NPC Issuance Wiki

NPC BN 23-007: In re: Fast Retailing Philippines, Inc.

Issued Order

Order Text

IN RE: FAST RETAILING PHILIPPINES, INC. NPC BN 23-007

x----------------------------------------------------x

ORDER

Before the Commission is the request for postponement filed by Fast Retailing Philippines, Inc. (FRPH) dated 12 January 2023.1

According to FRPH, it received an initial report from its warehouse contractor stating that on 09 January 2023, some shipments for delivery entrusted to Wall Street Courier Services, Inc. (Ninja Van PH), the subcontractor of Nippon Express Philippines Corporation (NEPC), FRPH’s contractor, went missing.2 FRPH reported that on 11 January 2023, it held an emergency meeting with the warehouse contractor to conduct a “thorough investigation to determine which of [the] said shipments are in fact lost and/or misrouted, and to identify the root cause of this incident.”3 FRPH also stated that once the root cause of the incident is determined, countermeasures must be immediately taken.4

Based on its Initial Report, FRPH determined one hundred ten (110) data subjects affected by the incident but stated that “[n]umber of data subjects is still being verified.”5

FRPH stated that the initial reports show that the personal data involved are the name, address, and telephone number of its customers who ordered through [its] online store (https://www.uniqlo.com/ph/en/) and mobile application.6

FRPH reported that the “measures to address the breach,”7 “measures to secure or recover personal data,”8 “actions to inform the data subjects,”9 and “measures to prevent recurrence of incidence”10 are to be determined or confirmed since there is currently an ongoing investigation to identify the root cause of the incident.11 Hence, the request for postponement to notify the data subjects.

In justifying its request for postponement, FRPH stated that:

Due to the uncertain number of shipments which requires verification as to their current status, and the fact that the delivery services are in turn outsourced by our warehouse contractor to a third-party, FRPH has yet to determine which of its e-commerce customers are in fact subject of the potential personal data breach. Because of this, FRPH is constrained to request for a postponement of data subject notification to allow it to first ascertain the affected individuals that must be notified.12

On 09 February 2023, the Commission issued a Minute Resolution ordering FRPH to submit proof to substantiate FRPH’s request for postponement. The Minute Resolution has the following dispositive portion:

Pursuant to Section 17 (D) of NPC Circular 16-03 (Personal Data Breach Management), the Commission may require additional information, if necessary, for the proper resolution of the request for postponement of notification of the affected data subjects.

WHEREFORE, premises considered, the Commission hereby ORDERS Fast Retailing Philippines, Inc. to SUBMIT within five (5) days upon receipt of this Minute Resolution proof to substantiate the request for postponement of notification of the affected data subjects.

Should Fast Retailing Philippines, Inc. fail to provide the foregoing, this case shall be submitted for resolution based on the records before the Commission.

SO ORDERED.13

Subsequently, FRPH submitted its Compliance dated 14 February 2023 stating that from 13 to 20 January 2023, it proceeded to contact its customers whose packages were confirmed lost based on the partial daily reports submitted by NEPC and Ninja Van PH.14 FRPH attached therein sample notices sent to its customers.15

According to FRPH, it received on 24 January 2023 an initial investigation report from Ninja Van PH stating that “sixty-four (64) data subjects have been impacted due to the lost parcels.”16 FRPH further stated:

The initial report disclosed that parcels were declared lost due to the following reasons:

  1. The number of parcels in Ninja Van PH’s last mile hubs increased due to peak season sales, considering that these hubs cater to other online platform sellers as well. In view thereof, there was improper management by the employees of Ninja Van PH’s hub inventory in several of their last mile hubs.

  2. There was also poor scan compliance by Ninja Van PH employees as most of these employees were newly hired due to the peak season and were not properly trained to handle the influx of parcels for delivery.17

Based on the Compliance, it was also stated that:

Ninja Van stated that since the parcels were considered missing while in their last mile hubs and the personal information of the customers were handled by authorized employees, there was no indication of unauthorized disclosure of personal information to third parties. Ninja Van claimed that their investigation remains ongoing and that they have instructed their personnel to locate the subject parcels.18

It was also stated therein that FRPH directed NEPC and Ninja Van PH “to employ systematic changes in the handling of UNIQLO parcels entrusted to their care in accordance with the Data Outsourcing Agreement FRPH has with NEPC. NEPC has also been enjoined to ensure that the same level of security shall be maintained by its subcontractor, Ninja Van PH.”19

Lastly, FRPH indicated that it continuously communicates with the sixty-four (64) affected data subjects “regarding their requests to reship and/or to refund payment for affected parcels.”20

The Commission denies the request of FRPH for postponement to notify the affected data subjects.

