Vivares v. St. Theresa's College

Minor students of St. Theresa's College (STC) in Cebu City were photographed in their undergarments while changing for a beach party, and a classmate uploaded the photos to Facebook. A computer teacher, Mylene Escudero, learned of the photos from her students, who logged into their own Facebook accounts on school computers and showed her these and other photos of the girls, including photos of them drinking and smoking in a bar. The students said the photos had at times been viewable by the public. After investigation, STC found violations of its Student Handbook and barred the girls from the commencement exercises, and did so despite a TRO obtained in a separate injunction case. The girls' parents petitioned the RTC for a writ of habeas data. They claimed that the girls' accounts were set to "Friends Only," that the school intruded on them, and that the photos were broadcast when STC attached them to a court memorandum. The RTC issued the writ but, after the return, dismissed the petition for failure to prove an actual or threatened violation of the right to privacy.

1. 1Whether the writ of habeas data is available outside cases of extralegal killings and enforced disappearances, and against an entity not in the business of collecting data.
2. 2Whether STC violated the minors' right to informational privacy, so that the writ should issue.

The petition was denied. Procedurally, Section 2 of the Rule, which prescribes who may file "in cases of extralegal killings and enforced disappearances," shows that the writ is not confined to those cases. It is "an independent remedy to enforce one's right to privacy, more specifically the right to informational privacy." To be "engaged" in gathering, collecting or storing data does not require doing so as a business. Still, the writ requires a nexus between the right to privacy and the right to life, liberty or security, and a showing by substantial evidence of an actual or threatened violation. Before a user can have an expectation of privacy in OSN activity, the user must "manifest the intention to keep certain posts private" through the use of privacy tools. Here the default setting was "Public," the minors' claim that only five people could view the photos was uncorroborated, and they did not dispute that Escudero's students saw the photos through their own accounts. Even a "Friends Only" setting does not keep a post within a zone of privacy, since friends can share it or tag others. STC's officials were "mere recipients" of photos shown to them by people with legitimate access, and attaching them to a court memorandum was not an offensive disclosure. Had the posts been limited to "Only Me" or a custom list, the result might have differed. The Court also stressed that OSN users must take responsibility for protecting their own privacy.