The Supreme Court (SC) has ruled that while bank deposits remain confidential, the Cybercrime Prevention Act under Republic Act No. 10175 allows the disclosure of certain information in the investigation of cybercrimes.

In a decision written by Associate Justice Ramon Paul L. Hernando, the SC clarified that while the Bank Secrecy Law protects the confidentiality of bank deposits and their financial details, it does not prevent the disclosure of basic identifying information when allowed by law.

It pointed out that under RA 10175 enacted in 2012, law enforcement agencies may, with a court-issued warrant, require the disclosure of computer data necessary to investigate cybercrime offenses.

It explained that banks are considered service providers under the Cybercrime Prevention Act because their digital banking services – such as online banking platforms, mobile applications, and automated email notifications – allow customers to communicate and transact through computer systems.

It also said that banking institutions also process and store substantial amounts of computer data both in the course of their operations and on behalf of their customers, placing them within the law’s coverage for the disclosure of computer data when authorized by a court-issued warrant.

With its decision, the SC denied the petition filed by EastWest Rural Bank which challenged the orders issued by the court and the police to disclose certain computer data as part of cybercrime investigation.

In a summary of the decision, the SC’s Office of the Spokesperson said that the SC case stemmed from the complaint filed by Leonard Vendiola who was scammed by a caller posing as a bank employee.

The caller tricked Vendiola into disclosing his email and one-time password. The disclosure allowed the transfer of P10,000 from Vendiola’s account to an account with EastWest Rural Bank.

Aggrieved, Vendiola reported the incident to the Philippine National Police Anti-Cybercrime Group (PNP-ACG), which sought a Warrant to Disclose Computer Data to identify the EastWest account holder involved in the alleged scam.

The regional trial court (RTC) issued the warrant which authorized the PNP-ACG to compel EastWest Rural Bank to disclose and preserve data relating to the account holder.

The bank challenged the issuance of the warrant. It argued that the Bank Secrecy Law strictly prohibits banks from revealing any information about bank deposits, including the identity of the account holder.

It also argued that the rule remains in force because it was not repealed by the Cybercrime Prevention Act.

At the same time, the bank pointed out that it is not covered under RA 10175 because it is a financial institution rather than a communications service provider.

But the SC rejected the bank’s arguments as it upheld the validity of the Warrant to Disclose Computer Data and Disclosure Order issued by the trial court.