Order Text
IN RE: BREACH NOTIFICATION REPORT OF AXA PHILIPPINES INVOLVING JUICE AND WRAPPED IDEAS, INC. CID BN No. 17-041
x----------------------------------------------------x
ORDER
On 20 August 2019, the Commission issued a Resolution containing the following dispositive portion:
WHEREFORE, all premises considered, it is resolved that there are no notable findings requiring further action from this Commission with regard to the data breach subject of the notification, and that AXA Philippines is ordered to submit a comprehensive report stating the above specifications and in compliance with Section 9 of Circular No. 16-03 within thirty (30) days of receipt of Resolution.
On 27 September 2019, AXA submitted its Compliance Report detailing the description of the personal data breach; actions and decisions of the incident response team; post-breach review and the outcome of the breach management and difficulties encountered; and compliance with notification requirements and assistance provided to affected data subjects.
In its Compliance Report, AXA conveyed that on 14 December 2017, after the report to this Commission was made and the partial list was retrieved, they informed known affected data subjects regarding this breach. They also conveyed that JWI was required to execute a certification that data collected for AXA has been deleted from all their systems, and said certification has been issued. AXA has terminated the services of JWI and removed them from their list of accredited suppliers. AXA likewise conducted a face-to-face data privacy training for the members of its Marketing Team on 20 December 2019.
On 14-15 September 2017, JWI mounted an event for AXA Philippines that utilized one iPad unit with a web-based registration app supported by a pocket Wi-Fi. During this event, the Distribution Team manned an activation booth and went around the food court to invite people to register. These individuals were considered “leads” to be contacted by the Marketing Team of AXA Philippines. On the first day of the event, the assigned project officer monitored the entries through the back-end Wordpress dashboard of the app. By the end of the event, there were a total of 107 entries for the first day and 118 entries for the second day.
Once the representative from JWI coordinated with their IT specialist for the extraction of the database from the two events, however, they found that only 49 entries were recorded for the first day and all the entries from the second day were gone. An internal investigation conducted by JWI confirmed that there were indeed data inputs during the dates of the events, as the app’s server logs revealed records of users’ transactions and logs into the app with time marks as early as 11:40 AM up to 6:41 PM of 15 September. The IT specialist also found that there was an “admin access” on the app’s back-end on 18 September 2017 by an unidentified user, who exported and deleted entries.
AXA Philippines has since reported that it: (1) changed the log-in and password; (2) exported the database and saved it in a secure location; and (3) continuously monitored the JWI server for possible intrusions of the app. AXA Philippines also reported that it ceased from engaging further with JWI after the incident, resolved to investigate employees who have dealt with JWI, and proposed to strengthen measures on third party engagements.
Notably, there is a lack of notification to the affected data subjects. While this may be attributed to the inability to do so due to the loss of personal information, the Commission takes note of a statement made in the breach notification report: “We emphasize to the Honorable Commission at this point that: (1) The data subjects are not clients of AXA Philippines as they are supposedly potential “leads” to be contacted by our Marketing team…” It must be noted, however, that Section 15 of Circular 16-03 provides that “the personal information controller shall notify… the affected data subjects upon knowledge of, or when there is reasonable belief that a personal data breach has occurred. The obligation to notify remains with the personal information controller even if the processing of information is outsourced or subcontracted to a personal information processor.” Hence, the fact that the affected individuals were still “leads” and not clients of the personal information controller should not be a factor in considering whether to notify data subjects of a breach.
Upon consideration of the Investigator’s Report and the Breach Notification of AXA Philippines, the Commission hereby resolves that there are no notable findings requiring further action from the Commission with regard to the data breach subject of the notification.
Taking note of the time that has lapsed since the incident, the Commission hereby requires a comprehensive report on the status of AXA Philippines’ abovementioned investigation on the employees that have dealt with JWI, as well as its implementation of the “strengthened measures on third party engagements.” Pursuant to Section 9 of Circular No. 16-03, the report shall also include:
A. A description of the personal data breach, its root cause and circumstances regarding its discovery; B. Actions and decisions of the incident response team; C. The outcome of the breach management, and difficulties encountered; and D. Compliance with notification requirements and assistance provided to affected data subjects.
This report shall also include a procedure for a Post-Breach Review which must be established for the purpose of improving the personal data breach management policies and procedures of the personal information controller or personal information processor.
WHEREFORE, all premises considered, it is resolved that there are no notable findings requiring further action from this Commission with regard to the data breach subject of the notification, and that AXA Philippines is ordered to submit a comprehensive report stating the above specifications and in compliance with Section 9 of Circular No. 16-03 within thirty (30) days of receipt of this Resolution.
SO ORDERED.
City of Pasay, Philippines 20 August 2019.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
IVY D. PATDU Deputy Privacy Commissioner
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Copy furnished:
IB Data Privacy Officer AXA Philippines
ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission