NPC Issuance Wiki

NPC BN 23-082: In re: Department of Science and Technology-Regional Office V

Issued Order

Order Text

IN RE: DEPARTMENT OF SCIENCE AND TECHNOLOGY-REGIONAL OFFICE V NPC BN 23-082

x----------------------------------------------------x

ORDER

Before the Commission is the Department of Science and Technology-Regional Office V’s (DOST – Region V) request for exemption of notification to the affected data subjects dated 20 March 2023 submitted through the Data Breach Notification Management System (DBNMS).

According to DOST – Region V’s initial report, they were informed by the DOST Information Technology Division (DOST-ITD) regarding the Department of Science and Technology – Alleged Leaked Database it received on 15 March 2023.1 The initial information of the incident was from the Department of Information and Communications Technology– Philippine National Computer Emergency Response Team (CERT-PH), who thereafter informed and forwarded the same to the DOST-Region V Management Information Systems Unit (MISU).2

Thereafter, the MISU’s technical staff checked and verified the reported alleged leaked database through their Information Technology (IT) staff.3 To check the extent and severity of the incident, an initial assessment and server/database audit were conducted.4 As a result of the initial assessment, DOST-Region V stated that “it was then concluded by the team that there has been no intrusion through the agency’s existing firewall and server”5 and that “no other malicious threats were detected or found in the database.”6

Subsequently, DOST – Region V stated in its initial report that its MISU exported the subject database that may include personal information which needs verification and further assessment by the DOST Data Privacy Act Project Team.7 The Data Privacy Act Project Team by the DOST conducted its initial assessment and coordinated with the technical staff of DOST-ITD.8 Moreover, DOST – Region V stated in its initial report that there were seventy-six (76) affected data subjects and there is no sensitive personal information disclosed.9

Lastly, DOST – Region V stated that to avoid further data breaches and losses, it temporarily disabled the network interface of its server.10 DOST – Region V also performed database and server directory scanning for malicious files and validated the leaked database.11 It also claimed that the subject database which was posted on social media is no longer found in the demo server.12

On 08 May 2023, the Commission issued a Minute Resolution with the following dispositive portion:

Pursuant to Section 17(D) of NPC Circular No. 16-03 (Personal Data Breach Management), the Commission may require additional information, if necessary, for the proper resolution of the request for exemption to notify the affected data subjects.

WHEREFORE, premises considered, the Commission hereby ORDERS Department of Science and Technology-Regional Office V to SUBMIT within five (5) days upon receipt of this Minute Resolution proof to substantiate the request for exemption to notify the affected data subjects.

Should Department of Science and Technology-Regional Office V fail to provide the foregoing, this case shall be submitted for resolution based on the records before the Commission.

SO ORDERED.13

To date, DOST – Region V has not yet submitted any proof to substantiate its request for exemption to notify the affected data subjects. Consequently, the request shall be decided based on the existing records.

The Commission denies the request for exemption to notify the affected data subjects.

Section 18 (B) of NPC Circular No. 16-03 (Personal Data Breach Management) provides:

B. Exemption or Postponement of Notification. If it is not reasonably possible to notify the data subjects within the prescribed period, the personal information controller shall request the Commission for an exemption from the notification requirement, or the postponement of the notification. A personal information controller may be exempted from the notification requirement where the Commission determines that such notification would not be in the public interest or in the interest of the affected data subjects. The Commission may authorize the postponement of notification where it may hinder the progress of a criminal investigation related to a serious breach, taking into account circumstances provided in Section 13 of this Circular, and other risks posed by the personal data breach.14 (Emphasis supplied)

Based on the foregoing, the instant case does not fall under any of the circumstances provided in Section 18 (B) of NPC Circular 16-03, which may warrant the exemption of notification to the affected data subjects. It must be noted that a mere assertion that there is no sensitive personal information involved that would likely give rise to a real risk to the affected data subjects without substantiating the same should not be given credence.

To reiterate, DOST – Region V failed to provide any necessary supporting documentation for its request for exemption to notify the affected data subjects when it did not comply with the Commission’s Minute Resolution dated 08 May 2023 ordering it to substantiate its request. Additionally, DOST – Region V was given sufficient opportunity to substantiate its request for exemption to notify the affected data subjects, however, it failed to do so.

Further, it must be noted that there was a delay in notification to the Commission of the breach incident. NPC Circular 16-03 (Personal Data Breach Management) Section 17 (A) and (B) provides:

SECTION 17. Notification of the Commission. The personal information controller shall notify the Commission of a personal data breach subject to the following procedures:

A. When Notification Should be Done. The Commission shall be notified within seventy-two (72) hours upon knowledge of or the reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred.

B. Delay in Notification. Notification may only be delayed to the extent necessary to determine the scope of the breach, to prevent further disclosures, or to restore reasonable integrity to the information and communications system. The personal information controller need not be absolutely certain of the scope of the breach prior to notification. Its inability to immediately secure or restore integrity to the information and communications system shall not be a ground for any delay in notification, if such delay would be prejudicial to the rights of the data subjects. Delay in notification shall not be excused if it is used to perpetuate fraud or to conceal the personal data breach.15 (emphasis supplied)

Thus, based on DOST Region V’s initial report, it stated that it discovered the incident on 15 March 2023, however, it only notified the Commission on 20 March 2023.16 Accordingly, the seventy-two (72) hours time to notify the Commission had already lapsed. Given the foregoing, the Commission finds it necessary to direct DOST Region-V to provide an explanation for its delay in notification to the Commission of the breach incident pursuant to the above-stated provision of NPC Circular No. 16-03.

WHEREFORE, premises considered, this Commission DENIES Department of Science and Technology Regional Office V’s request for exemption of notification to the affected data subject.

Further, Department of Science and Technology Regional Office V is hereby ORDERED to SHOW CAUSE in writing and SUBMIT to the Compliance and Monitoring Division (CMD) why it should not be subjected to contempt proceedings, as permitted by law, before the appropriate court, and other actions as may be available to the Commission, for its failure to notify the Commission within the required period under NPC Circular No. 16-03 within fifteen (15) days from receipt of this Order.

Lastly, the Commission DIRECTS the CMD to issue the appropriate orders necessary to evaluate and monitor the completeness of the Department of Science and Technology Regional Office V’s data breach notification and assess its breach management pursuant to NPC Circular No. 16-03.

SO ORDERED.

City of Pasay, Philippines. 04 July 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

(On Official Leave) NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

MC Data Protection Officer Department of Science and Technology-Regional Office V

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. In re: Department of Science and Technology Regional Office V, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), (20 March 2023). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. In re: Department of Science and Technology Regional Office V, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), (20 March 2023). ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. In re: Department of Science and Technology Regional Office V, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), (20 March 2023). ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. In re: Department of Science and Technology Regional Office V, NPC BN 23-082, Minute Resolution dated 08 May 2023, at p. 1. ↩

  14. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18(B) (15 December 2016) (NPC Circular 16-03). ↩

  15. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 17 (A) (B) (15 December 2016) (NPC Circular 16-03). ↩

  16. In re: Department of Science and Technology Regional Office V, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), (20 March 2023). ↩

Backlinks

  • No backlinks found