Rule V, Section 18(B) of the NPC Circular No. 16-03 (Personal Data Breach Management) provides:

B. Exemption or Postponement of Notification. If it is not reasonably possible to notify the data subjects within the prescribed period, the personal information controller shall request the Commission for an exemption from the notification requirement, or the postponement of the notification. A personal information controller may be exempted from the notification requirement where the Commission determines that such notification would not be in the public interest or in the interest of the affected data subjects. The Commission may authorize the postponement of notification where it may hinder the progress of a criminal investigation related to a serious breach, taking into account circumstances provided in Section 13 of this Circular, and other risks posed by the personal data breach.21

In this case, FRPH failed to show that the investigation it conducted was a criminal investigation contemplated under the NPC Circular No. 16-03. It also failed to prove that notification to the affected data subjects may hinder the progress of a criminal investigation related to a serious breach.

In its Compliance, FRPH merely stated that it ordered a joint investigation to NEPC and Ninja Van PH to determine the root cause and the actual number of customers affected.22 However, FRPH failed to show that the investigation it conducted was criminal in nature, which would be a ground for the postponement of the notification requirement to the affected data subjects.

Moreover, FRPH’s request for postponement is grounded on the fact that according to Ninja Van PH, no indication of unauthorized disclosure to third parties has occurred since the personal information of the customers were handled by authorized employees.23 However, FRPH failed to show that the personal information of the customers are not handled by other persons other than its authorized employees.

Further, it must be noted that it has been more than a month since the parcels were reported missing. Thus, FRPH is deemed to have lost control over them. Additionally, the lost parcels contained personal data of customers such as their names, addresses, and telephone numbers24 which, if put together may be used by unauthorized persons to enable identity fraud.25

Nevertheless, FRPH stated that it continues to communicate with the sixty-four (64) data subjects regarding their requests for reship or refund.26 Also, with the available information that FRPH have in the course of its investigation, the Commission deems it necessary for FRPH to likewise notify the affected data subjects to allow them to take necessary measures to protect themselves from possible negative consequences of the breach.

Lastly, Rule V, Section 18(C) of the NPC Circular No. 16-03 also provides:

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.27

Applying the foregoing provision, FRPH could have notified the affected data subjects in phases based on the information it has in its possession pending its investigation. The notification to the data subjects affected by the incident should have been done without FRPH awaiting for the conclusion of its investigation.

WHEREFORE, premises considered, the request for postponement from the notification requirement filed by Fast Retailing Philippines, Inc. (FRPH) is hereby DENIED. The Commission hereby ORDERS FRPH to NOTIFY the affected data subjects and submit proof of such notification.

The Commission also DIRECTS the Compliance and Monitoring Division (CMD) to ISSUE appropriate orders necessary to evaluate and monitor the completeness of its data breach notification and breach management pursuant to NPC Circular No. 16-03 (Personal Data Breach Management).

SO ORDERED.

City of Pasay, Philippines. 20 March 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

AS Data Protection Officer Fast Retailing Philippines, Inc.

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. In re: Fast Retailing Philippines, Inc., NPC BN 23-007, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Date of Notification of Fast Retailing Philippines, Inc. (12 January 2023). ↩

  2. Id., 1.b. Chronology. ↩

  3. Id. ↩

  4. Id. ↩

  5. In re: Fast Retailing Philippines, Inc., NPC BN 23-007, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1.c Number of DS/Records of Fast Retailing Philippines, Inc. (12 January 2023). ↩

  6. Id. ↩

  7. Id., 3.a Measures to address the breach. ↩

  8. Id., 3.b Measures to secure/recover personal data? ↩

  9. In re: Fast Retailing Philippines, Inc., NPC BN 23-007, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 3.c Actions to mitigate harm? of Fast Retailing Philippines, Inc. (12 January 2023). ↩

  10. Id., 3.e Measures to prevent recurrence of incidence. ↩

  11. In re: Fast Retailing Philippines, Inc., NPC BN 23-007, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS) (12 January 2023). ↩

  12. Id., Justification for postponement. ↩

  13. In re: Fast Retailing Philippines, Inc., NPC BN 23-007, Minute Resolution dated 09 February 2023, at p. 1. ↩

  14. Compliance dated 14 February 2023 of Fast Retailing Philippines, Inc., at p. 1. ↩

  15. Id., regarded as Exhibit “A.” ↩

  16. Id., at p. 2. ↩

  17. Id. ↩

  18. Compliance dated 14 February 2023 of Fast Retailing Philippines, Inc., at p. 2. ↩

  19. Id. ↩

  20. Id. ↩

  21. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18(B) (15 December 2016) (NPC Circular 16-03). ↩

  22. Compliance dated 14 February 2023 of Fast Retailing Philippines, Inc., at p. 1. ↩

  23. Id., at p. 2. ↩

  24. In re: Fast Retailing Philippines, Inc., NPC BN 23-007, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Brief Summary of Fast Retailing Philippines, Inc. (12 January 2023). ↩

  25. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 11 (15 December 2016) (NPC Circular 16-03). ↩

  26. Compliance dated 14 February 2023 of Fast Retailing Philippines, Inc., at p. 2. ↩

  27. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18(C) (15 December 2016) (NPC Circular 16-03). ↩

Backlinks

  • No backlinks found