Order Text
IN RE: BPI PHILAM LIFE ASSURANCE CORPORATION NPC BN 21-054
x----------------------------------------------------x
ORDER
AGUIRRE, D.P.C.:
This Order refers to a breach notification submitted by BPI Philam Life Assurance Corporation (BPLAC) dated 26 March 2021 and its Update Report dated 09 April 2021. The breach notification refers to an alleged data breach and suspicious activity involving its third-party call center and includes a request for extension of five (5) days to submit a full breach report and to notify the affected data subjects. The update report contains a request for an extension of additional five (5) days from the originally requested period.
Facts
On 27 March 2021, the Commission received a letter from BPLAC with the subject: “Alleged Data Breach and Suspicious Activity Involving (Its) Third Party Call Center.” In its letter, BPLAC narrated that:
On Feb. 16, 2021, a file containing 61,000 names of Citi credit cardholders together with their ages and contact numbers were uploaded by CFSI into the system of the 3rd party call center, Shore Solutions, Inc. to be used for the telemarketing campaign of BPLAC called Non-Credit Insurance Campaign. In this batch of upload, there were names of Citibank employees seeded as part of their testing activity.
On March 23, 2021, suspicion of a fraudulent activity was discovered. The employees whose names were seeded in the file received calls offering credit card services which is not part of the BPLAC official campaign. The method of the call was like a social engineering scheme whereby the conversation is being conducted in a fast-paced manner that an ordinary customer will not have a chance to ask questions and feel pressured to agree to the purchase. The details of the credit card will then be secured from the customers including the card no., expiry date and the CVV.
The activity is described as account take over.
A forensic investigation is currently ongoing to determine the extent of these activities and how many customers might have already been victimized. The investigation also aims to find out if these actions are perpetrated by the agents of the call center or it could be that the system of the call center was hacked. Our vendor, third party call center Shore Solutions, is not aware of any cyber security breach at this time.1
BPLAC stated that it has undertaken measures to address the breach and was conducting a forensic investigation to find out the root cause of the breach and to determine who and how many customers were affected so that it can appropriately notify them.2 In line with this, BPLAC requested for a five (5) day extension on the seventy two (72)-hour deadline for mandatory reporting, thus:
We also write to respectfully request for extension on the 72 hour deadline of mandatory reporting. As provided under NPC Advisory 2018-02 dated June 26, 2018, we shall provide full report within 5 days, or as soon as possible, as the result of the investigation becomes available.3
On 09 April 2021, BPLAC submitted an Update Report which stated that it is making good progress in its investigation but still needed more time to complete it. Further, it stated that based on the preliminary findings, there were no signs that would indicate any cyber-attack. Lastly, it requested for an additional five (5) working days to release the customer notification letters and to submit its full breach report:
To date, we are making good progress in our investigation but we need more time to complete this thoroughly. Material pieces of evidence have been gathered that will help us determine if there was indeed a data breach that happened, and if there was, what was the cause of said breach, the extent of damage, and who were the customers affected. Based on preliminary findings, there were no signs that would indicate any cyber attack.
We are in close coordination with the third party service provider and with our business partner, Citi Financial Services Inc. (CFSI), as this investigation progresses.
As such, we would request your office to grant us an additional 5 working days for us to release customer notification letters and submission of the full breach report.
Discussion
The Commission denies the requests for extension and orders BPLAC to submit its full breach report and proof of notification within seventy-two (72) hours from receipt of this Order. The Commission further orders BPLAC to show cause as to why it should not be held liable for failure to submit its full breach report and to notify the affected data subjects within the prescribed period.
At the outset, it should be emphasized that notification of data subjects of a personal data breach is the general rule and exemptions are allowed only under specific circumstances. Section 18(A) of NPC Circular No. 16-03, provides the rule:
The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred. The notification may be made on the basis of available information within the 72-hour period if the personal data breach is likely to give rise to a real risk to the rights and freedoms of data subjects. It shall be undertaken in a manner that would allow data subjects to take the necessary precautions or other measures to protect themselves against the possible effects of the breach. It may be supplemented with additional information at a later stage on the basis of further investigation.4
The purpose of the requirement to notify data subjects of a breach incident is to give them the opportunity to take the necessary precautions or such other measures to protect themselves against possible effects of the breach. Personal information controllers (PICs) are likewise required to establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach.5 A delay in notification can cause harm to affected data subjects as they cannot protect themselves from the consequences of the breach.
The Commission notes that BPLAC, in its initial report, requested for an extension of five (5) days or until 01 April 2021 to comply with the mandatory requirements under NPC Circular No. 16-03 to notify the data subjects and provide the Commission with its full breach report.
Despite the fact that this extended period already ended on 01 April 2021, BPLAC neither provided proof that it notified its data subjects nor did it submit its full breach report. Instead, it submitted an Update Report on 09 April 2021 requesting for an additional extension of five (5) days without sufficient explanation as to why it failed to comply with its commitments within the period it originally requested.
Until now, no submissions have been made by BPLAC despite the lapse of the additional five (5) days it requested on 09 April 2021. Time and again, the Commission has reiterated that PICs need not wait for the Commission to grant their request for extension of time before they comply.
Since BPLAC requested for a specific period to comply with the mandatory reporting requirements, it should have complied with the requirements within that requested period. At the very least, BPLAC should have submitted its request for further extension within the period they originally requested.
Given that both periods requested for has already lapsed, the Commission denies the request for extension. BPLAC should have already complied with the mandatory requirements of notifying its data subjects and submitting the full breach report. Further, BPLAC should explain its unreasonable delay in complying with these obligations.
WHEREFORE, premises considered, the Commission hereby ORDERS BPI Philam Life Assurance Corporation to comply with the following within seventy-two (72) hours from receipt of this Order:
- SUBMIT its full breach report with the contents required under NPC Circular 16-03;
- NOTIFY the affected data subjects and SUBMIT proof of notification that ensures all data subjects were made aware of the breach; and
- SHOW CAUSE in writing why it should not be held in liable for failure to submit a full breach report and notify the affected data subjects within the required period and be subject to contempt proceedings as permitted by law, before the appropriate court, and such other action as may be available to the Commission.
SO ORDERED.
City of Pasay, Philippines. 15 April 2021.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
ILF Data Protection Officer BPI Philam Life Assurance Corporation
COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT