Text
30 September 2020
Re: MASS EMAIL SENT USING CARBON COPY
Dear [Redacted],
We write in response to your email addressed to the Department of Justice (DOJ) which was subsequently referred to the National Privacy Commission (NPC). Upon evaluation and recommendation by the Complaints and Investigation Division (CID), the Office of the Privacy Commissioner endorsed the matter to the Privacy Policy Office for the issuance of an advisory opinion in accordance with the Rules of Procedure of the NPC, specifically Section 4 of NPC Circular 16-04 – Rules of Procedure, which states that the failure to comply with the requirements of this Section shall cause the matter to be evaluated as a request for an advisory opinion.
We understand based on your email that a certain company doing business as an online gaming hub for players sent you and others an email advisory for a “clan masters” meeting. However, the advisory was sent using the carbon copy (cc) feature in sending emails. Hence, all the recipients were able to see the email addresses of the other recipients of the email. You are concerned that the company has compromised your personal information.
Discussion
Obligations of a Personal Information Controller; Security Measures
The company inadvertently disclosed personal information belonging to the players. We are of the opinion, however, that the said act was not done with malice or bad faith.
Nevertheless, the company, as a personal information controller (PIC), should have acted with prudence and considered sending the email advisory through blind carbon copy (bcc) instead. When processing personal information, PICs are required to implement reasonable and appropriate organizational, physical, and technical security measures to protect personal data and maintain its confidentiality, integrity, and availability.
This would include having the appropriate policies in place to govern the processing of personal and sensitive personal information of customers and ensuring that employees are adequately trained on proper email usage to protect the data subjects from unauthorized access to or disclosure of their personal information.
Personal Data Breach; Notification Requirements
As the incident happened prior to the effectivity of NPC Circular No. 16-03 on the management of personal data breaches, we refer instead to Section 38 of the Implementing Rules and Regulations (IRR) of the DPA, to wit:
Section 38. Data Breach Notification.
a. The Commission and affected data subjects shall be notified by the personal information controller within seventy-two (72) hours upon knowledge of, or when there is reasonable belief by the personal information controller or personal information processor that, a personal data breach requiring notification has occurred.
b. Notification of personal data breach shall be required when sensitive personal information or any other information that may, under the circumstances, be used to enable identity fraud are reasonably believed to have been acquired by an unauthorized person, and the personal information controller or the Commission believes that such unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.
In this case, email addresses, while not categorized as sensitive personal information, may nonetheless be used to enable identity fraud when acquired by an unauthorized person. The company should have therefore notified the Commission and the affected data subjects of the breach within seventy-two (72) hours upon knowledge that a personal data breach requiring notification has occurred, in accordance with Section 38 as mentioned above.
If you have not been notified by the personal information controller about this breach, or should you still wish to pursue this matter, you may refer to our website to download a copy of the Complaints-Assisted Form (CAF) available at https://www.privacy.gov.ph/complaints-assisted/.
This opinion is rendered solely on the information you have provided. Additional information may change the context of the inquiry and the appreciation of the facts.
For your reference.
Very truly yours,
(Sgd.) RAYMUND ENRIQUEZ LIBORO Privacy Commissioner