Vivares vs. St. Theresa's College

The right to informational privacy in online social network (OSN) activities is not automatic; a user must manifest an intention to keep posts private through the positive employment of privacy tools and settings. Absent proof that privacy settings were utilized to limit access—such as the "Only Me" or "Custom" settings—there is no reasonable expectation of privacy in Facebook posts, even under the "Friends Only" setting, due to the inherent nature of social networking sites that facilitate sharing, tagging, and interaction among users.

Minor students of St. Theresa's College (STC) in Cebu City posted digital photographs of themselves on Facebook wearing only brassieres and undergarments, some depicting them drinking liquor and smoking in public places. These images were uploaded by one of the students and allegedly viewable by their Facebook friends. A computer teacher at STC discovered the photos through her students' Facebook accounts, reported them to school officials, and the students were subsequently sanctioned for violating the school's Student Handbook provisions on immoral conduct, possession of alcoholic drinks outside campus, and inappropriate apparel. The students were barred from participating in the commencement exercises, prompting their parents to file a petition for the writ of habeas data claiming invasion of privacy and unlawful data gathering.

• Nenita Julia V. Daluz (Julia) and Julienne Vida Suzara (Julienne), minor students at St. Theresa's College (STC), took digital pictures of themselves in undergarments while changing into swimsuits for a beach party in January 2012.
• Angela Lindsay Tan uploaded these photos on her Facebook profile.
• Mylene Rheza T. Escudero, a computer teacher at STC, learned from her students that seniors posted photos online showing themselves in brassieres.
• Escudero's students logged into their personal Facebook accounts using STC computers and showed her photos of Julia and Julienne drinking liquor, smoking, and wearing clothing exposing their brassieres along Cebu streets.
• The students claimed the photos were sometimes accessible to any Facebook user, not just friends, and that there had been times when the photos were "public."
• Escudero reported the matter to Kristine Rose Tigol, STC's Discipline-in-Charge, showing the photos through a student's Facebook page.
• STC conducted an investigation and found the students violated provisions of the Student Handbook regarding possession of alcoholic drinks, immoral acts, smoking in public, apparel exposing underwear, and uploading pictures with ample body exposure.
• On March 1, 2012, the students were called to the office of Sr. Celeste Ma. Purisima Pe, STC's high school principal, where they were allegedly castigated and verbally abused.
• The students were barred from joining the commencement exercises scheduled for March 30, 2012.
• On March 23, 2012, Angela's mother filed a Petition for Injunction and Damages before the RTC, joined by petitioner Vivares as intervenor on March 25, 2012.
• On March 28, 2012, defendants in the injunction case filed a memorandum with printed copies of the photographs as annexes.
• Petitioners filed the habeas data petition claiming the photos were taken for posterity, the Facebook accounts were set to "Friends Only," and respondents violated their children's privacy by accessing, saving, and reproducing the photos.
• The RTC issued a writ of habeas data on July 5, 2012, but subsequently dismissed the petition on July 27, 2012, finding no violation of the right to privacy.

• The photos were taken for posterity before changing into swimsuits and were uploaded with "Friends Only" privacy settings, creating a reasonable expectation of privacy that must be respected.
• Respondents, being educators, should have known laws safeguarding privacy and recognized that the minors were victims, not offenders, of privacy invasion.
• Escudero violated the minors' rights by saving digital copies of the photos and showing them to school officials, constituting intrusion into Facebook accounts.
• The intrusion occurred at STC's Computer Laboratory using the school's computers, and the data were broadcasted when respondents appended them to their memorandum filed with the RTC in the related civil case.
• There was an actual violation of the right to privacy in life, liberty, or security necessary for the issuance of the writ of habeas data.

• Petitioners are not the proper parties to file the petition and are engaging in forum shopping.
• The case is not one where a writ of habeas data may issue because the writ is limited to cases of extralegal killings and enforced disappearances.
• STC is not an entity "engaged in the business" of gathering, collecting, or storing data, which is required for the writ to issue against private entities.
• There can be no violation of the right to privacy as there is no reasonable expectation of privacy on Facebook, especially since the photos were uploaded without restrictions and were viewable by the public.
• The photos were gathered through legal means and for a legal purpose, specifically for implementing school discipline policies and the Student Handbook.

• Procedural Issues:
  • Whether the writ of habeas data is confined only to cases of extralegal killings and enforced disappearances.
  • Whether STC, as a private educational institution, qualifies as an entity "engaged in the gathering, collecting or storing of data" under Section 1 of the Rule on the Writ of Habeas Data.
• Substantive Issues:
  • Whether the minors had a reasonable expectation of informational privacy regarding the Facebook photos in question.
  • Whether respondents violated the minors' right to informational privacy by accessing and using the photos for disciplinary proceedings.

