NPC Issuance Wiki

NPC BN 17-010: In re: Movie and Television Review and Classification Board

Issued Order

Order Text

IN RE: MOVIE AND TELEVISION REVIEW AND CLASSIFICATION BOARD NPC BN 17-010

x----------------------------------------------------x

ORDER

Before the Commission is a request filed by the Movie and Television Review and Classification Board (MTRCB) for additional time to comply with the Commission’s directives and for permission to notify its remaining data subjects through alternative means.

MTRCB submitted its Compliance to the Order dated 15 April 2021 with Motion for Extension of Time to Comply with Directives and for Permission for Other Modes of Public Notification dated 14 February 2022 (Compliance and Motion).

To recall, the Commission issued an Order dated 15 April 2021 directing MTRCB to do the following:

WHEREFORE, premises considered, the Commission ORDERS the Movie and Television Review and Classification Board to comply with the following:

(1) NOTIFY the data subjects affected by the breach incident within fifteen (15) days from receipt of this Order;

(2) SUBMIT proof of notification that ensures all data subjects were made aware of the breach, within fifteen (15) days from receipt of this Order; and

(3) SUBMIT the results of the independent security audit within three (3) months from receipt of this Order.

SO ORDERED.1

MTRCB received the Order on 06 May 2021 and, on 12 May 2021, proceeded to post a Notice of Data Breach on its website (www.mtrcb.gov.ph).[^2] Thereafter, MTRCB, in a Letter dated 18 May 2021, informed the Commission that it has notified its data subjects by posting a notice of data breach on its website.2 It stated that “[it is] aware of the requirements of NPC Circular 16-03 regarding the sending of an individual notification to affected data subjects. However, [it finds] the individual notification an arduous task[.]”3 The Commission, through a Compliance Letter from its Enforcement Division (EnD) dated 15 October 2021, directed MTRCB to strictly comply with the 15 April 2021 Order by individually notifying the affected parties:

In your letter, you informed the Commission that you have posted a notice of a data breach on your website on May 12, 2021. However, this could not be considered as a valid form of notification absent prior approval of the NPC.

The Enforcement Division (EnD) reiterates that individual notification is the general rule. The Commission has repeatedly ordered MTRCB to individually notify the data subjects despite its prior request for alternative means of notification. Moreover, we would like to take this opportunity to remind you that it is the Personal Information Controller’s (PIC) responsibility to ensure that all data subjects are made aware of the breach.4

In a letter dated 02 November 2021, MTRCB informed the Commission that:

[T]he affected data subjects were already notified via electronic mail from 25-29 October 2021. The total data subjects affected as reported to NPC is five hundred seventy-three (573). This is composed of two hundred seventy-four (274) individuals (Annex A) and two hundred ninety-nine (299) companies (Annex B). From the 274 affected individuals, the breakdown below shows the number of individuals notified, deceased and those not notified due to the unavailability of contact records from the Information Technology Unit, Human Resources Management Unit and Property and Supply Unit, to wit:

  • Emailed: 180 individuals
  • Deceased: 17 individuals
  • No Record: 77 individuals5

The EnD, through a Compliance Letter dated 28 January 2022, responded by requesting MTRCB to submit proof that it sent the notifications and proof that the affected data subjects it notified received the breach notification.6 As for the deceased data subjects, the EnD requested that MTRCB notify the deceased data subject’s next of kin if it can be ascertained from MTRCB’s company records.7 After which, the EnD clarified that:

If MTRCB, even after diligent search, still renders it unable to determine the contact of a deceased data subject’s kin, it may seek approval of the Commission to use alternative means of communication in accordance with Section 18(D) of NPC Circular 16-03.

As it appears that 77 individuals were not notified due to the unavailability of contact records, MTRCB may likewise seek approval of the Commission to use alternative means of communication under Section 18(D) of NPC Circular 16-03.

We note that MTRCB has earlier posted a public notification of the breach through its website. However, individual notification of data subjects remains to be the general rule. Hence, prior approval of the Commission is required.8

Thus, MTRCB served and individually notified the affected parties through email.9 By collating email addresses from its records, MTRCB was able to notify one hundred seventy-seven (177) out of two hundred seventy-four (274) affected individuals.10 The remaining ninety-seven (97) affected individuals that were not notified are broken down as follows: seventy-eight (78) could not be served because MTRCB has no record of their email addresses and nineteen (19) were determined to be deceased.11 As for the successfully served data subjects, one hundred two (102) out of the one hundred seventy-seven (177) successfully served individuals have acknowledged receipt of the notification.12 Out of the nineteen (19) deceased individuals, MTRCB found the contact information for the next of kin of one (1) data subject who was served the notice and acknowledged the same.13

