Facebook and the Expectation of Privacy

An Analysis of Vivares v STC

In 2012, news came out involving the case of students who were not able to attend their high school commencement exercises after the school found out that photos where they were wearing bikinis and drinking alcohol were posted on Facebook. Aggrieved, the parents of the children filed a petition for a writ of habeas data which the Regional Trial Court (RTC) dismissed in July 2012. Two years hence, the Supreme Court (Court) affirmed the decision of the RTC and found that there is no violation of the privacy rights of the minors.

The facts, as narrated by the Supreme Court are as follows. Sometime in January 2012, during a birthday party and while changing into their swimsuits, they, along with several others, took photos of themselves clad only in their undergarments. Other photos were also taken of the children drinking hard liquor and smoking cigarettes inside a bar and along the streets of Cebu wearing clothes that show virtually the entirety of their black brassieres. The said photos are then uploaded by Angela Tan on her Facebook profile.

The photos were subsequently discovered by a computer teacher at STC, Mylene Escudero (Escudero), through her students who showed her their Facebook accounts. The matter was then reported by Escudero to Kristine Tigol, STC’s Discipline-in-charge. After investigation, the children were found to have violated several provisions in the Students Handbook, i.e., possession of alcoholic drinks outside the school campus; engaging in immoral, indecent, obscene or lewd acts; smoking and drinking alcoholic beverages in public places; apparel that exposes the underwear; clothing that advocates unhealthy behavior, depicts obscenity, contains sexually suggestive messages, language, or symbols; and posing and uploading pictures on the Internet that entail ample body exposure. Afterwards, the children were called to the office of the High School Principal and ICM Directress, Sr. Celeste Purisima Pe (Sr. Purisima) and were then informed that they are to be barred from joining the commencement exercises. This prompted the parents of the children to file a petition for the issuance of a writ of habeas data arguing that the acts done by the school i.e., using and reproducing the photos without the consent of the children and doing such intrusion at the computer laboratory of STC, constitute an invasion of the privacy of the children. The RTC dismissed the petition finding that the petitioners in the case failed to prove the existence of an actual or threatened violation of the right to privacy of the children. Petitioners then raised this issue with the SC. On September 29, 2014, the Court decided in favor of STC and affirmed the decision of the RTC.

The Court in this case had the opportunity to resolve and discuss two very relevant issues: 1) the application of the Rule on the Writ of Habeas Data; and 2) privacy in the realm of online social networks.

In relation to the first issue, the Court had the opportunity to discuss the application of the writ of habeas data, specifically, on who may file for the same and against whom may it issue.

As regards the first question, the Court clarified that the application of the writ of habeas data is not confined to cases of extralegal killings and enforced disappearances. The Court explained that unlike the writ of amparo, the writ of habeas data finds application outside of extralegal killings and enforced disappearances. The Court cited the annotations to the Rule prepared by the Committee on the Revision of the Rules of Court which states that the writ “can be availed of as an independent remedy to enforce one’s right to privacy, more specifically the right to informational privacy” and stressed that the Rule was designed “to safeguard individual freedom from abuse in the information age.”

The Court also clarified the meaning of the phrase “engaged in the gathering, collecting or storing data or information.” After the STC questioned the applicability of the Rule against them on the argument that it does not fall within the meaning of the said term, the Court explained that “nothing in the Rule [suggests] that [it] is available only against abuses of a person or entity engaged in the business of gathering, storing and collecting of data.” The Court explained that the word “engage” does not mean to undertake a business endeavor but simply “to do or take part in something.” The Court stated that what matters for the application of the Rule is that “the person or entity must be gathering, collecting or storing data or information about the aggrieved party or his or her family.” Further, it added that whether the said act is done with regularity is immaterial and shall not prevent the issuance of the writ.

Although it seems that all the arguments in relation to the application of the writ to STC were found untenable by the SC, it still found that there is no violation of the privacy rights of the children.

First, the Court explained the concept of privacy. According to the Court, citing then Chief Justice Puno’s speech, the Common Right to Privacy, there are three strands of the right to privacy, i.e., 1) locational or situational privacy; 2) informational privacy; and 3) decisional privacy. It further stated that this case deals with the second strand which is the right to informational privacy which is “usually defined as the right of individuals to control information about themselves.”

The Court then went on to state that by reason of the “numerous venues for information gathering and data sharing […], there is more reason that every individual’s right to control said flow of information should be protected and that each individual should have at least a reasonable expectation of privacy in cyberspace.” However, the Court also recognized that “generally speaking, having an expectation of informational privacy is not necessarily compatible with engaging in cyberspace activities, including those that occur in online social networks (‘OSN’).” The Court then explained that although the purpose of an OSN is precisely to provide a venue for interacting with people, Facebook in addressing concerns about privacy, provided privacy tools without defeating the aforementioned purpose.

