audit, regulatory, fraud-prevention, or claims-related purposes. But retention must be limited and justified.

5. Can the app keep my phone contacts?

The app should not retain or use phone contact data without lawful basis. You may demand deletion or blocking of contact data, especially if it was collected excessively or used for harassment.

6. Can the app contact my references?

It may contact references for legitimate and disclosed purposes, but it should not harass them, disclose unnecessary loan details, or threaten them.

7. Can the app contact people who are not my references?

This is highly questionable and may violate privacy rights, especially if the contacts were obtained from your phone without proper lawful basis.

8. Can the app contact my employer?

It may verify employment if lawfully disclosed and necessary, but it should not shame you, disclose debt unnecessarily, or harass your workplace.

9. Can the app refuse deletion because I have an unpaid loan?

It may refuse deletion of data necessary for lawful collection and enforcement, but it should still delete or stop processing unnecessary, excessive, or unlawfully obtained data.

10. Can I withdraw consent?

Yes, but withdrawal may not stop processing based on contract, legal obligation, legitimate claims, or regulatory compliance.

11. What if the app keeps sending marketing after I request deletion?

You may object, withdraw consent for marketing, demand cessation, and file a complaint if the app continues.

12. What if the app ignores my request?

Send a written follow-up, preserve proof, and consider filing a complaint with the National Privacy Commission or other regulators.

13. Can I file a privacy complaint against a lending app?

Yes, if the app violates your data privacy rights, such as unauthorized data sharing, excessive collection, refusal to honor rights, or harassment using personal data.

14. Is uninstalling the app enough?

No. Uninstalling removes the app from your phone but does not delete your account or data from the lender’s servers.

15. Should I request deletion before or after paying?

If you still owe money, the lender may retain necessary data. If fully paid, request deletion with proof of payment and ask for written confirmation.

16. Can I demand deletion of my ID photo?

You may request deletion if it is no longer necessary. The lender may retain it for lawful record-retention purposes if justified, but access should be restricted and protected.

17. Can a contact reference demand deletion?

Yes. A person contacted by a lending app may request deletion or blocking of their personal data if they are not legally liable and their data is being processed without lawful basis.

18. Can the lending app share my data with collectors?

It may share necessary data with lawful collectors under proper safeguards, but collectors must not misuse or disclose the data unlawfully.

19. Can I sue for damages?

Possibly, if unlawful processing caused harm such as humiliation, financial loss, emotional distress, or reputational damage.

20. What should I do first if collectors are harassing my contacts?

Preserve evidence, send a written demand to stop unauthorized processing, request deletion of contact data, report to the lender’s data protection officer, and consider filing complaints with the proper authorities.

LXXIV. Conclusion

A borrower in the Philippines has the right to request deletion, blocking, removal, or restriction of personal data held by a lending app, especially when the data is no longer necessary, was unlawfully collected, is excessive, inaccurate, or is being used for unauthorized purposes such as harassment, public shaming, or improper contact of third persons.

However, the right to delete a lending app account is not absolute. If the borrower still has an outstanding loan, the lender may retain and process personal data necessary for lawful collection, contract enforcement, compliance, fraud prevention, and legal claims. Even after full payment, the lender may retain limited records for accounting, regulatory, audit, tax, or dispute purposes. But it must not retain everything indefinitely or use personal data for unrelated purposes.

The best approach is to send a clear written request to the lending app’s data protection officer or official privacy channel. The request should ask for account closure, deletion or blocking of unnecessary personal data, cessation of marketing, restriction of third-party sharing, deletion of unlawfully collected phone contacts, and an explanation of any data retained.

Borrowers should remember that uninstalling the app is not enough. They should preserve loan records, proof of payment, privacy requests, and evidence of harassment. If the lending app ignores the request or continues to misuse personal data, the borrower may file a complaint with the National Privacy Commission and, where appropriate, with other regulators or law enforcement.

The guiding principle is simple: a lender may collect and retain what is lawful, necessary, and proportionate, but it may not weaponize personal data. Debt collection does not cancel privacy rights. A borrower may owe money, but the borrower remains a data subject protected by Philippine law.