Can Consultants Face Criminal Charges for Leaking Client Data?

Introduction

Private consultants often receive confidential business information, including pricing methods, financial records, customer data, expansion plans, and proprietary business strategies. When a consultant discloses that information without authority, the client may consider filing criminal charges under Article 291 of the Revised Penal Code.

Article 291, however, does not penalize every person who receives confidential information. It applies to a manager, employee, or servant who learns the secrets of a principal or master by reason of that position and later reveals them. An independent contractor or consultant may therefore be covered only if the evidence shows that the person falls within the provision’s employment or agency relationship.

What Does Article 291 Penalize?

Article 291 of the Revised Penal Code, as amended by Republic Act No. 10951, penalizes the disclosure of secrets by a manager, employee, or servant who learns those secrets in that capacity and reveals them.

The current penalty is arresto mayor and a fine not exceeding ₱100,000. This amended penalty is stated in Section 76 of Republic Act No. 10951, which revised Article 291. The original ₱500 fine under the Revised Penal Code has been superseded by the amended amount.

The provision is distinct from Article 209, which concerns an attorney or another person duly authorized to represent or assist a party in a case. Article 209 may apply when the confidential information was obtained in a professional legal relationship or when the person undertakes the defense of opposing parties in the same case without the first client’s consent.

Elements of the Offense

A complaint under Article 291 should allege and support the following circumstances:

• Status of the respondent: The respondent was a manager, employee, or servant of the complainant or was in a substantially similar position of trust and subordination.
• Existence of a secret: The information involved confidential business, financial, commercial, or operational information that was not generally known or readily available to the public.
• Acquisition by reason of position: The respondent learned the information because of the employment, service, or entrusted role.
• Disclosure: The respondent communicated, transferred, published, sold, or otherwise made the information available to another person.
• Absence of authority: The disclosure was not authorized by the client, permitted by contract, required by law, or otherwise justified by a lawful purpose.

The prosecution must establish these matters through evidence. Suspicion, an unexplained business loss, or the mere fact that the consultant later worked for another company will not by itself prove unlawful disclosure.

Can an Independent Consultant Be Charged?

Possibly, but not automatically. The label used in a contract is not necessarily decisive. Prosecutors and courts may examine the actual relationship between the parties, including the degree of control exercised by the client, the consultant’s authority, the manner in which the work was performed, and the consultant’s access to confidential information.

A consultant is more likely to be considered covered by Article 291 when the evidence shows that the person functioned as an employee, manager, or trusted subordinate rather than as an independent business operator. Relevant facts may include fixed working hours, direct supervision, continuing service, integration into the client’s operations, authority to access internal systems, and regular reporting to company officers.

Conversely, a consultant who operates an independent business, serves multiple clients, controls the manner of performing the engagement, and merely provides specialized advice may not fall within the precise wording of Article 291. In that situation, other criminal, civil, contractual, or data-protection remedies may need to be examined.

What Information May Qualify as a Secret?

Article 291 does not define “secrets” in detail. The information should therefore be evaluated according to its character, the measures taken to protect it, and the circumstances under which it was disclosed.

Examples may include confidential financial projections, non-public pricing formulas, customer lists, supplier terms, unpublished product plans, internal security procedures, and proprietary business strategies. The Supreme Court has recognized that trade secrets are privileged and may be protected from compulsory disclosure in judicial proceedings in Air Philippines Corporation v. Pennswell, Inc., G.R. No. 172835, 13 December 2007.

That decision does not mean that every commercial document is automatically a trade secret. The complainant should show why the information was confidential, how access was restricted, and what competitive or financial harm could result from its disclosure.

Evidence Needed to Support the Complaint

A well-prepared complaint should establish both the confidential character of the information and the respondent’s unauthorized disclosure. The following evidence may be relevant:

• Consultancy agreements, employment records, nondisclosure agreements, confidentiality policies, and access-control documents;
• Emails, messages, file-transfer records, system logs, screenshots, or other records showing access or transmission;
• Copies of the documents or data allegedly disclosed, together with proof that they were confidential;
• Witness statements from officers, employees, customers, or recipients of the information;
• Forensic reports identifying downloads, forwarding, copying, or unauthorized access; and
• Evidence linking the disclosure to a particular recipient, competitor, transaction, or commercial use.

The complainant should preserve original electronic evidence and document how it was obtained. Altered screenshots, incomplete message threads, or files lacking authentication may weaken the complaint.

Where and How Is the Criminal Complaint Filed?

