NPC BN 18-002: In re: Smart Communications, Inc. -SM MOA Branch

Reference

NPC BN 18-002

Length

8 pages

Source listing

NPC orders listing

Official PDF

• Sec 17 (c). When delay is prohibited
• Sec 17 (d) Content of Notification

Order Text

IN RE: SMART COMMUNICATIONS, INC. -SM MOA BRANCH NPC BN 18-002

x----------------------------------------------------x

ORDER

Before the Commission is the Breach Notification of Smart Communications, Inc. (Smart) dated 05 January 2018.

On 05 January 2018, Smart notified the Commission about an incident that occurred involving an electronic mail (e-mail) that was sent to an unintended recipient which contained personal information and sensitive personal information.¹

In Smart’s Data Breach Notification, it alleged that on 03 January 2018, JO (JO), a postpaid subscriber, visited Smart - Mall of Asia (MOA) Branch to apply for retention of his post-paid account.² JO was assisted by IV (IV), Smart Customer Service Officer, wherein he presented proof of identification and financial documents as supporting documents for the request for the retention of a postpaid account.³ Further, IV accidentally sent JO’s credit card Statement of Account (SOA) such as the name, address, customer number, credit limit, amount due, and payment due date, to another Smart subscriber, a certain WB (WB).⁴

On 04 January 2018, WB responded to the e-mail sent by IV that she inadvertently sent the SOA of JO to him and informed the latter of the “data privacy implications of [the] said mistake.”⁵ Smart alleged that pursuant to its information and data security protocol, it attempted several times on the same day to get in touch with WB to address the incident.⁶ Moreover, Smart assured WB that the incident was an isolated case and only took place “due to [the] sheer inadvertence/accident” of IV, and that appropriate measures have been taken place to ensure the personal data security of Smart’s subscribers.⁷

Based on Smart’s initial investigation, it was discovered that the e-mail sent by IV “auto-resolved the intended recipient’s e-mail address to a random recipient” and was sent to WB, but was intended for Smart Branch Officer WA.⁸

On 05 January 2018, the matter was escalated to Smart’s Data Protection Officer (DPO) and to the PLDT Group DPO. Smart stated in its report that on 05 January 2018, it notified JO regarding the data breach incident.⁹

Smart stated in its data breach notification that, to remediate the incident, it initiated a “refresh information dissemination and training to all SMART retail stores/branches through the re-issuance of Data Privacy Do’s and Don’ts”.¹⁰ Further, they also addressed the “auto-resolved” function of Smart’s e-mail system, especially in typing in the recipient’s e-mail address.¹¹

Smart indicated on its breach notification that IV is currently being investigated to ascertain whether she may be liable under the Company’s Code of Discipline, which has been updated in accordance with the Data Privacy Act of 2012 (DPA).¹²

On 09 January 2018, Smart submitted the screenshot of the e-mail from WB which states that he should not be included in the e-mail thread since he is not working for Smart.¹³ Moreover, WB stated that a personal data breach due to negligence is a violation of the DPA.¹⁴

NC, (NC), Manager of Smart - MOA branch, reached out to WB through e-mail and clarified that it was an honest mistake of IV and that the reason that he received the e-mail is due to the fact that IV previously assisted WB when he applied for a postpaid line.¹⁵ NC reassured IV that this was not just a random case and that all documents of their customers were safe and kept in accordance with the DPA.¹⁶

Smart furnished the Commission with the Copy of SOA of JO.¹⁷ In addition, Smart submitted the letter that was sent to WB which was signed by NC.¹⁸

On 08 January 2018, WB wrote to the Commission that the incident made him “felt that as their customer [his] own data has been compromised.”¹⁹ Further, he stated that he would like to pursue the case further.²⁰

On 09 February 2018, the National Privacy Commission (NPC), through its Complaint and Investigation Division (CID), ordered Smart to submit a full report within five (5) days from receipt detailing the incident containing the following:

1. Nature of the Breach

   • a. Description of how the breach occurred and the vulnerability of the data processing system that allowed the breach;
   • b. A chronology of the events leading up to the loss of control over the personal data;
   • c. Approximate number of data subjects or records involved;
   • d. Description or nature of the personal data breach;
   • e. Description of the likely consequences of the personal data breach; and
   • f. Name and contact details of the data protection officer or any other accountable persons.

2. Personal Data Possibly Involved

   • a. Description of sensitive personal information involved; and
   • b. Description of other information that may be used to enable identity fraud.

3. Measures Taken to Address the Breach

   • a. Description of the measures taken or proposed to be taken to address the breach;
   • b. Actions being taken to secure or recover the personal data that were compromised;
   • c. Actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident;
   • d. Action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification;
   • e. The measures being taken to prevent a recurrence of the incident.²¹

However, the records show that Smart failed to comply with the directive of the Commission to submit its Full Report.

