[ G.R. No. 271360. August 13, 2025 ] THIRD DIVISION
[ G.R. No. 271360. August 13, 2025 ]
GRACE M. TRIMILLOS, PETITIONER, VS. FCASH GLOBAL LENDING, INC., REPRESENTED BY SIOLY M. AMPARO, RESPONDENT. D E C I S I O N
INTING, J.:
Before the Court is a Petition for Review on Certiorari[1] under Rule 45 of the Rules of Court filed by petitioner Grace M. Trimillos (Trimillos) assailing the Decision[2] dated May 17, 2023, and the Resolution[3] dated December 11, 2023, of the Court of Appeals (CA) in CA-G.R. SP No. 169222. The assailed issuances reversed and set aside the Decision[4] dated November 5, 2020, and the Resolution[5] dated March 11, 2021, of the National Privacy Commission (NPC) in NPC 19-605.
The Antecedents
On July 26, 2019, Trimillos filed a Complaint[6] with the NPC against FCash Global Lending Inc., (FCash), operating the application “Fast Cash,” for violating several provisions of Republic Act No. 10173 or the “Data Privacy Act of 2012” (DPA). Trimillos alleged that FCash accessed her phone’s contact list without her authority and informed everyone on the list regarding the status of her loan with the latter, to wit:
Unauthorized access on my phone’s contact list. Informing everyone about my loan with the company. The worst part is, the last message my co-worker[s] and friends’ got was they were my guarantors and if no payment was made, they are being forced to pay on my behalf. They even called my friends and co-workers though they have nothing to do about my transactions with them.[7]
As a result thereof, Trimillos claims that her reputation was besmirched.[8] Consequently, NPC ordered the parties to appear on September 5, 2019, for a Discovery Conference. Due to the absence of FCash, it was reset on October 31, 2019.[9] On September 13, 2019, Trimillos submitted screenshots of the text messages allegedly sent by FCash and a print-out of her email correspondence with the National Telecommunications Commission (NTC).[10] The alleged malicious text message reads:
To: Grace Trimillos Magandang Araw! Hindi kami nagkulang ng paalala sa inyo upang maayos ang inyong pagkakautang sa ISANG ONLINE LENDING COMPANY, pero nanatili kayong walang tugon at pakipag communicate. Dahil dyan[,] napagdesisyonan naming kayo ay aming isusumite sa legal proceedings ng SMALL CLAIMS sa pamamagitan ng pag babarangay sa inyo at ifile sa CIVIL COURT upang ito at mabayaran sa pamamagitan ng WRIT OF ATTACHMENT AND GARNISHMENT o ang pagkuha ng inyong personal property bilang kabayaran, kung ang buong halaga ng pagkakautang ay hindi mabayaran. Maraming salamat. ANG DAHILAN KUNG BAKIT KAYO NAKATANGGAP NG MENSAHE NA ITO DAHIL GINAWA KAYONG CONTACT REFERENCE NG PANGALAN NA NASA TAAS AT IYON ANG LAGI NYANG DINADAHILAN KASABWAT KAYO SA LAHAT NG GINAGAWA NIYANG TRANSACTION SA MGA UTANG NIYA[.][11]
On October 1, 2019, Trimillos requested via email that the Discovery Conference be set at an earlier date. Granting the request, NPC issued an Order for both parties to appear on October 10, 2019.[12] During the Discovery Conference, both parties manifested their willingness to avail themselves of the mediation proceedings of the NPC. Unfortunately, they were unable to reach an agreement which resulted in the resumption of the proceedings. Upon termination of the Discovery Conference, NPC ordered FCash to file its responsive comment. Based on records, no responsive comment to the Complaint was filed by FCash.[13] There being no other pleadings filed, the case was submitted for resolution.[14]
The Ruling of the NPC
In a Decision[15] dated November 5, 2020, the NPC awarded nominal damages to Trimillos and recommended the prosecution of FCash for the crimes under Sections 28[16] and 31[17] of the DPA. The dispositive portion of the Decision reads:
WHEREFORE, premises considered, FCash Global Lending Inc. is hereby ORDERED by this Commission to pay Grace M. Trimillos nominal damages in the amount of fifteen thousand pesos ([PHP] 15,000.00). This Commission FORWARDS this Decision and a copy of the pertinent case records to the Department of Justice, recommending the prosecution of FCash Global Lending Inc. for the crimes of Processing of Personal Information and Sensitive Personal Information for Unauthorized Purposes as provided under Section 28 and Malicious Disclosure as provided under Section 31 of Republic Act No. 10173 otherwise known as the Data Privacy Act of 2012. SO ORDERED.[18]
The NPC explained that FCash gathered personal information in excess of what was necessary and processed them for purposes other than those stated in their own privacy policy, particularly when it sent out messages to the contacts of Trimillos.[19] In addition, the unauthorized processing of personal information was done with malice when the messages reveal FCash’s unquestionable intention to shame Trimillos and jeopardize her reputation until the latter settled her obligations.[20] As a result thereof, NPC awarded Trimillos nominal damages in recognition of her violated privacy right.[21] FCash filed its Motion for Reconsideration,[22] but the NPC denied it for lack of merit in its Resolution[23] dated March 11, 2021. Hence, FCash filed a Petition for Review[24] before the CA.
