NPC Issuance Wiki

NPC BN 18-061: In re: Bureau of Research and Standards – Department of Public Works and Highways (DPWH)

Issued Order

Order Text

IN RE: BUREAU OF RESEARCH AND STANDARDS – DEPARTMENT OF PUBLIC WORKS AND HIGHWAYS (DPWH) NPC BN 18-061

x----------------------------------------------------x

ORDER

Before the Commission is the Post-Breach Report dated 18 November 2022 (Post-Breach Report) submitted by the Bureau of Research and Standards – Department of Public Works and Highways (DPWH) in compliance with the Order dated 07 January 2022 (Order) of the Commission, through its Complaints and Investigation Division (CID).1

In its Initial Report, DPWH stated that personal information such as home addresses and phone numbers were published on its website in the updated list of accredited contractors’/consultants’ materials engineers dated 31 October 2017.2 The Initial Report stated that there were one thousand eighty-two (1,082) affected data subjects.3 Further, its Data Protection Office coordinated with its Bureau of Research and Standards to remove/replace the list from the website as an action upon the discovery of the breach.4

To address the breach, DPWH stated that it pursued the following courses of action:

  1. At the date of discovery, the said list was removed from the website. However, the list was still visible from the internet through search engines.
  2. The Department’s Webmaster coordinated with Google to have the list totally removed from the internet and is no longer accessible to anyone.
  3. The Data Protection Office will conduct a thorough search of the DPWH Website and will also recommend additional preventive measures to prevent incidents such as this from happening again.
  4. Data Privacy Awareness campaigns will also be conducted to increase the Departments’ understanding in the importance of Data Privacy.5

Subsequently, the CID issued an Order dated 22 November 2021, with the following dispositive portion:

Pursuant to Section 9, Rule IV of the NPC Circular No. 16-03 on Personal Data Management, you are hereby required to submit a Post-Breach Report detailing following requirements:

  1. Results of the Department’s request with Google to have the list removed from the search engines;

  2. Results of the search conducted by the Data Protection Office, and the measures taken to prevent similar incidents from recurring;

  3. Status update of the Department’s efforts to conduct Data Awareness campaigns; and

  4. Efforts made to inform the affected data subjects about the incident, and proof thereof.

SO ORDERED.6

In Compliance with the Order, DPWH submitted its Post-Breach Report dated 29 November 2021.7 In answering the CID’s directives respectively, DPWH stated that:

  1. Through the coordination of the Data Protection Office, the Department’s Webmaster requested Google to have the list removed from the internet. (Annex A) The said list is not available on the internet as of April 23, 2018. (Annex B)

  2. The Data Protection Office conducted a thorough search of the website immediately after the incident.

    In addition, the DPO also conducted a privacy risk assessment and other manual processes that involve personal data, such as:

    1. Consultancy Services Application (CSA)
    2. Civil Works Application (CWA)
    3. Legal Case Information Application (LCIA)
    4. Civil Works Application (CWA)
    5. Personnel Information System (PIS)
    6. Employee Portal and Engagement Tool (ePortal)
    7. SALN, 201 files and Training Files

  3. To prevent similar incidents from recurring, Data privacy activities were conducted by the Department. Attached is the list of activities from 2018 to 2021. (Annex D)

  4. A letter was sent informing the affected data subjects of the breach, the corrective action, and the preventive measures to secure the personal information of all the data subjects. (Annex E)8

On 07 January 2022, the CID issued an order directing DPWH to request deletion from the platforms in which the data subject of the breach incident is still posted, thus:

Therefore, DPWH is hereby ORDERED to notify and request these platforms to delete and refrain from storing the data which is the subject of the breach.

Further, DPWH is ORDERED to investigate and find similar postings on other platforms, and to notify affected subjects should the exposed list fall under mandatory breach notification.

You are hereby given a period of thirty (30) days from receipt hereof to submit your compliance and report the results of the action taken through email at complaints@privacy.gov.ph.

SO ORDERED.9

Subsequently, DPWH submitted its compliance dated 22 February 2022 to the Order dated 07 January 2022.10 DPWH stated that the Department’s Webmaster has requested removal from the internet, specifically on Yumpu, Studylib, and Scribd, the subject data of the breach incident.11 Further, it stated that it did a thorough search on other platforms, and as a result, it found no similar postings.12

On 18 November 2022, DPWH submitted its Post Breach Report, attaching therein the email it received from Yumpu, Studylib, and Scribd, in response to its request for removal, to wit:

From Yumpu: “We took the document offline and informed the user about the violation of your copyright. If you should find further infringements, please let us know.”13

From Studylib: “We investigated your report and decided to close the access to this document, as well as to delete this document from our service. The user that uploaded this document to our service has received abuse notification.”14

From Scribd: “Thank you for contacting Scribd. This content was removed. It may take several days for Google and other search engines to remove deleted links from their indexes.”15

To properly resolve the breach incident, the Commission directs DPWH to submit proof of notification to the affected data subjects.

NPC Circular No. 16-03 (Personal Data Management) Rule V Sections 18(A) and (D) state that:

SECTION 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

A. When should notification be done. The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred.

The notification may be made on the basis of available information within the 72-hour period if the personal data breach is likely to give rise to a real risk to the rights and freedoms of data subjects. It shall be undertaken in a manner that would allow data subjects to take the necessary precautions or other measures to protect themselves against the possible effects of the breach. It may be supplemented with additional information at a later stage on the basis of further investigation.16

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.17

Based on the submitted compliance of DPWH, it only attached a copy of its letter notifying the affected data subjects. The said letter does not sufficiently prove that the notification was indeed sent to and received by the affected data subjects.

It bears stressing that submission of a letter of notification allegedly sent to the affected data subjects is not tantamount to proof of such notification because as enunciated by the Commission:

It is noteworthy that the avowed purpose of the required notification to data subjects of a breach incident is for them to take the necessary precautions or other measures to protect themselves against possible effects of the breach. Moreover, personal information controllers (PICs) are required to establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach. It therefore follows that PICs should guarantee that the notification they sent to data subjects has been received. Otherwise, it defeats the very purpose of notification of data subjects.18

Unfortunately, DPWH failed to show that they notified the affected data subjects because it only submitted a copy of the letter it purportedly sent to them, thereby defeating the avowed purpose of the notification requirement under NPC Circular 16-03.

Further, in DPWH’s Initial Report, it stated that the personal information involved in the incident includes the home address and phone number of one thousand eighty-two (1,082) data subjects.19 This significant number further emphasizes the need to ensure that they were properly notified.

In this regard, Section 13 of the same Circular provides:

SECTION 13. Determination of the Need to Notify. Where there is uncertainty as to the need for notification, the personal information controller shall take into account, as a primary consideration, the likelihood of harm or negative consequences on the affected data subjects, and how notification, particularly of the data subjects, could reduce the risks arising from the personal data breach reasonably believed to have occurred. The personal information controller shall also consider if the personal data reasonably believed to have been compromised involves:

A. Information that would likely affect national security, public safety, public order, or public health; B. At least one hundred (100) individuals; C. Information required by applicable laws or rules to be confidential; or D. Personal data of vulnerable groups. (emphasis supplied)20

Notification to the affected data subjects is essential in order to allow them to take the necessary precautions or other measures to protect themselves against the possible effects of the breach, especially given that the incident involved herein consists of more than one hundred (100) individuals.

In view of the foregoing, the Commission deems it proper to require DPWH to promptly submit proof that it notified its affected data subjects.

WHEREFORE, premises considered, the BUREAU OF RESEARCH AND STANDARDS – DEPARTMENT OF PUBLIC WORKS AND HIGHWAYS (DPWH) is hereby ORDERED to SUBMIT proof of its notification to the affected data subjects directly to the Compliance and Monitoring Division (CMD) within fifteen (15) days from receipt of this Order.

SO ORDERED.

City of Pasay, Philippines. 11 May 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

(on official leave) NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

ARM Data Protection Officer DPWH Central Office Manila

RRO Administrative Officer V DPWH Central Office Manila

COMPLAINTS AND INVESTIGATION DIVISION COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Post-Breach Report dated 18 November 2022 of DPWH, pp. 1-2. ↩

  2. Initial Report dated 24 April 2018 of DPWH, at p. 1. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. In re: Bureau of Research and Standards – Department of Public Works and Highways, NPC BN 18-061, Order dated 22 November 2021, pp. 1-2. ↩

  7. Post-Breach Report dated 18 November 2022 of DPWH. ↩

  8. Post-Breach Report of DPWH dated 29 November 2021, pp. 1-2. ↩

  9. In re: Bureau of Research and Standards – Department of Public Works and Highways, NPC BN 18-061, Order dated 07 January 2022, pp. 1-2. ↩

  10. Compliance dated 22 February 2022 of DPWH. ↩

  11. Id. ↩

  12. Id. ↩

  13. Post Breach Report dated 18 November 2022, in In re: Bureau of Research and Standards – Department of Public Works and Highways, NPC BN 18-061 (NPC 2018), referred to as Annex A. ↩

  14. Id., referred to as Annex B. ↩

  15. Id., referred to as Annex C. ↩

  16. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, §18(A) (15 December 2016). ↩

  17. NPC Circular 16-03, rule V, §18(D). ↩

  18. In re: Magsaysay Shipmanagement, Inc., NPC BN 20-161, Resolution dated 17 December 2020. ↩

  19. Initial Report dated 24 April 2018 of DPWH, at p. 1. ↩

  20. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, §13 (15 December 2016). ↩

Backlinks

  • No backlinks found