Order Text
IN RE: BREACH NOTIFICATION REPORT OF SPROUT SOLUTIONS, INC. AFFECTING MARIE FRANCE GROUP OF COMPANIES CID BN No. 17-046 and 17-047
x----------------------------------------------------x
ORDER
On 25 July 2019, the Commission issued a Resolution containing the following dispositive portion:
WHEREFORE, all premises considered, this Commission finds that Sprout Solutions, Inc. and Marie France Group of Companies are required to notify the data subjects affected by this data breach, furnishing them the required information enumerated in Section 18(c) of the Commission’s Circular No. 16-03. Sprout Solutions, Inc. and Marie France Group of Companies are ordered to submit proof of their compliance within thirty (30) days from receipt of this Resolution.
On 5 September 2019, the Commission received a Manifestation of Compliance from Sprout Solutions, Inc. It received a Supplemental Manifestation of Compliance on 6 September 2019.
The Manifestation of Compliance contained the following: (1) Acknowledgment letter to the NPC stating that Sprout Solutions, Inc. and Marie France Group of Companies have received the 25 July 2019 Resolution on 8 August; (2) Template letter-notice patterned after Section 18(c) of the Implementing Rules and Regulations of the Data Privacy Act of 2012; (3) Affidavit executed by Sprout’s Data Privacy Officer and Vice President for Operations and Legal, AC, with respect to Notices addressed to KMC Employees; and (4) Affidavit of Service executed by Sprout’s Legal Counsel, LVO, with respect to Notices addressed to Marie France employees.
On 18 September 2019, the Commission received a Compliance letter from Marie France Group of Companies. Attached to the said letter were the following: (1) DPO Memorandum 19-001 which was sent to the affected employees of the MF Group; (2) Copies of the duly accomplished acknowledgment receipt of the affected employees who are still employed by the MF group; (3) A copy of the e-mail sent to the employees who failed to sign the acknowledgment receipt because their schedule did not permit them or they were on leave at the time the memorandum was sent; and (4) A copy of the transmittal sheet as proof of mailing of the DPO Memorandum by registered mail.
On 27 September 2019, the Enforcement Division issued its findings on the compliance reports. Its assessment stated thus:
Upon reviewing the Compliance Reports submitted by Sprout Solutions Phil., Inc. and Marie France Group of Companies on 2 and 6 September 2019, we found that the reports have fully complied with the Order of this Commission.
It was found that the notification sent to all affected data subjects complied with the requirement of Section 18 (c) of NPC Circular No. 16-03 on contents of notification. Further, Sprout and Marie France notified the affected data subjects individually through registered mail in compliance with Section 18(d) of the same circular. Affidavits were executed by Sprout’s officers attesting to the sending of individual notice by registered mail.
WHEREFORE, all premises considered, the Commission resolves that the matters of NPC BN 17-046 and 17-047 are considered CLOSED.
SO ORDERED.
City of Pasay, Philippines 28 October 2019.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
IVY D. PATDU Deputy Privacy Commissioner
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
Copy furnished:
EPJ Corporate Legal Counsel Marie France Group of Companies
AC VP, Operations and Legal
ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission