NPC Issuance Wiki

NPC BN 18-152: In re: Lazada E-Services Philippines, Inc.

Issued Order

Order Text

IN RE: LAZADA E-SERVICES PHILIPPINES, INC. NPC BN 18-152

x----------------------------------------------------x

ORDER

Before the Commission is the Compliance of Lazada E-Services Philippines, Inc. (Lazada) dated 25 February 2022 in accordance with the Order dated 03 February 2022.

E-Konflux Solutions, Inc. (E-Konflux), a member of the Lazada Group of Companies, provides outsourced customer care services, such as outsourced call center operations, to several Lazada Group companies in Southeast Asia, including Lazada E-Services Philippines, Inc.1

On 07 August 2018, during the conduct of internal checks, E-Konflux discovered that a former employee, JB (JB), sent an email on 30 May 2018 (first email), from his E-Konflux work email address to both his personal email address and an email address with his current employer, Shopee.2

The e-mail was sent one day before his last working day with E-Konflux and transmitted a file (CS Response Compilation) that contained a compilation of past customer service response logs.3

For this reason, the names and e-mail addresses of Lazada’s customers were laid out as the logs were not anonymized.4 One log in the CS Response Compilation set out a Lazada customer’s first name and bank account number, and one log set out a different Lazada customer’s first name and physical shipping address.5

Lazada alleged that from their preliminary internal checks, it does not seem that any other bank account, payment card details, or physical shipping addresses were disclosed.6

Additionally, E-Konflux discovered that JB also sent an e-mail from his personal e-mail address to his work email address on 17 October 2017 (second email), transmitting various customer service response logs in which the names and e-mail addresses of Lazada customers were set out, as well as the CS Response Compilation.7

Around one thousand two hundred (1,200) unique customer e-mail addresses were set out in the customer service response logs attached to the two e-mails.8 These logs are a database of email responses and template response scripts that were accumulated during the employee’s time with the company.9

The scripts include an “information combination” depending on the issues raised by the customers, such as name and email address, name and physical address, or name and bank account number.10

On 10 August 2018, Lazada notified the Commission regarding the incident for a possible data breach.11 In addition, it also enumerated the initial remediation steps it took to address the situation, namely:

  1. Our team has made a police report against JB, and is studying other available legal remedies, including filing a formal case against JB;
  2. At Lazada’s instruction, E-Konflux is initiating audit and manual screenings of all customer service agent workstations in E-Konflux, and requiring that all customer service response logs be anonymized; and
  3. At Lazada’s instruction, E-Konflux will also explore if it is possible to “re-configure” all workstations of customer service agents servicing Lazada, with the result that they will not be able to send e-mails to non-Lazada e-mail addresses.12

On 05 November 2020, the Commission, through its Complaints and Investigation Division (CID), ordered Lazada to submit a Full Report expounding the details of the incident with emphasis on the lacking information from the initial notification report received and attaching the specified documents therein.13

As of 03 February 2022, Lazada has yet to comply with the Order to submit a Full Breach Report. Hence, the Commission issued an Order with the following dispositive portion:

WHEREFORE, premises considered, LAZADA E-SERVICES PHILIPPINES, INC. is hereby ORDERED:

  1. TO SHOW CAUSE why it should not be held in contempt, subject to appropriate proceedings, for its failure to abide by the Commission’s Order to submit a Full Breach Report dated 05 NOVEMBER 2020;

  2. TO SUBMIT A FULL BREACH REPORT containing the proper information and annexes pursuant to the aforementioned Order.

LAZADA E-SERVICES PHILIPPINES, INC. is hereby given a period of fifteen (15) days from receipt hereof to submit its compliance through email at complaints@privacy.gov.ph.

SO ORDERED.14

On 25 February 2022, Lazada sent its Final Breach Report stating that there is no sensitive personal information compromised by the subject incident.15 Also, it reiterated the remedial measures taken to minimize the harm and to address the breach, attaching therein the Police Report it filed against JB.16

In addition, Lazada submitted its response to the Show Cause Order, explaining that at the time the 10 August 2018 Notification was sent to the Commission, JF (JF) was then the acting Data Protection Officer (DPO) of Lazada PH.17

However, Lazada expounded that before the issuance of the 05 November 2020 Order, Lazada PH had already registered CC with the Commission as its official or replacement DPO because of JF’s resignation.18

Accordingly, the Commission finds that Lazada must notify the affected data subjects due to the considerable number involved, submit proof of such notification and proof of the measures it allegedly took in order to address the incident.

Section 18 (A) of NPC Circular No. 16-03 provides:

SECTION 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

A. When should notification be done. The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred.

The notification may be made on the basis of available information within the 72-hour period if the personal data breach is likely to give rise to a real risk to the rights and freedoms of data subjects. It shall be undertaken in a manner that would allow data subjects to take the necessary precautions or other measures to protect themselves against the possible effects of the breach. It may be supplemented with additional information at a later stage on the basis of further investigation.19

In this case, Lazada has yet to notify the affected data subjects because of its belief that the only purpose of JB in sending the logs to himself is to help him in performing his job as a customer service agent, and no unauthorized processing of any personal information transpired.20

Based on E-Konflux’s initial investigation, the inclusion of customers’ names and addresses appears to be merely incidental to the primary purpose as to why JB sent those e-mails and/or stored copies of those files — to secure a database of customer service responses which he can use, particularly in his current employment with Shopee.21

Further, Lazada stated that notwithstanding the lapse of time since the questioned e-mails were released, at present, there are still no reported incidents or complaints from any of its customers whose names and/or addresses were included.22

It is therefore Lazada’s assessment that aside from the fact that only the name and email address of the customers were primarily involved in the incident, no subsequent processing of the information in violation of the customers’ privacy rights occurred.23

In addition, Section 13 (B) of the same Circular provides:

SECTION 13. Determination of the Need to Notify. Where there is uncertainty as to the need for notification, the personal information controller shall take into account, as a primary consideration, the likelihood of harm or negative consequences on the affected data subjects, and how notification, particularly of the data subjects, could reduce the risks arising from the personal data breach reasonably believed to have occurred. The personal information controller shall also consider if the personal data reasonably believed to have been compromised involves:

A. Information that would likely affect national security, public safety, public order, or public health; B. At least one hundred (100) individuals; C. Information required by applicable laws or rules to be confidential; or D. Personal data of vulnerable groups.24

In Lazada’s Breach Notification Report, it stated that the data subject of the incident involved the names and addresses of around one thousand two hundred (1,200) Lazada customers which were embedded within the response scripts used by JB.25

On this note, the Commission reiterates the importance of the obligation of Personal Information Controllers (PICs) in notifying the affected data subjects in cases of breach that falls under the instances mentioned by law.26

In a number of cases, the Commission emphasized the importance of ensuring that affected data subjects receive timely notification, viz:

It is noteworthy that the avowed purpose of the required notification to data subjects of a breach incident is for them to take the necessary precautions or other measures to protect themselves against possible effects of the breach. Moreover, personal information controllers (PICs) are required to establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach. It therefore follows that PICs should guarantee that the notification they sent to data subjects has been received. Otherwise, it defeats the very purpose of notification of data subjects.27

Notification to the affected data subjects is fundamental in order to allow them to take the necessary precautions or other measures to protect themselves against the possible effects of the breach, especially given that the incident involved herein consists of more than one hundred (100) individuals.28

WHEREFORE, premises considered, the Commission hereby ORDERS Lazada E-Services Philippines, Inc. to notify the affected data subjects and to submit the proof of notification and the measures it reportedly took regarding the breach directly to the Compliance and Monitoring Division (CMD).

SO ORDERED.

City of Pasay, Philippines. 02 August 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

(On official leave) NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

BJ Data Protection Officer Lazada E-Services Philippines, Inc.

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Lazada E-Services Philippines, Inc. Notification/Advisory on Possible Data Breach, 10 August 2018, at 1, in In re: Lazada E-Services Philippines, Inc., NPC BN 18-152 (NPC 2018). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Lazada E-Services Philippines, Inc. Notification/Advisory on Possible Data Breach, 10 August 2018, at 1, in In re: Lazada E-Services Philippines, Inc., NPC BN 18-152 (NPC 2018). ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. Final Breach Notification Evaluation Report, 29 November 2022, in In re: Lazada E-Services Philippines, Inc., NPC BN 18-152 (NPC 2018). ↩

  10. Id. ↩

  11. Lazada E-Services Philippines, Inc. Notification/Advisory on Possible Data Breach, 10 August 2018, in In re: Lazada E-Services Philippines, Inc., NPC BN 18-152 (NPC 2018). ↩

  12. Id. ↩

  13. Order to Submit Full Report, 05 November 2020, in In re: Lazada E-Services Philippines, Inc., NPC BN 18-152 (NPC 2018). ↩

  14. Order for Compliance, 03 February 2022, in In re: Lazada E-Services Philippines, Inc., NPC BN 18-152 (NPC 2018). ↩

  15. Final Breach Report, 25 February 2022, at 3, in In re: Lazada E-Services Philippines, Inc., NPC BN 18-152 (NPC 2018). ↩

  16. Id. ↩

  17. Response to Show Cause Order, 25 February 2022, at 1, in In re: Lazada E-Services Philippines, Inc., NPC BN 18-152 (NPC 2018). ↩

  18. Id. ↩

  19. National Privacy Commission, Personal Data Breach Management, Circular No. 3, Series of 2016 [NPC Circ. No. 16-03], § 18 (15 December 2016). ↩

  20. Final Breach Report, 25 February 2022, at 3, in In re: Lazada E-Services Philippines, Inc., NPC BN 18-152 (NPC 2018). ↩

  21. Lazada E-Services Philippines, Inc. Notification/Advisory on Possible Data Breach, 10 August 2018, at 1, in In re: Lazada E-Services Philippines, Inc., NPC BN 18-152 (NPC 2018). ↩

  22. Id. ↩

  23. Final Breach Report, 25 February 2022, at 3, in In re: Lazada E-Services Philippines, Inc., NPC BN 18-152 (NPC 2018). ↩

  24. National Privacy Commission, Personal Data Breach Management, Circular No. 3, Series of 2016 [NPC Circ. No. 16-03], § 13 (15 December 2016). ↩

  25. Lazada E-Services Philippines, Inc. Notification/Advisory on Possible Data Breach, 10 August 2018, at 2, in In re: Lazada E-Services Philippines, Inc., NPC BN 18-152 (NPC 2018). ↩

  26. In re: Crosta Crociere S.p.A., NPC BN 21-185, Resolution dated 23 September 2021, at p. 6. ↩

  27. In re: Health Delivery System, Inc., NPC BN 20-049, Resolution dated 01 July 2021, at p. 5. ↩

  28. National Privacy Commission, Personal Data Breach Management, Circular No. 3, Series of 2016 [NPC Circ. No. 16-03], § 13 (15 December 2016). ↩

Backlinks

  • No backlinks found