Eastwest Rural Bank vs. Philippine National Police Anti-Cybercrime Group

Factual Background

Vendiola lodged a complaint with PNP-ACG RACU 1 located at Camp Diego Silang, Carlatan, San Fernando City, La Union. He stated that on May 19, 2023 at around 2:19 p.m., he received a phone call from Justine Dela Cruz (Dela Cruz), who represented himself as an employee of Banco de Oro and offered rewards (“points”) conditioned upon Vendiola disclosing his email address and OTP. Vendiola complied.

After checking his BDO account through online banking, Vendiola found a transfer of PHP 10,000.00 to an EWRB account numbered 500023412872. He immediately reported the incident to BDO and thereafter to PNP-ACG RACU 1. PNP-ACG RACU 1 concluded that Vendiola had fallen victim to “vhishing,” an offense prosecuted under Section 9(s) of Republic Act No. 8484, as amended by Republic Act No. 11449, in relation to Section 6 of Republic Act No. 10175.

WDCD Application and RTC Grant

On June 13, 2023, PNP-ACG RACU 1 applied for a WDCD to disclose computer data for the alleged violation under Section 9(s) of Republic Act No. 8484, as amended, in relation to Section 6 of Republic Act No. 10175. On June 21, 2023, the RTC granted the WDCD, authorizing PNP-ACG RACU 1 to compel EWRB to release and preserve data and information pertaining to EWRB Account Number 500023412872. The WDCD expressly identified the categories of information sought: account information such as the account holder’s full name, personal information, and address; the verification ID submitted when the account was opened; contact details (email and phone/cellular number); and any other relevant information that could lead to the identity of the account holder(s) and their digital footprint.

Pursuant to the WDCD, PNP-ACG RACU 1 issued a Disclosure Order to EWRB.

EWRB’s Motion for Clarificatory Order and RTC Denial

EWRB filed an Entry of Appearance and a Motion for Clarificatory Order with the RTC. EWRB requested clarification on whether the WDCD implicated the confidentiality regime under Republic Act No. 1405, the Law on Secrecy of Bank Deposits (Bank Secrecy Law). EWRB also asked that the Disclosure Order be held in abeyance. It argued that: first, the information sought was unrelated to any civil or criminal case pending before the court; second, the Cybercrime Prevention Act did not repeal the Bank Secrecy Law; and third, the Rule on Cybercrime Warrants was inapplicable because EWRB allegedly did not qualify as a covered service provider under the Rule’s definition.

In its Order dated July 3, 2023, the RTC denied the motion for lack of merit. The RTC ruled that the WDCD did not authorize law enforcement to scrutinize the deposits of the EWRB account holder. It emphasized that the WDCD did not require EWRB to divulge deposit amounts, but focused on verifying identity information, such as full name, personal information, and address, which the RTC treated as within the authority of the Rule on Cybercrime Warrants. The RTC further noted that once a criminal action was initiated, EWRB could seek remedies such as a motion to quash, and issues regarding the WDCD could be addressed in the court that would acquire jurisdiction over the criminal case. The RTC likewise denied EWRB’s motion for reconsideration in an Order dated July 27, 2023.

CA Proceedings and Dismissal on Procedural Grounds

EWRB elevated the RTC orders to the Court of Appeals (CA) via a Petition for Certiorari with Application for Temporary Restraining Order and/or Writ of Preliminary Injunction. In a Resolution dated September 26, 2023, the CA dismissed the petition for procedural deficiencies: the petition failed to provide EWRB’s address; it did not include a clear and legible copy of Annex D; and it failed to indicate the MCLE compliance details (number and date) of the notary involved. The CA additionally held that there was no grave abuse of discretion on the RTC’s part in issuing the WDCD and its July 3, 2023 and July 27, 2023 orders. The CA denied EWRB’s motion for reconsideration in a Resolution dated April 30, 2024.

Issues Raised Before the Supreme Court

EWRB then filed the present Petition for Review on Certiorari under Rule 45. It asserted that the RTC erred in issuing WDCDs under the Cybercrime Prevention Act by compelling banking institutions to reveal depositor identities and information. It argued that such disclosure violated the Bank Secrecy Law because depositor identity is protected confidentiality information. It further contended that the Cybercrime Prevention Act did not expressly repeal the Bank Secrecy Law and therefore disclosure remained impermissible unless a recognized legal exemption applied. EWRB also maintained that it was not a service provider and thus lay outside the Act’s coverage.

With respect to the CA’s procedural rulings, EWRB argued that its omission of address, the clarity of a document attachment, and the notary’s MCLE number should not justify dismissal, invoking the policy that cases should be resolved on their merits rather than on technicalities.

The Office of the Solicitor General (OSG) supported key aspects of petitioner’s stance. It argued that the EWRB deposit account was protected by the Bank Secrecy Law and that the WDCD violated the law. It further argued that the Cybercrime Prevention Act did not apply because petitioner allegedly did not meet the service-provider definition. The OSG also contended that the account constituted a bank deposit and not only computer data, so information connected to the deposit had to remain confidential.

PNP-ACG RACU 1, in its Comment/Opposition, argued instead that the WDCD did not authorize the disclosure of financial transactions or deposit amounts. It insisted that the WDCD targeted only identity and address verification information. It maintained that while the Bank Secrecy Law protects bank deposits, the referenced personal information of the account holder may be disclosed under Section 14 of the Cybercrime Prevention Act and under Section 4 of the Rule on Cybercrime Warrants. It also contended that EWRB qualified as a service provider because, through its online banking system, it enabled communication using a computer system and retained subscriber information constituting computer data.

The Supreme Court’s Treatment of Procedural Defects

The Supreme Court held that the petition’s dismissal by the CA should not be sustained purely on the procedural defects. It ruled that substantial compliance with Rule 46, Section 3 in conjunction with Rule 65, Section 1 required the petition to include the actual addresses of petitioners and respondents. The CA had treated petitioner’s failure to include its address as a valid ground for dismissal. The Supreme Court, however, overlooked this technical defect because the name and address of petitioner’s counsel were clearly stated and the bank’s address was ascertainable from the attached Special Power of Attorney and certified true copy of the secretary’s certificate. The Court also noted that petitioner promptly corrected the omission by filing a motion for reconsideration with an amended petition, and it found no showing that the defect prejudiced the CA or respondent.

As to the CA’s finding regarding the absence of a clear and legible copy of Annex D, the Supreme Court acknowledged that petitions deficient in essential pleadings or parts of the record are generally dismissible. It nonetheless found the WDCD attached to the petition, though not ideal in clarity, to remain legible. It also observed that petitioner later cured the problem by submitting a clearer WDCD copy with its motion for reconsideration before the CA, and it treated the later submission as a substantial compliance equivalent consistent with the approach recognized in Duremdes v. Jorilla.

Finally, the Supreme Court addressed the MCLE omission in the affidavit of service and verification documents. It noted that a lawyer’s omission of the MCLE compliance number and date does not warrant dismissal, and it extended that principle because only the notary public’s MCLE data was missing. The Court observed that petitioner later supplied the notary’s MCLE number and date in its motion for reconsideration.

Accordingly, while the Supreme Court refrained from overturning the CA’s ultimate conclusion on grave abuse of discretion, it treated the CA’s procedural disposition with more leniency than it had applied.

Grave Abuse and the Novel Substantive Questions

The Supreme Court agreed with the CA that the RTC had not committed grave abuse of discretion in issuing the WDCD through its July 3, 2023 and July 27, 2023 orders. The Court, however, recognized that petitioner had raised novel issues concerning the confidentiality of bank deposits under Philippine law in relation to the Cybercrime Prevention Act, the Data Privacy Act of 2012 (Republic Act No. 10173), and the Rules on Cybercrime Warrants. The CA had not addressed those matters comprehensively. The Supreme Court accordingly resolved these issues seriatim.

Legal Issue One: Whether the Cybercrime Prevention Act Repealed the Bank Secrecy Law

The Supreme Court rejected petitioner’s position that the Cybercrime Prevention Act revoked the Bank Secrecy Law. It explained that repeal depends on legislative intent and that express repeal requires a specific identification of the law or provisions meant to be repealed. It also held that implied repeal requires either an irreconcilable conflict on the same subject matter or an intent to substitute the earlier law with the later one.

The Court found no express repeal, noting that Congress did not explicitly mention Sections 2 and 3 of the Bank Secrecy Law in the Cybercrime Prevention Act’s repealing provisions. It also found no implied repeal. It reasoned that the two laws do not cover the same subject matter: the Bank Secrecy Law focuses on confidentiality of bank deposit information, while the Cybercrime Prevention Act governs a broader class of data related to cybercrime investigations, including comp