Order Text
IN RE: ROKKO AND ASSOCIATES, INC. CID BN 19-034
x----------------------------------------------------x
ORDER
Before this Commission is a complete post breach report submitted by Hexel Works, Inc. (formerly Rokko and Associates, Inc.), through The Law Firm of Ingles Laurel Calderon dated 28 July 2020.
Facts
On 02 July 2020, this Commission issued a resolution granting the request for an alternative means of notifying the data subjects of Hexel Works, Inc. (Hexel) containing the following dispositive portion:
WHEREFORE, all premises considered, the requested means by Hexel Works, Inc. to notify the affected data subjects is hereby GRANTED.
The complete post breach report, including details of notification and assistance provided to the data subjects, should be submitted within fifteen (15) days from receipt of this Resolution.
On 28 July 2020, Hexel submitted through its local representative a complete post breach report, including the details of notification and the assistance provided to the affected data subject. They also attached therein the Affidavit of Compliance relating to the individual notification of the data subjects.
In the said report, Hexel informed this Commission that it received the Resolution dated 02 July 2020 of this Commission which granted their request of sending mass e-mail notification and ordering their submission of the complete post breach report only last 21 July 2020. However, while awaiting the Resolution of the Commission, on 09 July 2020, Hexel sent out individual notices through the email addresses of the affected data subjects, which contained, among others: (a) an apology from Hexel; (b) the personal data breached; (c) the nature of the breach; (d) the measures taken by Hexel to address the breach; (e) the measures taken by Hexel to reduce the harm of the breach; and (f) the contact details of Hexel’s representative for further assistance.
Since Hexel already notified all one hundred fifty-eight (158) data subjects individually last 09 July 2020, they no longer notified the affected data subjects in the mass e-mail manner stated in their previous request with the Commission.
Discussion
This Commission, upon reviewing the complete post breach report submitted by Hexel through its local representative, finds that Hexel has complied with the previous Orders and Resolution of the Commission.
The Commission finds that the complete post breach report submitted by Hexel Works, Inc. dated 28 July 2020 is sufficient and considers this matter closed.
Section 17 of the NPC Circular 16-031 provides that the Notification shall include, but not be limited to:
- Nature of the Breach
- a. description of how the breach occurred and the vulnerability of the data processing system that allowed the breach;
- b. a chronology of the events leading up to the loss of control over the personal data;
- c. approximate number of data subjects or records involved;
- d. description or nature of the personal data breach;
- e. description of the likely consequences of the personal data breach; and
- f. name and contact details of the data protection officer or any other accountable persons.
- Personal Data Possibly Involved
- a. description of sensitive personal information involved; and
- b. description of other information involved that may be used to enable identity fraud.
- Measures Taken to Address the Breach
- a. description of the measures taken or proposed to be taken to address the breach;
- b. actions being taken to secure or recover the personal data that were compromised;
- c. actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident;
- d. action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification;
- e. the measures being taken to prevent a recurrence of the incident.
The Commission reserves the right to require additional information, if necessary.
In this case, the complete post breach report dated 28 July 2020 submitted by Hexel has already indicated the nature of the breach, the possible personal data involved, and the measures taken to address the breach.
The content and information of the complete breach report is needed by the Commission in order to determine whether Hexel has acted adequately in order to protect the rights of the affected data subject and to see if Hexel has undertaken measures to avoid further damage and prevent similar incidents from recurrence.
While it is worth noting that Hexel has notified the Commission beyond the period of seventy-two (72) hours upon knowledge as required by the Section 17(A) of the NPC Circular 16-03 which provides that the Commission shall be notified within seventy two (72) hours upon knowledge of or the reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred, Hexel nevertheless implemented measures to address the breach which are indicated in its complete post breach report.
In order to secure or recover the data compromised, Hexel has duplicated the data stored on both laptops through the company server, as the original database was secured and stored in such server, before both laptops went missing.
As to the notification of data subjects, Hexel also complied with the requirements of Section 18 of NPC Circular 16-03. An affidavit of compliance was executed by Hexel’s legal counsel, who also attached therein the copy of the apology letter and notification of breach.
To prevent recurrence of the incident, Hexel also took the following steps:
- Retained its policy that each laptop requires a login password to be accessed; and
- Installed a Hard Disk Drive (HDD) lock software to laptops used outside the company premises to ensure that the hard drive will be locked, and the data will be encrypted if the login password is incorrectly entered for more than a limited time.
WHEREFORE, all premises considered, the Commission resolves that the matter CID BN 19-034 — “In Re: Rokko and Associates, Inc.” is hereby considered CLOSED.
SO ORDERED.
Pasay City, Philippines; 21 September 2020.
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRE Deputy Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
THE LAW FIRM OF INGLES LAUREL CALDERON Counsel of the PIC
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission