EXPLAINER: That ‘Notice to the Public’ could get your company sued

You’re scrolling through Facebook when a “Notice to the Public” catches your attention. It features a former employee’s name and photograph, followed by a statement that the person is no longer affiliated with the business.

Some notices go further, warning customers against transacting with the former employee. But how much information can a company legally disclose about someone who no longer works for it?

The long and the short of it: Businesses may inform customers when a former employee is no longer authorized to represent them.

The National Privacy Commission recognizes that companies may have legitimate reasons to issue such warnings, provided their disclosures are limited to what is necessary to protect customers.

But notices featuring unnecessary personal information or allegations of misconduct can raise several legal concerns.

Not every termination notice violates data privacy

Under Republic Act No. 10173, or the Data Privacy Act of 2012, a person’s name, photograph, and employment status are considered personal information when they can identify that individual.

Companies do not need an employee’s consent for every departure announcement. Under Section 12(f), they may process personal information to pursue legitimate interests, provided these do not override the individual’s fundamental rights and freedoms.

For example, a business may warn customers that a former sales agent, account manager, or representative is no longer authorized to collect payments or conduct transactions on its behalf.

What can a company include in a notice?

In Advisory Opinion No. 2024-017, the NPC recognized that businesses may publish former employees’ names and photographs, particularly when they previously dealt with the public.

The opinion cited earlier guidance allowing companies to clarify that a person shown in a photograph is no longer employed by them and that transactions made by that person on their behalf will no longer be honored.

However, this does not give companies a free pass to disclose every detail about an employee’s departure.

In Advisory Opinion No. 2022-009, the NPC said a bank’s proposed notice identifying former employees and confirming their separation could be sufficient to inform customers. Additional details could be disproportionate, and businesses should consider notifying affected customers privately.

Cyber libel and other legal risks

In Advisory Opinion No. 2024-017, the NPC distinguished ordinary personal information from sensitive personal information, such as details about alleged offenses and pending criminal cases.

The commission found no applicable lawful basis for publishing such sensitive information in the proposed notices, warning that doing so could be excessive and prejudice former employees before a final court judgment.

Public accusations may also expose businesses to cyber libel complaints. A notice calling someone a “thief” or “scammer,” for example, may be defamatory depending on its context and whether the elements of libel are present.

The Civil Code may provide additional grounds for liability. Articles 19, 20, and 21 cover the abuse of rights and acts that cause injury through unlawful or wrongful conduct, while Article 26 protects a person’s dignity, privacy, and peace of mind.

Protecting customers should not mean abandoning privacy

The principle of proportionality requires businesses to disclose only information that is adequate, relevant, necessary, and not excessive for their stated purpose.

Instead of public posts, companies may consider more targeted ways to notify affected customers, such as direct messages, official emails, or notices on their premises.

Employees do not lose their right to privacy simply because they have resigned or been dismissed.

Businesses have every reason to protect customers from unauthorized transactions, but that responsibility should not come at the expense of a former employee’s privacy, dignity, and legal rights.