Monthly Archives: July 2017

Lawbytes 127: ADVOCATING FOR THE “RIGHT TO BE (DIGITALLY) FORGOTTEN” OF THE VICTIMS OF REVENGE PORN: ATTENTION NATIONAL PRIVACY COMMISSION! (Copyright by Dr. Atty. Noel Guivani Ramiscal)

Posted by thecyberlawyer on

In my cyberlaw advocacies concerning the rights of victims of Sexual Orientation and Gender Identity (SOGI) discrimination, I encounter different, ever nefarious, ways of how sexual predators and their cohorts try to manipulate and make their victims suffer. Consider the case of R, a normally smart woman, except when she fell in love. She acceded to her lover’s request of digitally filming their multiple lively sexual congresses, to pacify her lover’s entreaties that he would keep them as a private reminder of their love, when he goes overseas, and as an incentive for him to come back to her.

The fickleness of Fate and her lover’s voracious sexual appetite prevented that from happening. The current sexmate of her lover discovered the recordings and in a jealous fit, posted them on a website that panders to pornography. This site encourages people to post videos of their exes in compromising sexual positions as a way of getting back at them. As an added “attraction” the site has an affiliated “digital reputation” management firm that contacts the victims of the site and offers them the opportunity to have the offending videos deleted for a price, which is usually exorbitant. The offer has an expiry date and if the contacted entity cannot come up with the money to pay the firm, the video stays on the site and it is “shared”, that is, for a price to other pornographic sites. R could not pay, and even if she had the resources to pay the price, there is actually no assurance from the digital reputation firm that the video had not already been previously copied and circulated to other websites. So this is one way of perpetuating online the private intimate details of a victim’s life without the consent and knowledge of the victim.

Prior to the Data Privacy Law, there are two legal remedies that can be invoked against cyber privacy predators in the Philippine context that could assist victims like R. The earliest remedy, which recently got a judicial boost from the ruling of the Supreme Court in the Vivares case is the writ of habeas data. This case established the rule that any person whose information (paper or electronic) is subject to the collection by any entity without the person’s consent can go to court via a writ of habeas data and have the collected information (among others) destroyed. The entity’s purpose or intent in collecting the information is immaterial and it is also not relevant if the entity engaged in this activity for personal enjoyment or as a business concern.

The second, later and more obvious remedy is the Anti-Boso Law, which criminalizes the act of disseminating or distributing in real time or in the internet, (among others) the act of sexual intercourse between two partners without the consent of the parties involved, even if they originally consented to the filming of the act itself.

In my lectures for lawyers and other professionals and SOGI advocates, I offer another legal alternative, i.e., the Intellectual Property Code. If the victim actually produced, acted, or had a hand in making the digital recording, then any unauthorized distribution of that recording, without the victim’s consent, can be considered an infringement on the victim’s copyright. This is considered a criminal offense because under the IP Code, copyright infringements do not only have civil aspects but are crimes as well.

One can also apply the Cybercrime Prevention Act in this regard because in the commission of the crime, a computer and/or computing system/network was definitely utilized. This will increase the criminal penalties of the accused by one degree.

Under the current Data Privacy Law, victims of revenge porn can take refuge in the law’s recognition of the right of any data subject to be “forgotten” or digitally “erased” from the web, or at least certain portions of the Internet. It all started with a Spanish case about (of all people) a lawyer trying to address the damage to his reputation concerning his cases pertaining to his unpaid debts which he already settled. Google Spain continually came up with search lists that included his cases and he sought to have these materials “delinked” to his name, and he succeeded.
The issue with the Philippine Data Privacy Law and its Implementing Rules and Regulations (IRR) promulgated by the National Privacy Commission (NPC) last September 2016, is that they contain no Guidelines or procedure as to how to operationalize or actualize this right.

The NPC as the vanguard of the data privacy rights of data subjects, like victims of revenge porn, must not gloss over this right. The NPC can consider the three legal remedies I have discussed in this article and incorporate them in whatever procedure they will formulate to actualize this right.

What would be truly useful is if NPC can provide assistance to victims who desire to deal with digital reputation management firms in an informal and effective manner, assuming that the victims do not desire to file criminal cases. What is also crucial is if NPC can also clarify the extent of “digital forgetting” as far as search engines go. If for example the offending material appeared in Google search engine, can victims have recourse to Google worldwide or merely Google.ph?

In the meantime, SOGI advocates and legal practitioners who are engaged in procuring redress for revenge porn victims can choose to avail of all these remedies I have discussed and see which one is most effective for their clients.

One final caveat, even though these remedies are available, and the extraterritorial reach of the Data Privacy law and its IRR, (and relatedly the Philippine Cybercrime Prevention Acts and its IRR) can actually cover any state in the entire planet, there is no assurance that any Philippine court or agency, including the NPC, can actually and effectively enforce these remedies against foreign maintainers of revenge porn sites.

Lawbytes 126: OPERATIONALIZING DATA PRIVACY IN LAW FIRMS (Copyright by Dr. Atty. Noel Guivani Ramiscal)

Posted by thecyberlawyer on

My cyberprivacy advocacy have taken me to some interesting places, including law firms. When UPIAJ invited me to lecture at the ACCRALAW Tower for the ACCRALAW lawyers last June 17, 2017, on data privacy, I jumped at the opportunity of scrutinizing the policies and practices of this law firm which has a long and illustrious history in the Philippine legal industry, and therefore a good benchmark for Philippine law firms, as far as protecting data privacy is concerned. My objective was to perform an informal external audit to see how the firm has complied with some of the most crucial requirements of the data privacy law (R.A. 10173) which is probably one of the most controversial and challenging laws that all Philippine entities that fall within its scope as a “personal information controller” (PIC) must deal with.