Section 17 (C) and (D) of the NPC Circular No. 16-03 or the Personal Data Breach Management provides:

C. When delay is prohibited. There shall be no delay in the notification if the breach involves at least one hundred (100) data subjects, or the disclosure of sensitive personal information will harm or adversely affect the data subject. In both instances, the Commission shall be notified within the 72-hour period based on available information. The full report of the personal data breach must be submitted within five (5) days, unless the personal information controller is granted additional time by the Commission to comply.²²

D. Content of Notification. The notification shall include, but not be limited to:

1. Nature of the Breach a. description of how the breach occurred and the vulnerability of the data processing system that allowed the breach; b. a chronology of the events leading up to the loss of control over the personal data; c. approximate number of data subjects or records involved; d. description or nature of the personal data breach; e. description of the likely consequences of the personal data breach; and NPC Circular No. 2016-03 Personal Data Breach Management 15 December 2016 f. name and contact details of the data protection officer or any other accountable persons.

2. Personal Data Possibly Involved a. description of sensitive personal information involved; and b. description of other information involved that may be used to enable identity fraud.

3. Measures Taken to Address the Breach a. description of the measures taken or proposed to be taken to address the breach; b. actions being taken to secure or recover the personal data that were compromised; c. actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident; d. action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification; e. the measures being taken to prevent a recurrence of the incident.

The Commission reserves the right to require additional information, if necessary.²³

The full breach report is required to assess whether Smart acted appropriately to protect the rights of the affected data subject and to ascertain whether it has undertaken measures to avoid further damage and prevent similar incidents from recurrence, all of which is crucial for the Commission’s assessment in compliance with the DPA.

Thus, Section 18 (E) of the NPC Circular No. 16-03 states:

E. Form. Notification shall be in the form of a report, whether written or electronic, containing the required contents of notification: Provided, that the report shall also include the name and contact details of the data protection officer and a designated representative of the personal information controller: Provided further, that, where applicable, the manner of notification of the data subjects shall also be included in the report.

Where notification is transmitted by electronic mail, the personal information controller shall ensure the secure transmission thereof.

Upon receipt of the notification, the Commission shall send a confirmation to the personal information controller. A report is not deemed filed without such confirmation. Where the notification is through a written report, the received copy retained by the personal information controller shall constitute proof of such confirmation.²⁴

Moreover, as mentioned in their submissions, Smart claimed that JO has already been notified regarding the incident.²⁵ However, no proof of such notification was submitted by Smart.

Thus, the Commission deems it proper that Smart, as Personal Information Controller (PIC), shall submit its Full Breach Report pursuant to NPC Circular No. 16-03 and proof of notification sent to the affected data subject. Smart is sternly reminded of its obligation to comply with the orders of the Commission.

WHEREFORE, premises considered, Smart Communications, Inc. is hereby ORDERED to submit a Full Breach Report and Proof of Notification to the affected data subject within fifteen (15) days from the receipt of this Order to the Compliance and Monitoring Division (CMD).

The Commission DIRECTS the CMD to issue the appropriate orders necessary to evaluate and monitor the completeness of Smart Communications, Inc.’s data breach notification and assess its breach management pursuant to NPC Circular No. 16-03 (Personal Data Breach Management).

SO ORDERED.

City of Pasay, Philippines. 16 March 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

AGG Data Privacy Officer Smart Communications, Inc.

LJ Chief Data Privacy Officer PLDT, Inc.

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

1. Data Breach Notification of Smart Communications, Inc. dated 05 January 2018. ↩

2. Id. at 1. ↩

3. Id. ↩

4. Id. ↩

5. Data Breach Notification of Smart Communications, Inc. dated 05 January 2018 at 1. ↩

6. Id. ↩

7. Id. ↩

8. Id.. ↩

9. Data Breach Notification of Smart Communications, Inc. dated 05 January 2018 at 2. ↩

10. Id. ↩

11. Id. ↩

12. Id. ↩

13. In re: Smart Communications, Inc. -SM MOA Branch, NPC BN 18-002, Electronic Mail dated 04 January 2018 from Wilbert WB. ↩

14. Id. ↩

15. In re: Smart Communications, Inc. -SM MOA Branch, NPC BN 18-002, Electronic Mail dated 04 January 2018 from Nanette Colon. ↩

16. Id. ↩

17. In re: Smart Communications, Inc. -SM MOA Branch, NPC BN 18-002, JO Statement of Account. ↩

18. In re: Smart Communications, Inc. -SM MOA Branch, NPC BN 18-002, Letter to WB dated 06 January 2018. ↩

19. In re: Smart Communications, Inc. -SM MOA Branch, NPC BN 18-002, Letter of WB dated 06 January 2018. ↩

20. Id. ↩

21. In re: Smart Communications, Inc. -SM MOA Branch, NPC BN 18-002, Inquiry dated 09 February 2018, at pp 1-2. ↩

22. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 17 (c) (15 December 2016) (NPC Circular 16-03). ↩

23. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 17 (d) (15 December 2016) (NPC Circular 16-03). ↩

24. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18 (e) (15 December 2016) (NPC Circular 16-03). ↩

25. Data Breach Notification of Smart Communications, Inc. dated 05 January 2018 at 2. ↩