SC explained the different privacy settings available to Facebook users and enumerated them, to wit:

a.  Public – the default setting; every Facebook user can view the photo;

b.  Friends of Friends – only the user’s Facebook friends and their friends can view the photo;

c.  Friends – only the user’s Facebook friends can view the photo;

d.  Custom – the photo is made visible only to particular friends and/or networks of the Facebook user; and

e.  Only Me – the digital image can be viewed only by the user.

These are considered “privacy tools, available to Facebook users, designed to set up barriers to broaden or limit the visibility of his or her specific profile content, statuses, and photos, among others, from another user’s point of view.”


Using this explanation on the privacy tools of Facebook and the findings of fact on the privacy settings relating to the posting of the photos in this case, the Court concluded that the children had no reasonable expectation of privacy.

The Court first explained that in order for the children or any user to have an expectation of privacy in his or her OSN activity, “it is first necessary that said user, […], manifest the intention to keep certain posts private, through the employment of measures to prevent access thereto or to limit its visibility.” Such intention, it added, is manifest through the utilization of the privacy tools available. The Court explains that the expectation of privacy differs depending on the limit of disclosure.

The Court then looked into the testimonies of the children claiming that the images were available to the five of them but did not give the same weight given that they failed to question Escudero’s students’ act of showing the photos which for the Court means that no special means to be able to view the Facebook posts were resorted to by the students, and therefore, it may be assumed that the same were viewable either by their Facebook friends, or by the public. Court added that since the default setting for the posts is “Public,” it can be surmised that the photos were viewable by everyone since no proof to the contrary was presented.

The Court also deemed the argument that there is still an expectation of privacy since the photos are viewable by “friends only” to be untenable. Court said that the “cyber community is agreed (sic) that the digital images under this setting still remain to be outside the confines of the zones of privacy.” This conclusion takes into consideration the following:

Facebook allows the world to be more open and connected

A good number of Facebook users “befriend” others who are total strangers;

The number of “Friends” of one user has are usually be the hundreds; and

A user’s Facebook friend can share the post or tag others who are not the Facebook friends of the user.

Thus, the Court rejected the argument of the petitioners that the visibility set at “Friends only” may be considered as “very private.” Court also added that the features of Facebook show its “proclivity towards user interaction and socialization rather than seclusion or privacy.”

The Court added that even assuming that the photos were in fact visible only to the friends of the children, STC cannot be considered to have violated their privacy since it was the friends of the children who showed the pictures. The photos, were then, not illegally obtained but voluntarily given to STC.

The other contention of the petitioners that STC reproduced the photos when it appended the same to a memorandum submitted to the trial court was also rejected by the Court and stated that such is not a violation of the privacy rights.

Furthermore, the Court stated that if the petitioners were able to prove that the access to the pictures was limited to the original uploader, or that there was limited access through the use of the “Custom” setting, the result may have been different since the intention to keep it private becomes more manifest.

As a final note, the Court seems to remind everyone that the best means of avoiding privacy rights violations is through the self-regulation on the part of the OSN users and internet consumers and that the parents of minors should exercise supervision over the activities of their children to avoid risks involved in participating to online activities.

Although we agree with the decision of the Court that the application of the writ of habeas data is not confined to cases of extralegal killings and enforced disappearances; as well as to the finding that STC should not be liable for the acts done by the friends of the children when they showed the photos to their teacher,  we would like to take note that the Court’s pronouncement in relation to the expectation of privacy of the children is dependent on a very crucial fact, i.e., the features surrounding the privacy setting used by Tan when she posted the photos in her account. According to the Court, the “Friends only” setting cannot put the photos within the zone of privacy. Such conclusion, however, is confined only to the circumstances present in the case which means that changes in the features of the privacy setting of Facebook would necessitate a change in the Court’s conclusion in relation to privacy. At this point we would like to direct your attention to the point that the Court did not seem to take into consideration – that in cases when the visibility is limited only to the “friends” of the Facebook user, the photos are neither visible nor accessible to the “friends of the friends” of the Facebook user. This certainly means that the user contemplated that only those that he/she considers as friends can view the photos, excluding everyone outside of the list of friends which he/she accepted. Applying this to the case, this means that the children had some expectation of privacy when instead of posting the photos in public: they chose only friends, that they, in the first place selected, to see the photographs.

Read more about the Data Privacy practice at Disini & Disini Law Office

Read more about the Technology and Telecommunications practice at Disini & Disini Law Office