The Ruling of the CA
The CA granted the Petition, to wit:
WHEREFORE, the appeal is GRANTED. The Decision dated 5 November 2020 and Resolution dated 11 March 2021 of the National Privacy Commission are REVERSED and SET ASIDE and the instant case is hereby DISMISSED. SO ORDERED.[25]
In reversing the ruling of the NPC, the CA ruled that the screenshots of the text message allegedly sent by FCash to Trimillos are inadmissible in evidence. The CA noted that Trimillos failed to have the screenshots authenticated by any of her supposed witnesses, in violation of the Rules on Electronic Evidence; thus, there is no admissible evidence to support a finding in her favor.[26] Trimillos sought reconsideration,[27] but the CA denied it in a Resolution[28] dated December 11, 2023. Hence, Trimillos filed the present Petition.
Petitioner Trimillos’ Arguments
In the main, Trimillos contends that the CA erred in finding the evidence inadmissible when in fact FCash has already waived its right to object thereto by refusing to participate in the proceedings before the NPC. Likewise, the CA should not have considered the issue of admissibility of evidence which was only raised for the first time on appeal.[29] Be that as it may, Trimillos argues that the findings of the NPC should not be so casually dismissed on technicality, as strict adherence to rules of procedure is not a feature in administrative proceedings. Accordingly, Trimillos submits that she was able to prove by substantial evidence that FCash violated the DPA.[30] In a Resolution[31] dated June 3, 2024, the Court required FCash to file its comment.
Respondent FCash’s Arguments
In its Comment,[32] FCash argues that unauthenticated electronic evidence is both inadmissible and without probative value. Even assuming arguendo that they may be admitted in evidence, they cannot be accorded evidentiary weight for failure to observe the Rule of Electronic Evidence for their authentication.[33] Furthermore, FCash avers that the NPC Rules of Procedure do not provide for formal offer of evidence; thus, the rule that objections to admissibility of evidence should be made after its offer cannot apply in the instant case.[34] On the contrary, FCash claims that its first opportunity to raise objection thereto was upon the receipt of the NPC Decision admitting the unauthenticated electronic evidence to which it promptly and timely filed its Motion for Reconsideration. Accordingly, there is no waiver of objection to the admissibility of unauthenticated electronic evidence.[35]
The Issue
For the Court’s resolution is whether the CA erred in finding that the evidence presented by Trimillos are inadmissible for failure to comply with the authentication requirements under the Rule on Electronic Evidence.
The Ruling of the Court
The Petition is impressed with merit. Preliminary to the resolution on the merits of the issue at hand, the Court deems it necessary to discuss the rules of procedure[36] for initiating a complaint with the NPC. The NPC is an independent body mandated to administer and implement provisions of the Data Privacy Act (DPA), and to monitor and ensure compliance of the country with international standards set for data protection. In the exercise of its quasi-judicial function, the NPC is authorized to receive complaints for violations of the DPA and institute investigations relative thereto.[37] The NPC, motu propio, or persons who are subject of a privacy violation or personal data breach, or who are otherwise personally affected by a violation of the DPA may file a complaint.[38] Once a complaint is filed, the NPC shall assign an investigating officer who shall evaluate the complaint to determine (1) whether its allegations involve a violation of the DPA or related issuances; and (2) if, based on its allegations, there is reason to believe that there is a privacy violation or personal data breach.[39] If, the allegations are deemed to be sufficient in form and substance, the investigating officer shall issue an order for all parties to confer, not later than ten days from receipt of the said order, whether discovery of information and of electronically-stored information is reasonably likely to be sought in the proceeding.[40] A copy of the complaint, together with its supporting evidence, shall be included in the order to confer for discovery. The agreement of the parties therein will be reduced into a Discovery Conference Report to be signed and submitted by all parties to the NPC within five days of the conclusion of the conference.[41] Following the receipt of the Discovery Conference Report, the investigating officer shall issue an order directing the respondent to submit within ten days from receipt thereof, a responsive comment to the complaint, together with any supporting documents they may have, including the affidavits of any of the respondent’s witnesses, if any. The investigating officer, upon his or her discretion, may require the complainant to file a reply within ten days after receipt of the order requiring the filing of a reply. Such an order may also require the respondent to file a rejoinder within ten days after receipt of the reply.[42] In the course of the investigation, the complainant and/or respondent may be required to furnish additional information, document or evidence, or to produce additional witnesses. The parties shall have the right to examine the evidence submitted, which he or she may not have been furnished, and to copy them at his expense.[43] If the respondent does not file a comment, the investigating officer may consider the complaint as submitted for resolution. The respondent shall, in any event, have access to the evidence on record.