Order Text
RPR,
Complainant,
-versus- NPC 19-438
EDUKASYON.PH,
Respondent.
x----------------------------------------------------x
ORDER
Before this Commission is a Complaint filed by RPR against Edukasyon.ph for an alleged violation of the Data Privacy Act of 2012 (DPA).
On 08 June 2018, RPR filed a Complaint against Edukasyon.ph.1 RPR stated that he participated in the Amazon Web Services (AWS) Builders Online Series Siklab Pilipinas 2019, an online conference co-organized by Edukasyon.ph and AWS Philippines.2
In the Complaint, RPR alleged that Edukasyon.ph sent by email a thank you letter to all participants of the online conference and included a link to the certificates of completion.3 He claimed that Edukasyon.ph entered all the email addresses of the participants in the “To:” field, and allowed all recipients of the email to access a zip file containing all participants’ certificates of completion.4 The names of the participants were apparent in the file names of the certificates of completion and on the certificates themselves.5 As a result, the names and email address of one hundred and three (103) participants were exposed to unauthorized third parties.6
RPR claimed that Edukasyon.ph’s unauthorized disclosure of his personal information caused him emotional stress and sleepless nights.7
He prays that the Commission impose a fine and a cease and desist order for Edukasyon.ph to stop disclosing the participants’ names and email addresses to unauthorized parties.8
On 12 September 2019, the Commission issued an Order to confer for discovery on 02 October 2019.9
On 02 October 2019, the parties conferred for discovery.10 The Commission issued an Order directing Edukasyon.ph to file its responsive comment within ten (10) days from the discovery conference or until 12 October 2019, and RPR to file his reply within ten (10) days from receipt of Edukasyon.ph’s responsive comment.11
On 12 October 2019, Edukasyon.ph responded to the Complaint.12 Edukasyon.ph maintains that the disclosed personal information is limited to RPR’s name and email address and such personal information is “not of a particularly sensitive nature.”13 It further alleged that the online conference encouraged socializing and networking with other participants and the zip file containing the certificates “served the same purpose as university entrance exam passer website, or board exam passer announcements, where all full names of participants in the classroom setting are published online to the public.”14 It also informed RPR that it shall delete the link to the certificates of participation to address his concern and to protect the participants’ personal information.15
On 21 October 2019, RPR emailed his reply to Edukasyon.ph’s responsive comment.16 He explained that he never consented to the disclosure of his private email address to other participants of the online conference.17 He reiterated that Edukasyon.ph, without his consent, sent the email containing access to the certificates, and consequently the names and email addresses, to all the participants of the online conference.18
Discussion
The Commission directs Edukasyon.ph to notify the participants of the online conference since their names and email addresses were exposed to the other participants as a result of the thank you letter that Edukasyon.ph sent by email.
A Personal Information Controller (PIC), such as Edukasyon.ph, should implement reasonable and appropriate organizational, physical, and technical measures to protect the personal information of its data subjects.19 Section 20 (a) of the DPA provides:
Section 20. Security of Personal Information. – (a) The personal information controller must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.
…
(c) The determination of the appropriate level of security under this section must take into account the nature of the personal information to be protected, the risks represented by the processing, the size of the organization and complexity of its operations, current data privacy best practices and the cost of security implementation. Subject to guidelines as the Commission may issue from time to time, the measures implemented must include: (1) Safeguards to protect its computer network against accidental, unlawful or unauthorized usage or interference with or hindering of their functioning or availability; (2) A security policy with respect to the processing of personal information[.]20
Section 25 of the Implementing Rules and Regulations elaborates on the PIC’s obligation to implement these measures:
Section 25. Data Privacy and Security. Personal information controllers and personal information processors shall implement reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data.
The personal information controller and personal information processor shall take steps to ensure that any natural person acting under their authority and who has access to personal data, does not process them except upon their instructions, or as required by law.
The security measures shall aim to maintain the availability, integrity, and confidentiality of personal data and are intended for the protection of personal data against any accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing. These measures shall be implemented to protect personal data against natural dangers such as accidental loss or destruction, and human dangers such as unlawful access, fraudulent misuse, unlawful destruction, alteration and contamination.21
As such, it is incumbent upon Edukasyon.ph to implement these security measures in a Security Incident Management Policy to protect the personal data of its data subjects.
Given the Complaint that RPR filed before the Commission, the other participants of the online conference may have similar concerns concerning their respective personal information. Even if the names and email addresses were exposed to the participants of the same online conference, prudence dictates that Edukasyon.ph should still notify its data subjects.
Edukasyon.ph should ensure that the notification to its affected data subjects complies with the requirements under Section 18 (C) of NPC Circular No. 16-03 (Personal Data Breach Management):
Section 18. Notification of Data Subjects.
…
C. Content of Notification. The notification shall include, but not be limited to:
- nature of the breach;
- personal data possibly involved;
- measures taken to address the breach;
- measures taken to reduce the harm or negative consequences of the breach;
- representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
- any assistance to be provided to the affected data subjects.
Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.22
WHEREFORE, premises considered, the Commission ORDERS Edukasyon.ph to submit its Security Incident Management Policy and to notify its affected data subjects of the breach and submit proof of notification thereof to the Commission within a non-extendible period of thirty (30) days from its receipt of the Order.
SO ORDERED.
Pasay City, Philippines. 03 February 2022.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
I CONCUR:
JOHN HENRY D. NAGA Privacy Commissioner
Copy furnished:
RPR Complainant
EDUKASYON.PH Respondent
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
Complaint-Assisted Form, 08 June 2018, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2018) (pending). ↩
-
Id. at 3. ↩
-
Id. ↩
-
Id. at 5. ↩
-
Id. ↩
-
Id. ↩
-
Complaints-Assisted Form, 08 June 2018, at 6, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2018) (pending). ↩
-
Id. at 6-7. ↩
-
Order to Confer for Discovery, 12 September 2019, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2018) (pending). ↩
-
Order, 02 October 2019, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2018) (pending). ↩
-
Id. ↩
-
Response to the Complaint (CID Case No. 19-F-438), 10 October 2019, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2018) (pending). ↩
-
Id. at 1. ↩
-
Id. ↩
-
Id. ↩
-
Email Reply dated 21 October 2019 of RPR, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2018) (pending). ↩
-
Id. ↩
-
National Privacy Commission, Personal Data Breach Management, Circular No. 03, Series of 2016 [NPC Circ. No. 16-03], § 18 (C) (15 December 2016). ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 20 (2012). ↩
-
Id. ↩
-
National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule VI, § 25 (2016). ↩
-
NPC Circ. No. 16-03, § 18 (C). ↩