MTRCB claimed that it exerted diligent efforts to locate the data subjects, however, the contact details of the remaining unnotified data subjects are not available in its existing records.14 Therefore, it “prayed for the allowance of other modes of public notification by allowing the posting of the Notice in its website.”15

As to the conduct of an independent security audit, MTRCB submitted its Contract for the Conduct of Vulnerability Assessment and Penetration Testing of MIDAS with Next Generation Global Inc.16 MTRCB explained, however, that “the testing has not been completed due to administrative and budgetary constraints.”17 It prayed for an extension until 31 July 2022, the expected end of contract, to comply with the directive of submitting an independent security audit.18

Discussion

The Commission grants MTRCB’s request for alternative means of notification of the remaining unnotified data subjects and denies the request for extension of the submission of an independent security audit.

Data subject notification is an essential obligation of a Personal Information Controller (PIC).19 PICs are required to “establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach.”20 Section 18 (D) of NPC Circular 16-03 (Personal Data Breach Management) provides that a PIC may seek the Commission’s approval to use alternative means of notification in lieu of individual notification in certain cases:

Section 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

…

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data.

The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.21

In this case, the Affidavit of JAT, the designated Unit Head of MTRCB’s Information Technology Unit in charge of information technology infrastructure and information systems, attested that:

[F]rom 25 to 29 October 2021, I cause[d] the service of a copy of the Notice of Data Breach, to the affected parties, via electronic mail through the email address [ ], of the 274 individuals affected by the data breach, we were able to serve the Notice of Data Breach to 177 affected individuals, whose email addresses we were able to collate from the records of the MTRCB[.]

…

From the 177 individuals […] who were successfully served with a copy of the Notice of Data Breach, 102 have acknowledged receipt of the Notice. Their email responses to the said Notice, are hereto attached as ANNEX “A-1” to “A-102[.]”22

The Commission considers MTRCB to have sufficiently individually notified the one hundred seventy-seven (177) affected individuals that were notified by email.

Out of one hundred seventy-seven (177) individuals, only one hundred three (103) data subjects acknowledged the individual notification by email.23 The remaining seventy-four (74) data subjects, however, are still considered to have been sufficiently notified despite their lack of reply. The Circular on Personal Data Breach Management only mandates that the data subject be sufficiently informed and notified.24 Data subjects cannot be forced to respond to the notification, provided that proper notification is done. The obligation of the PIC to notify affected data subjects is fulfilled regardless of the data subject’s response to the notification. What is important is that the email notification was sent and the data subject has access to the information contained in the notification should he or she need it.

As for the remaining ninety-seven (97) data subjects, MTRCB explained that:

Of the 97 that MTRCB was [unable] to serve the Notice, MTRCB ascertained that 78 of these could not be served because of the absence of email address records, and 19 of which have been determined to be deceased through the diligent search of records from the records of the Board Secretary, Human Resources Unit, and the Property and Supply Unit of the MTRCB[.]25

To support this, JAT’s Affidavit stated that:

From the 19 parties who were determined to be deceased, we found contact information for the next of kin of one party, who were similarly sent the Notice of Data Breach to and acknowledged the same. The Acknowledgment of the said next of kin is hereto attached as ANNEX “B”[.]26

The Commission acknowledges the diligent efforts exerted by MTRCB by attempting to locate the parties and going through its Board Secretary, Human Resources Unit, and Property and Supply Unit records. Given, however, that it does not have the contact information of the remaining affected data subjects and the next of kin of deceased data subjects, the Commission notes that individual notification to the remaining unnotified ninety-seven (97) data subjects is impossible. As such, the Commission grants the MTRCB’s request for alternative means of notification for the remaining data subjects who have not been individually notified due to the unavailability of contact information despite its exhaustive efforts to locate them.

As for the security audit, the Commission in a Compliance Letter dated 23 June 2022 informed the MTRCB that:

As to the conduct of security audit, we find that there is considerable amount of delay in MTRCB’s responsive action to prevent the likelihood of another breach from occurring since the breach incident occurred in September 2017.

