NPC Issuance Wiki

NPC BN 20-124: In re: E-Science Corporation

Issued Order

Order Text

IN RE: E-SCIENCE CORPORATION NPC BN 20-124

x----------------------------------------------------x

ORDER

AGUIRRE, D.P.C.:

This Resolution refers to the Full Breach Report submitted by E-Science Corporation (“E-Science”) dated 18 August 2020 involving a data breach incident affecting approximately four thousand (4,000) test records of data subjects.1

The Facts

On 6 August 2020, this Commission issued a Resolution2 with the following disposition:

WHEREFORE, premises considered, E-Science Corporation is ORDERED to 1) SUBMIT with dispatch a Full Report of the Personal Data Breach as required under Section 17(C) of NPC Circular No. 16-03; and 2) SHOW CAUSE in writing why it should not be liable for failure to submit a Full Report within the required period and be subject to contempt proceedings, as permitted by law, before the appropriate court, and such other actions as may be available to the Commission.

Furthermore, the Commission GRANTS the request for Postponement of Notification to Data Subjects of E-Science Corporation and directs them to submit proof of compliance thereof within fifteen (15) days from submission of their Full Breach Report. Pending their verification of the full list of affected data subjects, E-Science Corporation is enjoined to use alternative means of notification under Section 18(d) of NPC Circular No. 16-03.

On 18 August 2020, E-Science submitted a Full Breach Report3 where it reiterated the contents of its Initial Report dated 2 July 2020.4 The Commission notes that in its Initial Report, E-Science stated that it is still currently doing further investigations and it has still not sent notifications to the affected data subjects so that it can prevent sending the same to unaffected individuals.5 This was also indicated in the Full Breach Report it submitted.6

Moreover, a perusal of the written submissions made by E-Science reveals that it has not addressed the Show Cause Order issued by this Commission in the same Resolution.7

Discussion

This Commission hereby reiterates its Order against E-Science to Show Cause in writing why it should not be held liable for failure to submit a Full Breach Report within the required period and be subject to contempt proceedings, as permitted by law, before the appropriate court, and such other actions as may be available to the Commission.

Section 17(C) of NPC Circular 16-03 provides that:

There shall be no delay in the notification if the breach involves at least one hundred (100) data subjects, or the disclosure of sensitive personal information will harm or adversely affect the data subject. In both instances, the Commission shall be notified within the 72-hour period based on available information. The full report of the personal data breach must be submitted within five (5) days, unless the personal information controller is granted additional time by the Commission to comply.8

In this case, E-Science has submitted its Initial Report on 2 July 2020.9 Thus, it should have submitted its Full Breach Report five (5) days therefrom especially since E-Science did not request for and no additional time was granted by this Commission for the submission of such report. While it has requested for the postponement of notification to the affected data subjects on 3 July 2020,10 which this Commission granted in the said Resolution,11 the submission of a Full Breach Report is a different requirement that E-Science should have complied with accordingly. Being provided under separate sections, E-Science should have known that the Notification of the Commission and Notification of Data Subjects are two (2) different and separate requirements under Sections 17(C) and 18(A) of NPC Circular No. 16-03, respectively, that personal information controllers should promptly comply.

WHEREFORE, premises considered, this Commission reiterates its ORDER against E-Science Corporation to SHOW CAUSE in writing within five (5) days from receipt of this Resolution why it should not be held liable for its failure to submit a Full Breach Report within the required period and be subject to contempt proceedings, as permitted by law, before the appropriate court, and such other actions as may be available to the Commission.

The Full Breach Report dated 18 August 2020 submitted by E-Science Corporation is hereby NOTED, subject to the recommendations of the Compliance and Monitoring Division and further action of this Commission.

SO ORDERED.

Pasay City, Philippines; 27 August 2020.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

JOHN HENRY D. NAGA Deputy Privacy Commissioner

Copy furnished:

JYP Data Protection Officer E-Science Corporation

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Full Breach Report dated 18 August 2020. ↩

  2. Resolution dated 6 August 2020, In re: E-Science Corporation, NPC BN 20-124. ↩

  3. Supra note 1. ↩

  4. Initial Data Breach Report dated 2 July 2020. ↩

  5. Ibid., at page 3. ↩

  6. Full Breach Report dated 18 August 2020 at p. 4. ↩

  7. Supra note 2. ↩

  8. Emphasis supplied. ↩

  9. Supra note 4. ↩

  10. E-mail dated 3 July 2020 submitted by the Data Protection Officer of E-Science. ↩

  11. Supra note 2. ↩

Backlinks

  • No backlinks found