Comelec chief: NPC findings over ‘Comeleak’ based on ‘misappreciation’ of facts

Commission on Elections chair Andres Bautista on Thursday said the findings of the National Privacy Commission over the so-called "Comeleak" are "based on misappreciation of several facts."

Bautista released a statement on the matter shortly after the NPC made public its findings, which said Comelec violated Sections 11, 20, and 21 of the Data Privacy Act of 2012.

In addition, the NPC said the poll chief also violated Section 22 of the said law, recommending the filing of criminal charges against him.

'Misappreciation of facts'

Bautista said: "With all due respect to the NPC membership, we believe that the NPC decision was based on misappreciation of several facts, legal points, and material contexts."

He also defended himself after the NPC "conveniently points to the Head of Agency as solely responsible for the data breach."

Bautista said that the Comelec en banc, "currently managed by seven lawyers," including himself, "rely on our IT Department for expert advice on website/data security and privacy and IT-related matters."

Deferment to IT experts

"The Chairman, after exercising the diligence required by law in supervising and monitoring all departments under him as in the case of the Heads of other government agencies, is not the collector, processor, and custodian of the database," he said.

"As the Head of Agency, in areas where I did not have specific expertise, I generally trusted the advice and recommendations of our IT experts," he added.

"And if Comelec IT specialists directly in charge of operating the website were found not [to] be liable, what more those who merely oversee their work and in particular, the Head of Agency?" he went on.

'Rules can't be applied retroactively'

At a press conference at the Rembrandt Hotel in Quezon City on Thursday afternoon, Bautista also explained that the Comelec was not able to comply with the Data Privacy Act because the implementing rules and regulations were not yet in place when he assumed his post.

"Pagdating ko sa Comelec, wala pang implementing rules and regulations (IRR) na napapasa. So wala pang pwedeng i-appoint na data protection officer. Hindi ka pwedeng gumawa ng IRR at i-apply yon retroactively," Bautista told reporters.

"The data hacking was most unfortunate, at hindi ito dapat nangyari. Pero kahit na sinong ahensya ng gobyerno ay pwedeng matamaan. Ang sanang pag-tuunan natin ng pansin ay yung mga hacker," he added.  — With TJ Dimacali/RSJ, GMA News