Order Text
IN RE: PHILIPPINE VETERANS BANK NPC BN 22-185
x----------------------------------------------------x
ORDER
Before the Commission are the requests for exemption and postponement from the notification requirement to the affected data subjects filed by Philippine Veterans Bank (PVB) dated 28 October 2022.1
Based on its Initial Report, the Finance Department of PVB conducted a mass transfer of its information technology (IT) equipment in June 2021 from Sterling Building to PVB’s Head Office.2 According to PVB, among the transferred equipment are ten (10) computers dedicated for simulation and testing of R system which is a system used by PVB to calculate economic variables.3 PVB reported that by using the R system, the personal data uploaded therein are “loan borrower’s name, birthdate, address of the collateral if real estate and/or model unit of vehicle if car loan, outstanding balance, insurance coverage and number of days past due, if applicable, of PVB loan borrowers for the year 2019.”4
PVB also stated that the computers containing the R system “cannot be turned-on/logged-in successfully without being attached to the PVB domain” and that it can only be accessed by authorized users.5 It also stated that any attempt to access the system without permission, it will prompt the PVB administrator.6
During the inventory of the deployed IT equipment, two (2) computers cannot be traced in PVB’s system.7 PVB stated that it is conducting personal verification of all the units to confirm if the said units were lost or deployed but were unrecorded.8
On 28 October 2022, PVB notified the Commission and stated that it only discovered of the alleged breach on 25 October 2022.9
PVB also reported that there are thirty-two thousand two hundred seventy-four (32,274) affected data subjects who are loan borrowers of PVB.10
In justifying its request for exemption, PVB stated that the “lost computers do not contain sensitive personal information and there is no reason to believe that there may be an unauthorized access to the personal data considering the Bank’s technical security measures in place.11
On the other hand, PVB justified its request for postponement when it stated that it has yet to complete its investigation.12 PVB also stated that there is a possibility that the lost computers were deployed to other bank units.13 Lastly, PVB stated that “individual notification is not possible and would require disproportionate effort since the data subjects involved are around 32,274.”14
On 11 January 2023, the Commission issued a Minute Resolution ordering PVB to submit proof to substantiate its requests for exemption and postponement from the notification requirement:
Pursuant to Section 17 (D) of NPC Circular No. 16-03 (Personal Data Breach Management), the Commission may require additional information, if necessary, for the proper resolution of the request for Exemption.
WHEREFORE, premises considered, the Commission hereby ORDERS Philippine Veterans Bank to SUBMIT within five (5) days upon receipt of this Minute Resolution proof to substantiate the request for Postponement and Exemption.
Should Philippine Veterans Bank fail to provide the foregoing, this case shall be submitted for resolution based on the records before the Commission.
SO ORDERED.15
To this date, PVB has yet to submit its compliance to the said Minute Resolution.
Rule V, Section 18(A) of NPC Circular No. 16-03 (Personal Data Breach Management) provides that the personal information controller (PIC) should notify the data subjects affected by the breach within seventy-two (72) hours upon knowledge of or reasonable belief that a personal data breach has occurred.16 Such notification shall be made to “allow data subjects to take the necessary precautions or other measures to protect themselves against the possible effects of the breach.”17
Further, Section 18(B) of the same Circular also provides that a PIC may be exempted from the notification requirement based on the Commission’s determination that such notification would not be in the interest of the public or the affected data subjects.18
Moreover, a request for postponement may be authorized by the Commission if the notification may “hinder the progress of a criminal investigation related to a serious breach.”19
In this case, PVB failed to provide proof that will substantiate its requests for exemption and postponement from the notification requirement.
As to its request to be exempt to notify, PVB was not able to submit proof that the notification would not be in the public interest or in the interest of the affected data subjects.
On the other hand, PVB stated that the bank has yet to complete its investigation, hence its request for postponement to notify.20 However, PVB was not able to prove whether the investigation it conducted is a criminal investigation contemplated by NPC Circular No. 16-03. The mere report that PVB has yet to complete its investigation is not sufficient to grant the request to postpone the notification requirement to the affected data subjects.
Thus, this Commission emphasizes that PVB, as PIC, must be reminded of its obligation to notify the data subjects affected by the breach for them to take necessary precautions in order to mitigate further risk of exposure of their personal data.
WHEREFORE, premises considered, the requests of Philippine Veterans Bank (PVB) for exemption and postponement of notification of the data subjects affected by the breach is hereby DENIED.
The Commission DIRECTS the Compliance and Monitoring Division (CMD) to issue the appropriate orders necessary to evaluate and monitor the completeness of PVB’s data breach notification and assess its breach management pursuant to NPC Circular No. 16-03 (Personal Data Breach Management)
SO ORDERED.
City of Pasay, Philippines. 26 January 2023.
JOHN HENRY D. NAGA Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
NERISSA N. DE JESUS Deputy Privacy Commissioner
Copy furnished:
VTV Data Protection Officer
COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
In re: Philippine Veterans Bank, NPC BN 22-185, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Date of Notification of Philippine Veterans Bank (28 October 2022). ↩
-
Id., 1.b Chronology ↩
-
Id., 1.b Chronology ↩
-
Id., 1.b Chronology ↩
-
In re: Philippine Veterans Bank, NPC BN 22-185, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1.b Chronology of Philippine Veterans Bank (28 October 2022). ↩
-
Id., 1.b Chronology ↩
-
Id., 1.b Chronology ↩
-
Id., 1.b Chronology ↩
-
In re: Philippine Veterans Bank, NPC BN 22-185, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1.b Chronology of Philippine Veterans Bank (28 October 2022). ↩
-
Id., in Date of Discovery. ↩
-
Id., in Justification for Exemption. ↩
-
Id., in Justification for Postponement. ↩
-
In re: Philippine Veterans Bank, NPC BN 22-185, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), in Justification for Postponement of Philippine Veterans Bank (28 October 2022). ↩
-
Id., in Justification for Postponement. ↩
-
In re: Philippine Veterans Bank, NPC BN 22-185, Minute Resolution dated 11 January 2023, at p. 1 ↩
-
National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18(A) (15 December 2016) (NPC Circular 16-03) ↩
-
NPC Circular 16-03, rule V, § 18(A). ↩
-
Id. ↩
-
Id., § 18(B) ↩
-
In re: Philippine Veterans Bank, NPC BN 22-185, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), in Justification for Postponement of Philippine Veterans Bank (28 October 2022). ↩