Order Text
IN RE: BREACH NOTIFICATION REPORT OF AXA PHILIPPINES INVOLVING JUICE AND WRAPPED IDEAS, INC. CID BN No. 17-041
x----------------------------------------------------x
ORDER
On 20 August 2019, the Commission issued a Resolution containing the following dispositive portion:
WHEREFORE, all premises considered, it is resolved that there are no notable findings requiring further action from this Commission with regard to the data breach subject of the notification, and that AXA Philippines is ordered to submit a comprehensive report stating the above specifications and in compliance with Section 9 of Circular No. 16-03 within thirty (30) days of receipt of Resolution.
On 27 September 2019, AXA submitted its Compliance Report detailing the description of the personal data breach; actions and decisions of the incident response team; post-breach review and the outcome of the breach management and difficulties encountered; and compliance with notification requirements and assistance provided to affected data subjects.
In its Compliance Report, AXA conveyed that on 14 December 2017, after the report to this Commission was made and the partial list was retrieved, they informed the known affected data subjects regarding this breach. They also conveyed that JWI was required to execute a certification that data collected for AXA has been deleted from all their systems, and said certification has been issued. AXA has terminated the services of JWI and removed them from their list of accredited suppliers. AXA likewise conducted a face-to-face data privacy training for the members of its Marketing Team on 20 December 2017. They also reported that its Procurement Team has since implemented an improved vendor risk assessment framework, which includes, among others: (1) an assessment on the third party’s information security procedure when entering into Data Sharing Agreements or Outsourcing Agreements; (2) examination of policy and collection controls, access controls, and physical security; (3) processes to check accuracy and correctness of personal information; (4) existence of contingency controls and retention, disposal, breach procedure; and (5) training and compliance.
For its post-breach review, AXA reported having implemented several improvements such as: (1) an improved and revised Data Breach Management process; (2) regular meeting with the Data Privacy Committee; (3) policy to ensure the training of all employees on Data Privacy on at least an annual basis; (4) inclusion of data privacy in the internal quality assessment process; (5) required approval by the Data Protection Officer for projects and third party engagements in dealing with processing of personal information; and (6) an improved central repository and logging system for their documents.
Upon review of the Compliance Report submitted by AXA Philippines on 27 September 2019, the Commission finds that AXA has timely complied with the Order of this Commission in the Resolution of NPC BN 17-041, dated 20 August 2019, to submit a comprehensive report. The Post-Breach Review Report of AXA is substantially in compliance with Section 9 of Circular No. 16-03.
WHEREFORE, all premises considered, it is resolved that the matter of NPC BN 17-041 is hereby considered CLOSED.
SO ORDERED.
City of Pasay, Philippines 24 October 2019.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
IVY D. PATDU On Official Travel Deputy Privacy Commissioner RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Copy furnished:
IB Data Privacy Officer AXA Philippines
ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission