A data privacy lawyer’s take on issues with ‘Cebu Updates’ account

Cebu City Hall executives Collin Rosell and Jerone Castillo both lawyers are given the enviable task of recovering ownership of the “property of Cebu City.”

CEBU CITY, Philippines – As Cebu City Hall executives are bent on recovering a former Cebu City Public Information Office (PIO) Facebook page, questions on data privacy and page ownership surface. Who really owns the page? What happens to the private information obtained while it was a city PIO page? And is this data being used to monetize the page?

In one of the city hall press conferences that City Administrator and lawyer Collin Rosell led with Atty. Jerone Castillo (city attorney, special assistant to the mayor, and acting budget officer) last week, Rosell told reporters that they instructed the city police to do what is proper “to recover the property of the city.”

The city officials echoed this call to the National Bureau of Investigation and the City Legal Office during the media briefing aired live on the current city PIO Facebook page.

“We also requested the police to determine kinsa ang nag-pretend to be the administrators of the account when, in fact, it is the city account. We already have data from them. So, expect that there will be cases filed against pretenders of an account that is supposedly owned by the City of Cebu,” Castillo said during the press briefing last Friday, July 21, 2023.

READ: Cebu Updates is a property of Cebu City, city lawyers ask PNP, NBI to help in recovering account

The city hall executive, however, did not specify what precise actions they intend to take in the future or how far along they are in their efforts to ‘recover’ the supposed local government property. However, the lawyer has already stated that anyone found to have ‘pretended’ to be the page’s administrator will face consequences.

As to what specific charges they will file against whom, these remain to be seen.

CDN Digital tried to get the side of the Cebu Updates but messages to its official Facebook page were left unanswered as of press time.

The city official’s premise was that the Facebook page, now with hundreds of thousands of followers, was a city government property–a Facebook page for the Cebu City PIO during the time of the late mayor Edgardo Labella.

Page ownership

The subject of page ownership, according to data privacy attorney Cecilia Soria, complicates the situation. When the contested Facebook page was established years ago, was there any official documentation in the local government stating that it is the city’s official Facebook page? 

The Cebu City government is referring to the “Cebu Updates” Facebook page–which, based on its Page Transparency Section, was created as Cebu City Public Information Office in May 2012.

In August 2016, it changed its name to “City of Cebu, Public Information Office, before it changed its name again to “Cebu City Public Information Office on January 27, 2018.”

The last name update of the page was on January 5, 2022, to “Cebu Updates.”

The page, currently, has at least 311,000 followers and 236,000 likes.

The page is managed by at least seven persons, according to Meta, formerly Facebook. Its posts include local updates for Cebu, news stories published from local and foreign news media outlets, and cryptic remarks on local politics.

But how does this affect an ordinary Cebuano netizen?

Issue on data privacy

Atty. Soria said the primary inquiry that not only the government but a private individual (who followed and shared data on the page) can make is to ask how their personal data is being protected by its supposed administrator.

The data privacy lawyer said that managers of Facebook pages are considered Personal Information Controllers, a concept provided in the Philippine Data Privacy Act, who have certain obligations to the data subjects, or in this case, the personal data processed by the page.

In this case, the data subjects that can be considered are those Facebook users who either liked or followed the pages—because the administrator of the Facebook page can see their activities. These personal data are protected by the Data Privacy Act.

Soria said the next requirement for the Data Privacy Act is the use of personal data only on a “lawful” basis.

“Tinitingnan natin to na when the Facebook users like or follow that page or if they commented or if they sent private message or if they submitted their personal information via private message, dun mo maipapakita na nag consent sila na gamitin mo yung personal data nila. Pero, gagamitin mo lang yun, only in the context of ng paano nila binigay,” she said.

“So, kunwari, pag ako nag comment dun, then ang expectation ko, hindi mo gagamitin ang data ko na ibebenta mo sa iba na…[for example,] kasi PIO [page] siya dati diba, you can expect that maybe somebody there is asking about a local government service and then maybe the administrator is saying that maybe I can help you out but give me your contact information so I can follow up with somebody and when I know the answer, I will communicate it to you,” she added.

“Kasi PIO talaga… if it was somebody na hindi mo kilala, magdadalawang isip ka na ibigay ang information, but since you know and it was represented to the people that this is an official page of the PIO, then there’s a certain level of trust,” Soria furthered.

This covers Facebook users who liked and followed the page when it still functioned as Cebu City PIO.

In her opinion, Soria said that when the administrators of the page continued using the data as a private entity, it could be considered unauthorized use already and that the current administrators of the page should have the information that they got when it was the city PIO page, deleted.

Ownership

Without official paperwork in the LGU, it could be hard to establish that the said page is the designated official Facebook page of the city government, Soria said.

“If there are no rules with respect to the transfer, they can also argue na we did not commit a violation at least with respect to the asset of the local government kasi kung wala namang official document saying nga this is ours and then wala naman ding rules na nagsasabi na oh kapag wala na kayo in power you turn it over to the incoming administration. Kung walang ganun, ano yung na violate nila?” she said.

Monetization

The next inquiry would be if the page is generating money out of the digital asset.

When the government changed hands, the page was not transferred and it could be presumed that the management remained to be in the hands of the private individuals who created the page.

“Kung na-monetized na, pinagkakakitaan ba nila yung interactions? Kasi could you just imagine, if you are a private individual, hindi ka naman magkakaroon ng libo-libong followers. Nag follow itong mga taong ito, because it’s PIO,” she said.

“I am not saying that’s what they’re doing, but it could be one of those things they’re doing. May monetization na din naman yung Facebook. So, we don’t know which part of their activities they are earning money from and whether they’re earning money from people who followed them,” she added.   /rcg

RELATED STORIES:

Beware of data theft via mobile phones, Filipinos told

Campaigns through text: A breach of data privacy?

Apple moving forward on app privacy, despite pushback