Order Text
IN RE: BREACH NOTIFICATION REPORT OF ROSEWOOD HOTEL GROUP CID BN No. 17-005
x----------------------------------------------------x
ORDER
On 05 August 2019, the Commission issued a Resolution containing the following dispositive portion:
WHEREFORE, all premises considered, it is resolved that there are no notable findings requiring further action from this Commission with regard to the breach subject of the notification, and that the Rosewood Hotel Group be ordered to submit a comprehensive report in compliance with Section 9 of Circular No. 16-03 within thirty (30) days of receipt of this Resolution.
On 9 September 2019, the Commission received a comprehensive report from the Rosewood Group, containing the additional information required by the Commission, such as:
- A full chronology of the discovery of the breach, which was from the time they were notified by Sabre of the incident and was informed of the extent of unauthorized access.
- A full chronology of the actions taken and decisions made upon knowledge of the breach, where they narrated how they coordinated with Sabre in mitigating the damage, notified law enforcement and payment card brands to help mitigate harm to the affected data subjects, and how they identified the affected data subjects and located their contact information, including their establishment of call center to further assist them;
- A discussion on their compliance with the required notification to data subjects, attaching thereto a copy of the notification letter, guidelines for reporting to the Federal Trade Commission for US residents, and State-specific instructions for US residents;
- A presentation of their Data Security Incident Response Plan where revisions were made in light of the lessons learned from this breach incident.
On 4 March 2020, the Enforcement Division issued its findings on the compliance report. Its assessment stated thus:
The comprehensive report by the Rosewood Group was submitted within the period prescribed and upon reviewing, we found that the measures undertaken and the notification sent comply with R.A. 10173 or the Data Privacy Act, its Implementing Rules and Regulations, and NPC Circular 16-03 on Personal Data Breach Management.
After the breach, the Rosewood Group reviewed their Data Security Incident Response Plan and made revisions to it in light of the lessons learned from the incident, which includes specific steps that the company will take upon receiving the reports from their service providers.
WHEREFORE, all premises considered, the Commission resolves that the matter of NPC BN 17-005 (“In Re: Breach Notification Report of Rosewood Hotel Group”) be considered CLOSED.
SO ORDERED.
City of Pasay, Philippines 2 July 2020.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
SGH
ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission