Order Text
IN RE: VULNERABILITY ASSESSMENT OF JOLLIBEEDELIVERY.COM CID BN No. 17-043
x----------------------------------------------------x
ORDER
On 05 November 2019, the Commission issued an Order with the following dispositive portion:
WHEREFORE, all premises considered, this Commission resolves to:
- GRANT the lifting of the suspension on the operations of jollibeedelivery.com;
- ORDER JFC to file a Monthly Progress Report for three (3) months following the launch of the new jollibeedelivery.com website;
- ORDER JFC to conduct regular audit and monitoring to ensure the implementation of security measures and the protection of processing of personal information, without need of furnishing the Commission.
Jollibee Foods Corporation (“JFC”) has since submitted its Monthly Progress Reports on 11 December 2019, 13 January 2020 and 14 February 2020. These reports include:
- Operational updates on the launch of the website, focused on operations training of participating stores to fully onboard everyone to the features of the new platform and to sustain the new process;
- Security updates showing how Tillster provides continuous security and vulnerability checks and patching as needed to keep the SaaS platform secured and efficient and JFC’s conduct of their own Vulnerability Assessment and Penetration Testing (VAPT); and
- Strategic initiative updates on the possibilities of fully utilizing the SaaS features of Tillster, improving the efficiency of services, and the proactive review and upgrade of the system’s IT infrastructure.
On 19 March 2020, the Enforcement Division issued its findings on JFC’s compliance, thus:
Upon review of the Monthly Progress Reports submitted, it is evident that JFC is continuously monitoring the development of the website and their plans to fully market the same. It can be assessed that they proactively monitor risks and threats and those that were previously declared to the Commission have been properly addressed and qualified.
Further, JFC continuously updates the system’s IT infrastructure to keep up with the technological advances and independently conducts VAPT on demand using their own tool for due diligence.
In view of the foregoing and considering the comprehensive reports previously submitted, the development and improvements made on their delivery website, the efforts exerted to closely work with the NPC to resolve this issue and comply with the DPA, its IRR and issuances, this Division finds that the acts and efforts of JFC to develop their website keeping the principle of Privacy by Design in mind, warrant termination of this case.
WHEREFORE, all premises considered, the Commission resolves that the matter of CID BN 17-043 (“In Re: jollibeedelivery.com”) be considered CLOSED.
SO ORDERED.
City of Pasay, Philippines 18 June 2020.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY DU NAGA Deputy Privacy Commissioner
Copy furnished:
MRG Data Protection Officer Jollibee Group of Companies
ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission