NPC Issuance Wiki

NPC BN 23-027: In re: AFNI, Inc.

Issued Order

Order Text

IN RE: AFNI, INC. NPC BN 23-027

x----------------------------------------------------x

ORDER

Before the Commission is the preliminary request for exemption from the notification requirement filed by AFNI, Inc.’s (AFNI) dated 14 February 2023 through the Data Breach Notification Management System (DBNMS).1

In its Initial Report, AFNI stated that on 19 December 2022, it received an escalation email from a partner client about a series of “unauthorized business account port outs” allegedly authorized by AFNI employees between 15 and 16 December.2 In its initial review of the incident, AFNI stated that no actual customer interactions were recorded for each of the identified transactions.3 However, further investigation by AFNI’s partner client revealed that some of its employees initiated unauthorized PIN changes even though no customer calls and a requirement to execute such changes were recorded.4

AFNI reported that it initiated an internal investigation “to determine the veracity of the report it received from the partner client,”5 and “interviewed their employees who could shed light on the incident, and pin down the perpetrators who were required to execute incident reports for documentation purposes.”6

During the investigation, two (2) employees of AFNI admitted their involvement in the fraudulent scheme and later found out that “six (6) AFNI employees were involved in a fraudulent scheme of initiating and sending the PIN changes requests [sic] without an actual request from the customer for consideration of P300 per account for the damage of AFNI.”7 AFNI reported that these employees used the access GAMA148 of one of their coaches without the latter’s consent to log in to the client system.8

AFNI also reported that it conducted an internal hearing to give the concerned employees an opportunity to explain the incident, and thereafter issued a decision to terminate their employment with AFNI.9

Moreover, AFNI further stated in its Initial Report:

AFNI issued a Memorandum (“Memo”) to their employees reminding them of the confidentiality agreement as stated in their employment contract and AFNI’s handbook to remind all employees that any information obtained by AFNI will only be released or issued with express approval from the concerned party or if there is a court order, and that any act contrary thereto shall be dealt with the appropriate penalty of dismissal from employment and the filing of appropriate criminal charges, among others.

Further, AFNI issued another Memorandum entitled Memo: Updated Threat Actors Memo mandating all employees to abide by the standard verification procedure, and report any suspicious activities, social engineering attempts, and breaches in internal controls and security to the FRM as well as the InfoSec Team. It likewise promoted the AFNI’s Integrity Campaign-Risk Management in the Workplace to prevent any unauthorized processing and disclosure of any information of their employees and customers. The same memorandum contained a warning that any employee who may have been found to have violated AFNI’s Code of Discipline, Republic Act No. 10175 or the Cybercrime Prevention Act of 2012, and Republic Act No. 10173 otherwise known as the Data Privacy Act of 2012 may be held administratively, civilly, and criminally liable.10

Further investigation by AFNI revealed that there are thirty (30) data subjects affected11 and that there was indeed a data breach that involved customer PIN numbers.12 Thereafter, AFNI stated that it coordinated with their Data Protection Officer (DPO) to determine the scope of the data breach and prepare safety and precautionary measures to safeguard the information of AFNI’s customers.13

Thus, AFNI requested to be exempt from the notification requirement of the data subjects.14 In justifying its request, AFNI stated that:

[It] locked down the compromised customer accounts and an alert email was sent to its affected customers, detailing ways on how their personal information can be protected. Further, AFNI has initiated administrative cases against the erring employees and is preparing to file criminal charges against those responsible for the commission of the breach.15

On 16 February 2023, AFNI sent an email to the Commission requesting the deletion of the notification made stating that same was erroneous.16 AFNI stated that it initially thought that there was a breach of confidential information, but additional verification showed there was none.17

On 27 February 2023, the Commission issued a Minute Resolution resolving that:

Pursuant to Section 17 (D) of NPC Circular No. 16-03 (Personal Data Breach Management), the Commission may require additional information, if necessary, for the proper resolution of the request for exemption to notify the affected data subjects.

WHEREFORE, premises considered, the Commission hereby ORDERS Afni Inc to SUBMIT within five (5) days upon receipt of this Minute Resolution proof to substantiate the request for exemption to notify the affected data subjects.

Should Afni Inc. fail to provide the foregoing, this case shall be submitted for resolution based on the records before the Commission.

SO ORDERED.18

Accordingly, AFNI submitted its Manifestation/Compliance dated 06 March 2023, stating that the reported breach was merely an internal error without any human intervention.19 Thus, AFNI requested to delete its data breach notification entry for being erroneous.20

The Commission resolves to deny AFNI’s request for exemption to notify the affected data subjects.

Section 18(B) of NPC Circular No. 16-03 (Personal Data Breach Management) provides:

SECTION 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

B. Exemption or Postponement of Notification. If it is not reasonably possible to notify the data subjects within the prescribed period, the personal information controller shall request the Commission for an exemption from the notification requirement, or the postponement of the notification. A personal information controller may be exempted from the notification requirement where the Commission determines that such notification would not be in the public interest or in the interest of the affected data subjects. The Commission may authorize the postponement of notification where it may hinder the progress of a criminal investigation related to a serious breach, taking into account circumstances provided in Section 13 of this Circular, and other risks posed by the personal data breach.21

In this case, AFNI filed its request for exemption from the notification requirement of the data subjects before the Commission.22 In resolving this request, the Commission issued a Minute Resolution requiring AFNI to submit proof to substantiate its request.23 Subsequently, AFNI sent an email to the Commission on 16 February 2023 requesting the deletion of the notification made as the same was said to be erroneous since no breach actually occurred.24

However, instead of substantiating its request for exemption, AFNI submitted its compliance with the Minute Resolution requesting the Commission to recall its notification entry since the reported breach was merely an internal error without any human intervention.25

AFNI, as a personal information controller (PIC), must substantiate its preliminary request for exemption by submitting additional information required by the Commission,26 showing that notification would not cause negative consequences to the data subjects affected by the breach. In this case, however, AFNI failed to submit proof to substantiate its request for exemption. Rather, AFNI submitted its compliance with the Minute Resolution retracting its preliminary request for exemption.

Mere manifestation that the submission was made in error without providing proof thereof is not sufficient to grant its request for exemption.

Further, investigations by AFNI revealed that six (6) of its employees were involved in the breach and two (2) of them admitted their complicity in the incident.27 This admission made by AFNI is an acknowledgment on its part that a breach has occurred. Thus, the Commission denies the request for exemption.

AFNI also reported in its Initial Report that there was indeed a personal data breach that involved thirty (30) data subjects28 affecting their PIN numbers29 which can likely result to exposure to unlawful access of their confidential information.30 These initial reports made by AFNI contradict its statements made from its compliance with the Minute Resolution dated 27 February 2023 stating that no breach has occurred and that the incident is merely an internal error.31

Lastly, the Commission requires AFNI to explain on its belated notification to the Commission of the incident. Section 17(A) of NPC Circular No. 16-03 provides:

SECTION 17. Notification of the Commission. The personal information controller shall notify the Commission of a personal data breach subject to the following procedures:

A. When Notification Should be Done. The Commission shall be notified within seventy-two (72) hours upon knowledge of or the reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred.32 (Emphasis supplied)

According to AFNI, it received an email on 19 December 2022 about a series of unauthorized business account port outs which allegedly occurred between 15 and 16 December 2022.33 However, AFNI reported that the incident was only discovered on 11 February 2023, and only notified the Commission on 14 February 2023.34

Moreover, AFNI also stated that it only notified the Commission after it concluded its investigation and confirmed that a breach has occurred.35

Applying the abovementioned provision, AFNI should have notified the Commission within seventy-two (72) hours from the date of knowledge or reasonable belief that a personal data breach has occurred, which in this case, was on 19 December 2022 when AFNI received an email on the alleged account port outs, and not after it has concluded its investigation and confirmed the occurrence of data breach.

WHEREFORE, premises considered, the Commission hereby DENIES the request of AFNI, INC. for exemption of the notification of the data subjects affected by the breach.

Further, AFNI, INC. is hereby ordered to SHOW CAUSE in writing why it should not be subjected to contempt proceedings, as permitted by law, before the appropriate court, and other actions as may be available to the Commission, for its failure to notify the Commission within the prescribed period.

Lastly, the Commission DIRECTS the Compliance and Monitoring Division (CMD) to issue the appropriate orders necessary to evaluate and monitor the completeness of AFNI, INC.’s data breach notification and assess its breach management pursuant to NPC Circular 16-03 (Personal Data Breach Management).

SO ORDERED.

City of Pasay, Philippines. 16 March 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

TN Data Protection Officer AFNI, Inc.

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. In re: AFNI, Inc., NPC BN 23-027, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Date of Notification of AFNI, Inc. (14 February 2023). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. In re: AFNI, Inc., NPC BN 23-027, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1. b in Chronology of AFNI, Inc. (14 February 2023). ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. In re: AFNI, Inc., NPC BN 23-027, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1. b in Chronology of AFNI, Inc. (14 February 2023). ↩

  10. Id. ↩

  11. Id. 1.c Number of DS / Records (14 February 2023). ↩

  12. Id. 1. b in Chronology of AFNI, Inc. (14 February 2023). ↩

  13. In re: AFNI, Inc., NPC BN 23-027, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1. b in Chronology of AFNI, Inc. (14 February 2023). ↩

  14. In re: AFNI, Inc., NPC BN 23-027, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS) (14 February 2023). ↩

  15. Id. in Justification for exemption (14 February 2023). ↩

  16. Electronic mail dated 16 February 2023 of AFNI, Inc. ↩

  17. Id. ↩

  18. NPC BN 23-027, (unreported), Minute Resolution dated 27 February 2023, at p. 1. ↩

  19. Manifestation/Compliance dated 06 March 2023 of AFNI, Inc., ¶ 2. ↩

  20. Electronic mail dated 16 February 2023 of AFNI, Inc. ↩

  21. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18(B) (15 December 2016) (NPC Circular 16-03). ↩

  22. In re: AFNI, Inc., NPC BN 23-027, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS) (14 February 2023). ↩

  23. NPC BN 23-027, (unreported), Minute Resolution dated 27 February 2023, at p. 1. ↩

  24. Electronic mail dated 16 February 2023 of AFNI, Inc. ↩

  25. Manifestation/Compliance dated 06 March 2023 of AFNI, Inc., ¶ 2. ↩

  26. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 17(D) (15 December 2016) (NPC Circular 16-03). ↩

  27. In re: AFNI, Inc., NPC BN 23-027, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1. b in Chronology of AFNI, Inc. (14 February 2023). ↩

  28. Id. 1.c Number of DS / Records (14 February 2023). ↩

  29. Id. 1. b in Chronology of AFNI, Inc. (14 February 2023). ↩

  30. Id. 1.e Likely Consequences of AFNI, Inc. (14 February 2023). ↩

  31. Manifestation/Compliance dated 06 March 2023 of AFNI, Inc., ¶ 2. ↩

  32. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 17(A) (15 December 2016) (NPC Circular 16-03). ↩

  33. In re: AFNI, Inc., NPC BN 23-027, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Brief Summary of AFNI, Inc. (14 February 2023). ↩

  34. Id. Date of Notification of AFNI, Inc. (14 February 2023). ↩

  35. Id. Brief Summary of AFNI, Inc. (14 February 2023). ↩

Backlinks

  • No backlinks found