…

In view of the foregoing, you are hereby required to:

…

(2) SUBMIT a written explanation for the cause of delay of conducting the security audit with supporting documentary evidence within ten (10) days from receipt of this letter; (3) SUBMIT a report on the results of the security audit within thirty (30) days from receipt of this letter.27

In its Compliance dated 14 February 2022, it stated that it is requesting for an “extension of until 31 July 2022, the expected end of contract, to comply with the directive to comply with the submission of the independent security audit.”28 In its prayer in the same Compliance, however, it requested that it be “granted an additional three (3) months of time to allow NEXT GENERATION to finish the independent security audit.”29 The Commission notes, however, that three (3) months from the date of the pleading is 14 May 2022, which is earlier than the requested date of extension in the body of the pleading.

Following the request made by MTRCB in its prayer, it should have submitted the independent security audit last 14 May 2022. To date, MTRCB has not complied with the directive of the Commission to submit the results of its independent security audit. The Commission emphasizes that PICs should comply with obligations they themselves undertake. It was MTRCB that specified the date for extension, but it itself has not complied with its own deadline. Therefore, regardless of the actual date of extension requested, the request for extension of MTRCB is denied.

WHEREFORE, premises considered, Movie and Television Review and Classification Board is hereby ORDERED within fifteen (15) days from the receipt of this Order to comply with the following:

  1. NOTIFY and SUBMIT to the Commission proof that it implemented notification through alternative means together with the text of the notification; and

  2. SUBMIT a report on the results of the independent security audit.

SO ORDERED.

City of Pasay, Philippines. 14 July 2022.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

DUG CHRISTOPER B. MAH Deputy Privacy Commissioner

Copy furnished:

ATTY. ALN Officer-in-Charge Office of the Executive Director Movie and Television Review and Classification Board

ATTY. JSP Data Protection Officer Movie and Television Review and Classification Board

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Order, 15 April 2021, at 7, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2017). ↩

  2. Letter Re: Compliance to National Privacy Commission (NPC) Order No. CID BN 17-010, 18 May 2021, at 1, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2017). ↩

  3. Id. ↩

  4. Enforcement Division Letter Re: Compliance to National Privacy Commission (NPC) Order No. CID BN 17-010 dated 15 April 2021, 15 October 2021, at 1, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2017). ↩

  5. Compliance to National Privacy Commission (NPC) Order No. CID BN 17-010 dated 15 April 2021, 02 November 2021, at 1, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2017). ↩

  6. Compliance with National Privacy Commission (NPC) Order No. CID BN 17-010 dated 15 April 2021, 28 January 2022, at 1, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2017). ↩

  7. Id. at 2. ↩

  8. Id. ↩

  9. Compliance to the Order dated 15 April 2021 with Motion for Extension of Time to Comply with Directives and for Permission for other Modes of Public Notification, 14 February 2022, at 2, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2017). ↩

  10. Id. ↩

  11. Id. Annex A. ↩

  12. Id. at 2, Annex A-1 to A-102, Annex B within Annex A. ↩

  13. Id. Annex B within Annex A. ↩

  14. Id. at 2. ↩

  15. Compliance to the Order dated 15 April 2021 with Motion for Extension of Time to Comply with Directives and for Permission for other Modes of Public Notification, 14 February 2022, at 2, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2017). ↩

  16. Id. at 2, Annex B. ↩

  17. Id. at 2. ↩

  18. Id. ↩

  19. NPC BN 21-035, 01 June 2021, at 4 (NPC 2021) (unreported). ↩

  20. National Privacy Commission, Personal Data Breach Management, Circular No. 03, Series of 2016 [NPC Circ. No. 16-03], § 18 (D) (15 December 2016). ↩

  21. Id. ↩

  22. Compliance to the Order dated 15 April 2021 with Motion for Extension of Time to Comply with Directives and for Permission for other Modes of Public Notification, 14 February 2022, Annex A, in In re: Movie and Television Review and Classification Board, NPC BN No. 17-010 (NPC 2017). ↩

  23. Id. Annex A-1 to A-102, Annex B within Annex A. ↩

  24. See NPC Circ. No. 16-03, § 18. ↩

  25. Compliance to the Order dated 15 April 2021 with Motion for Extension of Time to Comply with Directives and for Permission for other Modes of Public Notification, 14 February 2022, at 2, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2017). ↩

  26. Id. Annex A. ↩

  27. Enforcement Division Letter Re: Compliance with National Privacy Commission (NPC) Order No. CID BN 17-010 dated 15 April 2021, 23 June 2022, at 2, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2017). ↩

  28. Compliance to the Order dated 15 April 2021 with Motion for Extension of Time to Comply with Directives and for Permission for other Modes of Public Notification, 14 February 2022, at 2, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2017). ↩

  29. Id. at 3. ↩

Backlinks

  • No backlinks found