Order Text
IN RE: RESEARCH INSTITUTE FOR TROPICAL MEDICINE NPC BN 20-044
x----------------------------------------------------x
ORDER
LIBORO, P.C.:
Facts
On 22 March 2020, a list from the Research Institute for Tropical Medicine (RITM) that contained the personal information of at least nine (9) persons under investigation (PUI) for COVID-19 circulated on Twitter and Facebook. The source tracing conducted by RITM found possible persons who may have leaked the data from two (2) of their laboratories that mainly handled the data gathering.
On 24 March 2020, the Data Protection Officer (DPO) of RITM has sent a breach report with a request to the National Privacy Commission (NPC) for assistance to conduct a full investigation of this matter1 and exemption for notification of affected data subjects.
On 22 June 2020,2 the Commission issued a Resolution denying RITM’s request for assistance and exemption for notification. In the Resolution, the Commission reiterated the requirement of NPC Circular No. 16-03 (Circular) for a personal information controller (PIC) like RITM to have a data breach response team, which may include its DPO. As provided in the Circular, “the team must be ready to assess and evaluate a security incident, restore integrity to the information and communications system, mitigate and remedy any resulting damage, and comply with reporting requirements.” Thus, the Commission finds that compliance with the Circular must first be made before NPC extends additional assistance, if warranted.
Further, the Commission stressed on the Resolution3 that notification is the general rule during a personal data breach. Considering the reported discriminations against COVID-19 patients and those who are connected or related to them, the Commission finds that this personal data breach gives rise to the risk of serious harm to those PUI whose identity may have been revealed by said breach. As such, Section 11 of the Circular requires notification upon the occurrence of this kind of personal data breach.
On 13 July 2020,4 RITM submitted its full breach report in compliance with the order and expressed their hope that NPC may extend assistance to their team in investigating the case.
On 12 August 2020,5 upon evaluation of the full breach report submitted by RITM, it is found it to be deficient due to RITM’s failure to notify the affected data subjects. RITM was ordered to submit (1) proof of notification to the affected data subjects in the form of notarized affidavit; and (2) copy of the notification letter sent to the affected data subjects.
On 21 August 2020, RITM submitted its Compliance Report to which they stated that they already complied with the notification requirement under NPC Circular 16-03. In the Compliance Report, attached is the Affidavit6 executed by Dr. E.C.A. of RITM attesting to the fact that a notification letter was sent electronically to the affected data subjects on 20 August 2020. In the letter, RITM gave assurance that the data subjects’ personal information no longer exists in any social media platform upon RITM’s latest verification. Further, appropriate strengthening of controls in the RITM’s Data Information System was already put into place to ensure that the same or other forms of data privacy breach shall not happen again.
Discussion
The Commission adjudged that this case can now be considered closed.
In this case, RITM had taken measures to address the breach and to reduce harm or negative consequences of the breach by implementing policies that will prevent the similar events from happening in the future. Right after the Commission’s order to notify the data subjects, RITM promptly complied and sent secured notification letters7 to the data subjects electronically, which included, among others, the (1) nature of the breach; (2) personal data involved; (3) measures taken to address the breach; (4) measures taken to reduce the harm or negative consequences of the breach; (5) contact details of the personal information controller to whom further additional information can be obtained about the breach; and (6) assistance provided to the affected data subjects.
With the foregoing, the Commission finds that RITM satisfactorily complied with the requirements of Section 18 of NPC Circular 16-038 on Personal Data Breach Management, and as well as the Commission’s Resolutions and Orders.
WHEREFORE, all premises considered, the Commission resolves that the matter of NPC BN 20-044 “In re: Research Institute For Tropical Medicine” is hereby considered CLOSED.
With the compliance of both the Commission’s Resolutions and the requirement of NPC Circular No. 16-03 for a PIC like RITM to have a data breach response team that is ready to assess and evaluate a security incident, restore integrity to the information and communications system, mitigate and remedy any resulting damage, and to comply with reporting requirements, the Commission finds it just to extend its assistance to RITM through its Public Information and Assistance Division (PIAD) for the conduct of training and seminar on implementation of privacy and data privacy implementation measure and personal data breach management. RITM may directly coordinate with PIAD through piad@privacy.gov.ph or call +63 234-2228 local 117 and 116.
SO ORDERED.
Pasay City, Philippines; 21 September 2020.
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
O.B.O. Representative for RITM
COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT PUBLIC INFORMATION AND ASSISTANCE DIVISION National Privacy Commission
Footnotes
-
Research Institute for Tropical Medicine Initial Report dated 24 March 2020. ↩
-
Resolution dated 22 June 2020. ↩
-
Ibid. ↩
-
Compliance with Resolution dated 22 July 2020, Research Institute for Tropical Medicine. ↩
-
Enforcement Letter dated 12 August 2020. ↩
-
Affidavit of Dr. E.C.A. dated 21 August 2020. ↩
-
Copy of notification letter sent, letter to Senator Richard Gordon dated 21 August 2020. ↩
-
SECTION 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures: C. Content of Notification. The notification shall include, but not be limited to: nature of the breach; personal data possibly involved; measures taken to address the breach; measures taken to reduce the harm or negative consequences of the breach; representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and any assistance to be provided to the affected data subjects. Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay. D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. ↩