The Court of Appeals (CA) has granted the petition of a local car dealer that questioned an order from the National Privacy Commission (NPC) regarding an identity theft complaint.

In an 18-page decision dated February 21 and made available online recently, the CA 3rd Division granted the petition filed by Toyota Shaw, Inc. and set aside the 2017 order of the NPC for the dealer to respond to alleged violations of Republic Act (RA) 10173 or the Data Privacy Act.

The CA ruled that the complainant, Dunstant Egar, filed the case beyond six months from the alleged occurrence of the data breach, did not pay the required filing fees, and did not comply with other requirements of filing, including having his complaint verified or placed under oath.

“The violation by a government entity of its own rules and the basic tenet of due process is grave abuse of discretion,” the court ruled.

The case began in 2015 when Egar went to the Toyota showroom with the intent to buy a van.

He filled up a credit application form, provided identification cards for photocopying, and paid a reservation fee of PHP5,000.

A few days later, he changed his mind and was refunded the PHP5,000 but his documents were not withdrawn.

He later received calls from a bank reminding him of his unpaid amortizations and found out from another bank when he applied for a loan that he has records of non-payment.

Toyota confirmed that it had released a brand-new van in Egar’s name as the purchaser but had no information on who had actually received the unit and paid for the down payment.

Egar e-mailed his case to the NPC in 2017, with the commission treating it as a formal complaint despite it being just an inquiry.

The dismissal of the order, the CA said, is “without prejudice to the NPC taking further action on the basis of the facts alleged in the complaint consistent with RA 10173.” (PNA)