[44] Upon the termination of the investigation, the investigating officer shall produce a fact-finding report, which shall include the results of the investigation, the evidence gathered, and any recommendations. The report shall be submitted to the Office of the Commissioner.[45] The Commissioner shall review the evidence presented, including the fact-finding report and supporting documents. On the basis of the review, the NPC may: (1) promulgate a decision; or (2) order the conduct of a clarificatory hearing, if in its discretion, additional information is needed to make a decision.[46] The decision of the NPC shall adjudicate the issues raised in the complaint on the basis of all the evidence presented and its own consideration of the law. A copy of the decision shall be served upon the parties, for information and compliance with any directive contained therein.[47] In the present case, the parties appeared before the NPC for a Discovery Conference on October 10, 2019. By this time, the evidence submitted by Trimillos on September 13, 2019, were already made available for examination of the parties. Upon the termination of the Discovery Conference, FCash was ordered to file its responsive comment to the Complaint which it failed to do so. Consequently, the NPC issued a Decision in favor of Trimillos.[48] Herein petitioner Trimillos avers that the CA erred in reversing and setting aside the decision of the NPC due to inadmissible evidence when any objection to the admissibility of evidence was already waived by FCash’s refusal to file its comment before the NPC. Moreover, Trimillos submits that the issue of admissibility of evidence cannot be raised for the first time on appeal. The Court sustains the petitioner’s position. Settled is the rule that the failure to interpose a timely objection to evidence shall be considered a waiver of the objection.[49] The Court in Lorenzana v. Lelina[50] is instructive, to wit:
In order to exclude evidence, the objection to admissibility of evidence must be made at the proper time, and the grounds specified. Objection to evidence must be made at the time it is formally offered. In case of documentary evidence, offer is made after all the witnesses of the party making the offer have testified, specifying the purpose for which the evidence is being offered. It is only at this time, and not at any other, that objection to the documentary evidence may be made. And when a party failed to interpose a timely objection to evidence at the time they were offered in evidence, such objection shall be considered as waived. This is true even if by its nature the evidence is inadmissible and would have surely been rejected if it had been challenged at the proper time. Moreover, grounds for objection must be specified in any case. Grounds for objections not raised at the proper time shall be considered waived, even if the evidence was objected to on some other ground. Thus, even on appeal, the appellate court may not consider any other ground of objection, except those that were raised at the proper time.[51] (Emphasis supplied; citations omitted)
As to the admissibility of electronic evidence in particular, the Court in Ang v. Court of Appeals[52] ruled that an objection on the ground of lack of authentication—e.g., photograph sent via text message—shall be deemed waived if not raised at the time of formal offer:
Four. Rustan claims that the obscene picture sent to Irish through a text message constitutes an electronic document. Thus, it should be authenticated by means of an electronic signature, as provided under Section 1, Rule 5 of the Rules on Electronic Evidence (A.M. 01-7-01-SC). But, firstly, Rustan is raising this objection to the admissibility of the obscene picture, Exhibit A, for the first time before this Court. The objection is too late since he should have objected to the admission of the picture on such ground at the time it was offered in evidence. He should be deemed to have already waived such ground for objection.[53] (Citation omitted)
Simply put, any objection to the admissibility of evidence should be made upon offer of the evidence in question or as soon thereafter as ground against its admissibility becomes apparent; otherwise the opposing party shall be regarded to have waived its objection. Consequently, the subject evidence will form part of the records of the case as competent and admissible evidence.[54] In the same vein, basic considerations of fairness and due process require that arguments or issues not raised in the original proceedings cannot be raised for the first time on appeal.[55] This is true whether the decision elevated for review originated from a regular court or an administrative agency or quasi-judicial body. The rationale is that quasi-judicial bodies, like the NPC are also bound by rules of fair play and due process, and parties are expected to raise all their objections and defenses at the earliest opportunity. Any issue raised for the first time on appeal is barred by estoppel.[56] In the assailed Decision, the CA cited Cadajas v. People[57] to emphasize that admissibility of evidence shall be governed by the rules on relevance, materiality, authentication of documents, and exclusionary rules under the Rules on Evidence. In reversing the ruling of the NPC, the CA explained that, unlike in Cadajas where the pieces of evidence— photos and conversations from a Facebook Messenger account—were properly authenticated, Trimillos failed to have the text message authenticated by any of her supposed witnesses through an affidavit in accordance with the Rules on Electronic Evidence.[58] However, in the same case, the Court also recognized that inadmissible evidence may be admitted if not challenged at the proper time and such issue may not be raised for the first time on appeal, viz:
