Habeas Data and Facebook Privacy: When Photos Posted Online Lose Legal Protection

The Supreme Court's 2014 decision in Vivares v. St. Theresa's College (G.R. No. 202666) settled an important question for the digital age: when does a person lose the right to privacy over photos posted on social media? The case involved high school students who were disciplined after photos of them in their undergarments surfaced online, and their parents sought relief through the writ of habeas data. The ruling clarifies both the scope of the writ and the boundaries of informational privacy in cyberspace.

The Facts of the Case

Two graduating high school students of St. Theresa's College in Cebu City took digital photos of themselves in their undergarments before a beach party. A classmate uploaded these photos on her Facebook account. Later, a computer teacher at the school learned from students that some seniors had posted such photos online. Using the students' own Facebook accounts, the teacher viewed the photos and reported the matter to school authorities.

The school investigated and found the students violated the Student Handbook for acts including posing and uploading pictures on the Internet that entail ample body exposure. The students were barred from attending commencement exercises. Their parents filed a petition for the writ of habeas data, alleging invasion of their children's privacy.

The Writ of Habeas Data Explained

The writ of habeas data is a remedy available to any person whose right to privacy in life, liberty, or security is violated or threatened by an unlawful act of a public official or private individual or entity engaged in gathering, collecting, or storing data about the aggrieved party.

The Court clarified two procedural points. First, the writ is not limited to cases of extralegal killings and enforced disappearances. It is an independent remedy to enforce the right to informational privacy. Second, a private entity need not be in the business of data collection to be subject to the writ. To "engage" in gathering data simply means to take part in such activity, whether or not it is done in pursuit of a business.

Privacy on Facebook: What the Court Decided

The central issue was whether the students had a reasonable expectation of privacy over the photos. The Court held that a Facebook user who employs the platform's privacy tools—such as "Only Me" or "Custom" settings—manifests an intention to keep posts private and may invoke the right to informational privacy.

However, the students failed to prove they had limited access to the photos. Their claim that the photos were viewable only by five people was self-serving, especially since they did not dispute the teacher's account that other students—who were Facebook friends of the girls—freely showed the photos. The Court noted that the default setting for Facebook posts is "Public," and absent proof that the students positively limited disclosure, they could not claim protection.

Even a "Friends Only" setting does not automatically guarantee privacy. The Court observed that Facebook friends can share or tag others, expanding the audience beyond the original circle. A user's friends may include strangers, and the sheer number of friends can be substantial.

The Ruling

The Court denied the petition and affirmed the trial court's dismissal. The school did not violate the students' privacy rights because it was a mere recipient of the photos, which were voluntarily shown by persons who had legitimate access. The school did not resort to unlawful means of gathering information. The Court also noted that the photos were appended to a memorandum filed in court, which did not amount to offensive disclosure.

Practical Takeaways

• Privacy settings matter. A Facebook user who sets posts to "Only Me" or "Custom" has a stronger claim to privacy protection than one who leaves posts at the default "Public" setting.
• "Friends Only" is not absolute privacy. Because friends can share or tag others, a "Friends Only" setting does not guarantee that only the intended audience will see the content.
• The writ of habeas data is broad. It applies beyond extralegal killings and enforced disappearances, and it can reach private individuals or entities that gather data even if data collection is not their business.
• Voluntary disclosure defeats privacy claims. If someone with legitimate access shares information, the recipient who merely views or receives it may not be liable for invasion of privacy.
• Cyber responsibility is shared. Users must exercise due diligence in protecting their own privacy online. Parents and schools play a role in teaching responsible social networking.

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.