The firm’s website has a News & Updates portion which contained an article concerning the deployment of the iManage system that apparently was done last January of this year. The article states:

xxx In iManage, ACCRALAW has deployed a sophisticated Work Product Management system that encompasses document management, email management, knowledge management, analytics, process automation and more.”

In the first few months of going live with iManage Work, ACCRALAW has already experienced significant benefits. iManage Work integrates seamlessly with ACCRALAW’s existing practice management system, so that when a new matter is created, a workspace is automatically generated in iManage Work, without the need of manual intervention. Within minutes, users can start saving and publishing documents to this centralized repository, allowing anyone connected to the matter to search, access, and view the related files — saving valuable time and enabling more efficient collaboration.

iManage Work has been rolled out across all of the Firm’s practice departments. As a result, the Firm can better carry out work on behalf of its clients in areas ranging from Litigation and Dispute Resolution, Corporate and Special Projects and Intellectual Property, to Labor, Tax and other specializations. [ACCRALAW Deploys iManage for Document and Email Management,January 30, 2017, http://www.accralaw.com/news-updates/accralaw-deploys-imanage-document-and-email-management, accessed July 25, 2017]

In my lecture, I asked the over 40 lawyers present several questions including: Were ACCRALAW’s clients informed, and their written consent secured re: their personal information being subject to “processing” thru the iManage system prior to its roll-out? I further asked if there was a Privacy Impact Assessment (PIA) made prior to the deployment of iManage with respect to their clients who are, in all probability, the “data subjects” whose data are inputted in the iManage system. The response was not positive or clear. To be fair, none of the firm’s IT experts, nor the head of the MIS department, nor its Chief Privacy Officer was there to elucidate on this issue.

The article merely mentioned that before “deciding on a Work Product Management system, ACCRALAW exercised due diligence by visiting several legal firms in neighboring Malaysia that were iManage customers, to hear their opinions first-hand.” If its clients’ consent was secured and a PIA was actually done, then these should have been mentioned in the article. Gathering the opinions of iManage users cannot substitute for the firm actually securing their clients’ consent to the iManage system and conducting the actual PIA that are legally mandated and should have been part of the firm’s due diligence. It is also a legal must that the iManage system must be registered with the NPC, as part of the compliance processes that ACCRALAW as a PIC must undergo. I was not able to get any confirmation if iManage was already registered with NPC.

One good thing about the ACCRALAW’s implementation of the iManage system is that the firm does not utilize the hybrid cloud storage and infrastructure services offered by iManage. iManage’s hybrid cloud purportedly services over 1,800 law firms globally. In this connection, I discussed some of the dangers of entrusting clients’ data to cloud services. By choosing not to hand over their clients’ data to iManage’s cloud, and by deciding to develop their internal expertise in managing and dealing with data issues, ACCRALAW will thus avoid the data security breaches that plague the cloud. It is also commendable that the firm is training its own people on e-data management because they can develop the expertise that can be crucial in the electronic discovery of data that is in the iManage system which could be the subject of future litigation.

Another IT system the ACCRALAW is using is the Elite system for its financial records. The firm has an access policy which contains restrictions and delineates the people who are allowed to access these important records and the system. Other records of significance are located off-site. These are crucial procedures and protocols that can further avoid data security breaches. It is not clear though if the Elite system is registered with NPC.

As of the time of this blog’s publication (July 25, 2017), the ACCRALAW website still does not contain any posting of the law firm’s privacy policy or privacy code. I told the audience that they should pose this document on their website as part of their compliance with the NPC directives. One member of the audience said that they are still at work in crafting their policy/code.

I also found out that the firm has no social media policy and no Bring-Your-Own-Device (BYOD) policy which can create problems for the firm. While lawyers are supposed to observe the confidentiality of communications between them and their clients, I told the audience that cases abound in different jurisdictions where lawyers using social media have honoured this professional obligation in the breach. Some of the junior lawyers who brought their mobile phones with them confirmed during my lecture that these devices are owned by them personally. Assuming that they use these e-devices for their professional work as well, complications can arise due to the commingling of personal and professional data on these e-devices, if any of these data become the subject of litigation. Also, lawyers tend to be mobile, increasing the risk of security breaches on these devices. Firm clear policies on these matters, including access policies to the firm’s IT assets, and their effective implementation can actually serve as an insurance and defense for the firm in any future controversy that involve data breach and gross negligence charges levelled against it.

There are a lot of things that lawyers need to know in securing their own data as well as the data of their clients. The Chief Privacy Officer of any organization has their work cut out for them. The Data Privacy Law was passed last 2012. In a seminar I attended last January of this year, NPC Deputy Commissioner Ivy Patdu made the pronouncement that even if the law’s Implementing Rules and Regulations were promulgated over four years after its passage, the NPC operates on the principle that all PICs should have formulated and implemented the necessary policies, safeguards, and protocols that were clearly mandated by the law way back in 2012. All PICS (including law firms like ACCRALAW), as it stands, only have up to September 9, 2017 to comply with the registration requirements under this law. Law firms are particularly placed on the spotlight because they are supposed to be models of legal and regulatory compliance. Here is trusting that all Philippine law firms can duly and timely comply with the NPC requirements.