In any case, it bears pointing out that petitioner failed to raise his objection to the admissibility of the photos during the proceedings in the RTC. Basic is the rule that in order to exclude evidence, the objection to admissibility of evidence must be made at the proper time, and the grounds therefore be specified. Objection to evidence must be made at the time it is formally offered. In case of documentary evidence, offer is made after all the witnesses of the party making the offer have testified, specifying the purpose for which the evidence is being offered. It is only at this time, and not at any other, that objection to the documentary evidence may be made. When a party failed to interpose a timely objection to evidence at the time they were offered in evidence, such objection shall be considered as waived. This is true even if by its nature the evidence is inadmissible and would have surely been rejected if it had been challenged at the proper time. As a complimentary principle, it is well-settled that no question will be entertained on appeal unless it has been raised in the proceedings below. Points of law, theories, issues and arguments not brought to the attention of the lower court, administrative agency or quasi-judicial body, need not be considered by a reviewing court, as they cannot be raised for the first time at that late stage. Basic considerations of fairness and due process impel this rule. Any issue raised for the first time on appeal is barred by estoppel. By failing to timely raise his objection to the admissibility of the photos, petitioner is deemed to have already waived the same. Thus, the photos taken from his Facebook Messenger account are admissible in evidence.[59] (Emphasis supplied)
Here, there is no dispute that Trimillos’ indispensable evidence to support her complaint is the text message allegedly sent by FCash to everyone appearing in her contact list. However, she failed to allege with particularity the persons who received said text messages and submit affidavits of said persons. Neither was the text message authenticated by any of the alleged recipients. Hence, Trimillos failed to comply with the rules of admissibility under Rules on Electronic Evidence, as follows:
RULE 3 Electronic Documents
SECTION 2. Admissibility. – An electronic document is admissible in evidence if it complies with the rules on admissibility prescribed by the Rules of Court and related laws and is authenticated in the manner prescribed by these Rules.
RULE 5 Authentication of Electronic Documents
SECTION 1. Burden of proving authenticity. – The person seeking to introduce an electronic document in any legal proceeding has the burden of proving its authenticity in the manner provided in this Rule. SECTION 2. Manner of authentication. – Before any private electronic document offered as authentic is received in evidence, its authenticity must be proved by any of the following means:
(a)
by evidence that it had been digitally signed by the person purported to have signed the same;
(b)
by evidence that other appropriate security procedures or devices as may be authorized by the Supreme Court or by law for authentication of electronic documents were applied to the document; or
(c)
by other evidence showing its integrity and reliability to the satisfaction of the Judge.
While there had been a ground to question its admissibility, it is clear that FCash failed to make a timely objection on the presentation and offer of the screenshots. To be sure, the screenshots of the text message were already submitted by Trimillos to the NPC before the Discovery Conference. Despite the availability for examination of said evidence, FCash failed to raise any objection thereto. What is more, FCash did not file a responsive comment on the complaint, where it could have threshed-out its counter-arguments against Trimillos, including its objection to the admissibility of the unauthenticated text message. Contrary to its allegations, the Motion for Reconsideration filed before the NPC likewise failed to raise any objection to the admissibility of the evidence presented by Trimillos. Such issue was only advanced by FCash for the first time in the Petition for Review filed before the CA. At the risk of being repetitive, grounds for objections not raised at the proper time shall be considered waived. Thus, even on appeal, the CA may not consider any other ground of objection, except those that were raised at the proper time.[60] In view of the foregoing, the CA is already barred by estoppel from reviewing the admissibility of the evidence which was not objected to by FCash before the NPC. Accordingly, the CA erred in reversing the decision of the NPC on the ground of inadmissible evidence. Finally, the question on the probative value of the unauthenticated text message to support NPC’s ruling invites a re-determination of questions of fact which is not within the province of a petition for review on certiorari under Rule 45 of the Rules of Court. Moreover, it is axiomatic that the Court cannot substitute its own discretion over the factual findings of the quasi-judicial body, whose decisions, in a long line of jurisprudence, were afforded respect and conclusiveness owing to the expertise they possess on specific matters under their jurisdiction.[61] ACCORDINGLY, the Petition for Review on Certiorari is GRANTED. The Decision dated May 17, 2023, and the Resolution dated December 11, 2023 of the Court of Appeals in CA-G.R. SP No. 169222 are REVERSED and SET ASIDE. The Decision dated November 5, 2020, and the Resolution dated March 11, 2021 of the National Privacy Commission in NPC 19-605 are REINSTATED. SO ORDERED. Caguioa (Chairperson), Gaerlan, and Dimaampao, JJ., concur. Singh,* J., on leave.