Can Employers Post a Former Employee’s Name and Photo on Facebook? Philippine Privacy Rules
Yes. A business in the Philippines may tell customers that a former employee is no longer authorized to represent it, but a public notice must have a lawful basis and disclose only what is necessary. Publishing alleged crimes, disciplinary details or embarrassing personal information can violate privacy principles and create other legal risks. The National Privacy Commission (NPC) discussed these limits in Advisory Opinion No. 2024-017 and Advisory Opinion No. 2022-009.
Imagine scrolling through Facebook and seeing a “Notice to the Public” featuring a former worker’s name and photo, warning customers not to transact with that person. When is that customer protection, and when does the announcement go too far?
Is a public notice about a former employee legal?
Under Republic Act No. 10173, the Data Privacy Act of 2012, names, identifiable photos and employment status are personal information. Section 12(f) permits processing for legitimate interests where necessary and not overridden by the person’s fundamental rights and freedoms. Consent is therefore not always mandatory, but legitimate interest is not an automatic exemption. An employer must still satisfy transparency, legitimate purpose and proportionality.
The NPC recognizes that companies may need to inform customers that a former sales agent, employee or representative no longer has authority to accept payments or act on their behalf. This is especially relevant where customers previously dealt with that person. The announcement should be accurate, narrowly tailored and made through an appropriate channel. NPC Opinion 2024-017.
What information may a company include?
| Detail | Practical legal assessment |
|---|---|
| Name and statement of non-affiliation | May be proportionate where needed to prevent unauthorized dealings. |
| Loss of authority to receive payments or represent the company | May be relevant if accurate and necessary for customer protection. |
| Photograph | Not automatically prohibited; assess whether a photo is actually necessary. |
| Reasons for dismissal or private disciplinary records | Often unnecessary for customer protection; avoid routine disclosure. |
| Alleged theft, other offenses, pending criminal cases | High risk; criminal-proceeding information is sensitive and accusations can create separate liability. |
In Advisory Opinion No. 2024-017, the NPC distinguished ordinary identifying information from sensitive information concerning alleged offenses and criminal proceedings. It found no applicable lawful basis for publishing the sensitive details proposed in the particular case. Section 12(f) covers ordinary personal information, not sensitive personal information, which must satisfy an applicable condition under Section 13.
The three-part legitimate-interest assessment
- Purpose test: Identify a real, lawful reason—such as protecting customers from unauthorized transactions.
- Necessity test: Ask if direct customer messages, official email, signage, or verification channels can achieve the goal with less exposure.
- Balancing test: Weigh the business’s interest against potential harm to the former worker’s privacy, reputation, dignity and other rights.
The NPC described these tests in Advisory Opinion No. 2022-009. NPC Circular No. 2023-07 also requires a legitimate-interest assessment. Employers should document why the audience, medium, data included and duration of a notice are necessary.
Can an employer face cyberlibel or civil liability?
Possibly—but not merely because the notice identifies a former employee. Calling a person a “thief” or “scammer,” or publishing an unproven accusation may raise cyberlibel concerns if the legal elements are established. The starting statutory authorities are Section 4(c)(4) of Republic Act No. 10175 and the Revised Penal Code provisions on libel. Separate civil remedies may arise from Civil Code Articles 19, 20 and 21 (abuse of rights or wrongful injury) and Article 26 (dignity, privacy and peace of mind). None of those provisions automatically makes every public notice unlawful: liability depends on the applicable elements, context, fault, evidence of injury and appropriate remedies. A privacy dispute about an online notice is also distinct from whether the employee’s dismissal itself was valid.
For the separate employer obligations when ending employment, read LaborCode’s guide to terminating an employee in the Philippines. For the distinct data-privacy question of what counts as sensitive personal information, see CyberCode’s sensitive personal information examples.
Example of a restrained notice
Customer advisory: Effective [date], [name] is no longer authorized to transact, accept payments or represent [company]. For verification of authorized representatives, please contact [official contact channel].
This is an illustration, not a blanket legal approval. A company should first confirm that publicly naming the person is necessary, the information is accurate, and a less intrusive customer communication will not suffice. Do not add allegations or imply the departure proves misconduct.
What should an affected former employee do?
- Preserve screenshots, links, publication dates, comments, messages and evidence of any inaccuracies or resulting harm.
- Send a written correction or removal request identifying unnecessary, sensitive or false details.
- If the written correction request remains unresolved, review the NPC’s official complaint requirements. Generally, the rules require the organization to receive written notice and an opportunity to respond; no timely or appropriate action, including no response within fifteen (15) calendar days, may satisfy the exhaustion requirement, subject to the NPC’s exceptions. Seek legal advice where defamation or civil remedies are at issue.
- If the posting is connected to a workplace disciplinary dispute, keep employment notices and supporting documents. See the Notice to Explain guide.
Employer and HR checklist
- Identify and document the customer-protection purpose and legitimate-interest assessment.
- Limit the disclosure to accurate facts necessary to prevent unauthorized transactions.
- Prefer direct communications with affected customers where they adequately address the risk.
- Never publish case allegations, sensitive information or humiliating statements merely to explain the separation.
- Set a date to review, correct or remove the notice when the risk has passed.
Frequently asked questions
Can an employer publish a former employee’s photograph without consent?
Sometimes, where there is a proper legal basis and the photograph is demonstrably necessary and proportionate. An employer should not include a photo automatically simply because one is available.
Can a Facebook notice say an employee was dismissed for theft?
That creates considerably greater legal risk. Details of alleged offenses or pending criminal proceedings can be sensitive personal information; NPC Opinion 2024-017 warned against such publication in the proposed notices it assessed.
Is notifying customers privately always lawful?
No. A targeted notice may be less intrusive, but it still must be accurate, legally justified and limited to necessary information.
Does resignation end a worker’s right to privacy?
No. Former employees continue to have rights under data privacy law. The lawfulness of an employer’s notice depends on its specific purpose, lawful basis and proportionality.
Primary legal sources
- Republic Act No. 10173, Sections 11–13
- NPC Advisory Opinion No. 2024-017 (18 December 2024)
- NPC Advisory Opinion No. 2022-009 (2 March 2022)
- NPC Circular No. 2023-07, Guidelines on Legitimate Interest
This article provides general legal information, not individualized legal advice. NPC advisory opinions are guidance addressing presented facts, not court judgments of liability.