• Procedural:
  • The Supreme Court held that the writ of habeas data is not confined solely to cases of extralegal killings and enforced disappearances. Section 2 of the Rule provides special provisions for such cases but does not limit the writ's applicability only to them; it may be availed of as an independent remedy to enforce the right to informational privacy.
  • The Court ruled that "engaged" in the context of Section 1 of the Rule does not mean being in the business of data gathering. It means "to do or take part in" the activity of gathering, collecting, or storing data. Thus, STC could be subject to the writ if it engaged in such activities, regardless of whether it was a business endeavor or a personal undertaking.
• Substantive:
  • The Court held that there was no violation of the minors' right to informational privacy. The writ requires a nexus between the right to privacy and the right to life, liberty, or security, and requires proof of actual or threatened violation by substantial evidence.
  • The Court ruled that before one can have an expectation of privacy in OSN activity, the user must manifest the intention to keep posts private through the utilization of privacy tools. Mere uploading does not automatically create a protected expectation.
  • The Court found that petitioners failed to prove the minors utilized privacy settings to limit access to the photos. The default Facebook setting is "Public," and without evidence that the settings were changed to "Only Me" or "Custom," there is no reasonable expectation of privacy.
  • Even under the "Friends Only" setting, privacy is not guaranteed because Facebook friends can share posts or tag others, expanding the audience beyond the original user's friends and rendering the information outside the zone of privacy.
  • The Court held that respondents were mere recipients of the information voluntarily given by the minors' Facebook friends who had legitimate access. Respondents did not resort to unlawful means to gather the information.
  • Appending the photographs to a court memorandum does not constitute a violation of informational privacy rights.

• Right to Informational Privacy — Defined as the right of individuals to control information about themselves. The Court held that this right is not absolute in the context of online social networks (OSNs) and requires the user to manifest an intention to keep information private through the positive use of privacy tools and settings.
• Nexus Requirement in Habeas Data — The writ of habeas data requires a nexus between the right to privacy on one hand and the right to life, liberty, or security on the other; it will not issue merely on the basis of unauthorized access to information without this connection and substantial evidence of violation.
• Reasonable Expectation of Privacy in Cyberspace — The Court adopted the principle that having an expectation of informational privacy is not necessarily incompatible with engaging in cyberspace activities, but the expectation must be manifested through positive acts such as utilizing privacy settings. Absent such measures, information posted on social media, particularly under the default "Public" setting or even "Friends Only," is considered outside the zone of privacy due to the platform's features allowing sharing and tagging.
• Self-Regulation in Cyberspace — The Court emphasized that self-regulation is the best means of avoiding privacy violations, and OSN users must be proactive in protecting their own privacy by exercising due diligence and sound discretion in their online dealings.

• "The individual's desire for privacy is never absolute, since participation in society is an equally powerful desire. Thus each individual is continually engaged in a personal adjustment process in which he balances the desire for privacy with the desire for disclosure and communication of himself to others, in light of the environmental conditions and social norms set by the society in which he lives."
• "Before one can have an expectation of privacy in his or her OSN activity, it is first necessary that said user, in this case the children of petitioners, manifest the intention to keep certain posts private, through the employment of measures to prevent access thereto or to limit its visibility. And this intention can materialize in cyberspace through the utilization of the OSN's privacy tools. In other words, utilization of these privacy tools is the manifestation, in cyber world, of the user's invocation of his or her right to informational privacy."
• "A person who places a photograph on the Internet precisely intends to forsake and renounce all privacy rights to such imagery, particularly under circumstances such as here, where the Defendant did not employ protective measures or devices that would have controlled access to the Web page or the photograph itself."
• "The best filter is the one between your children's ears."

• Gamboa v. Chan — Cited to establish that the writ of habeas data is an independent and summary remedy designed to protect the image, privacy, honor, information, and freedom of information of an individual, and to define the nexus requirement between privacy and life, liberty, or security.
• Roxas v. Macapagal-Arroyo — Cited for the requirement of substantial evidence showing an actual or threatened violation of the right to privacy in life, liberty, or security before the privilege of the writ may be extended.
• H v. W (South Gauteng High Court, South Africa) — Referenced for the recognition that courts must respond to changing technological realities and that Facebook users can customize privacy settings, though these are not fool-proof.
• United States v. Gines-Perez — Cited for the principle that a person who places a photograph on the Internet without protective measures intends to forsake privacy rights over such imagery.
• United States v. Maxwell — Cited for the rule that the more open the method of transmission, the less privacy one can reasonably expect, and that messages sent to the public at large lose any semblance of privacy.
• Romano v. Steelcase, Inc. — Cited regarding privacy expectations in social networking environments and the notion that privacy is grounded in reasonable expectations rather than wishful thinking.

• Section 1, Rule on the Writ of Habeas Data (A.M. No. 08-1-16-SC) — Defines the writ of habeas data as a remedy available to any person whose right to privacy in life, liberty or security is violated or threatened by an unlawful act or omission of a public official or employee, or of a private individual or entity engaged in the gathering, collecting or storing of data.
• Section 2, Rule on the Writ of Habeas Data (A.M. No. 08-1-16-SC) — Provides who may file the petition, including special provisions for cases of extralegal killings and enforced disappearances.
• Section 19, Rule on the Writ of Habeas Data (A.M. No. 08-1-16-SC) — Provides for the appeal to the Supreme Court under Rule 45 from the judgment or final order in a habeas data proceeding.
• Rule 45 of the Rules of Court — Cited as the procedural basis for the petition for review on certiorari filed before the Supreme Court.