The usual process begins with the filing of a complaint-affidavit before the proper prosecutor’s office. The complaint should identify the respondent, describe the confidential information, explain the respondent’s relationship with the client, narrate the disclosure, and attach supporting evidence.

The prosecutor conducts preliminary investigation under the applicable criminal procedure. The respondent is given an opportunity to submit a counter-affidavit. The complainant may file a reply when allowed, after which the prosecutor determines whether probable cause exists to charge the respondent in court.

If probable cause is found, the corresponding information may be filed before the proper trial court. The court then determines whether an arrest warrant or summons should issue and eventually resolves the case after trial, unless the case is dismissed, withdrawn, or otherwise terminated according to law.

Possible Defenses

A respondent may dispute one or more elements of the offense. Common defenses include the following:

• The respondent was an independent contractor outside the class of persons covered by Article 291;
• The information was not secret because it was publicly available or commonly known in the industry;
• The respondent did not obtain the information by reason of the engagement;
• The disclosure was authorized, required by law, or made for a legitimate business or legal purpose;
• The alleged disclosure was not attributable to the respondent; or
• The evidence does not reliably establish what was disclosed, to whom, or when.

The absence of a written confidentiality agreement does not necessarily authorize disclosure. It may nevertheless make the complainant’s proof more difficult, particularly when the information’s confidential character is disputed.

Article 291 and Other Remedies

An Article 291 complaint should not be treated as the only possible remedy. Depending on the facts, the client may also consider a civil action for breach of contract, damages, injunction, or protection of trade secrets.

If personal information or sensitive personal information was disclosed, the Data Privacy Act may also be relevant. Section 32 of the Data Privacy Act penalizes unauthorized disclosure, subject to the statute’s exceptions. In JPV v. Souley MD Services, Inc., NPC 22-201, 4 March 2024, the National Privacy Commission explained that disclosure may be lawful when necessary for the establishment, exercise, or defense of legal claims under Section 13(f) of the Data Privacy Act, provided that the disclosure is relevant and proportionate.

Not every use of another person’s data constitutes unauthorized disclosure. The purpose, legal basis, scope, recipient, and proportionality of the disclosure must be examined.

Article 291 Compared with Article 209

Article 209 may be more appropriate when the respondent is a lawyer or a person duly authorized to represent or assist a party in a case and the disclosure involves secrets learned in a professional legal capacity. Section 36 of Republic Act No. 10951 amended Article 209 and extended its wording beyond attorneys and solicitors to include persons duly authorized to represent or assist a party in a case.

Article 291, in contrast, focuses on the abuse of a position as a manager, employee, or servant. The principal question is whether the person learned the secret through that position and then revealed it.

Typical Scenarios

Employee-consultant: A company hires a consultant under a service contract, but the consultant works full-time under the company’s direct supervision, uses company systems, and performs the duties of an internal manager. Article 291 may be considered if the consultant discloses confidential business information.

Independent business adviser: A consultant gives general market advice to several clients and later uses publicly available industry information in another engagement. Article 291 may not apply because the information may not be secret and the consultant may not be a manager, employee, or servant of the complainant.

Disclosure for litigation: A consultant provides relevant client records to counsel for use in a court proceeding. The disclosure may be legally justified, depending on its purpose, scope, authorization, and compliance with applicable privacy requirements.

Recommended Steps for the Client

1. Immediately preserve electronic records, access logs, contracts, messages, and copies of the allegedly disclosed material.
2. Restrict further access and change passwords or system permissions when necessary.
3. Identify the information disclosed, its confidential status, the recipient, and the resulting or threatened injury.
4. Review the consultant’s actual working relationship with the client rather than relying only on the contract’s title.
5. Obtain a forensic assessment when electronic copying, forwarding, or downloading is alleged.
6. Evaluate Article 291 together with contractual, civil, privacy, and other potentially applicable remedies.
7. Have counsel assess prescription, venue, jurisdiction, authentication, and the sufficiency of the evidence before filing.

Conclusion

A private consultant who leaks client data may face criminal liability, but Article 291 does not cover every confidential disclosure by every consultant. The prosecution must show that the respondent occupied a position covered by the law, learned a genuine secret because of that position, and revealed it without lawful authority.

The strongest complaint combines proof of the respondent’s actual role, the confidential nature of the information, the specific act of disclosure, and the absence of authorization. Because Article 291 was amended by Republic Act No. 10951 and may overlap with contractual, civil, and data-protection remedies, the facts should be reviewed under the current text of each applicable law before criminal proceedings are commenced.

About Nicolas and De Vega Law Offices

  Nicolas and de Vega Law Offices is a full-service law firm in the Philippines.  You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines.  You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.