Order Text
IN RE: IQOR PHILIPPINES, INC. NPC BN 23-102
x----------------------------------------------------x
ORDER
Before the Commission is IQOR Philippines Inc. (IQOR) request for alternative means of notification to the affected data subjects dated 11 April 2023 submitted through the Data Breach Notification Management System (DBNMS).
According to IQOR’s initial report, its Health Maintenance Organization (HMO) provider Asalus Corporation (Intellicare) reported to them on 07 April 2023 that one of the latter’s outsourced security tools to transfer files, GoAnywhere MFT, had a breach incident.1
This resulted in the extraction of the IQORs member list used for enrollment by threat actors.2 In the same report, IQOR stated that there are twenty-two thousand five hundred thirty-three (22,533) affected data subjects composed of employees and their dependents.3 Further, approximately three thousand (3,000) of the records are active employees of IQOR.4
IQOR stated in its report that on 10 April 2023, they had a meeting with Intellicare to discuss the incident.5 Consequently, IQOR was informed that the incident was already reported to the NPC by Intellicare on 29 March 2023 and that the latter already initiated the notification to the affected data subjects.6
Thus, IQOR requested that the notification to the affected data subjects be made through Intellicare which is the HMO provider since it already began the notification to its affected data subjects.7
On 02 May 2023, the Commission issued a Minute Resolution with the following dispositive portion:
Pursuant to Section 17(D) of NPC Circular No. 16-03 (Personal Data Breach Management), the Commission may require additional information, if necessary, for the proper resolution of the request for the use of alternative means to notify the affected data subjects.
WHEREFORE, premises considered, the Commission hereby ORDERS IQOR Philippines, Inc to SUBMIT within five (5) days upon receipt of this Minute Resolution proof to substantiate the request for alternative means to notify the affected data subjects.
Should IQOR Philippines, Inc fail to provide the foregoing, this case shall be submitted for resolution based on the records before the Commission.
SO ORDERED.8
On 13 May 2023, IQOR submitted its compliance to the Minute Resolution issued by the Commission dated 02 May 2023.9
In its compliance, IQOR reiterated how the breach incident transpired and that they were not made aware of the breach until 08 April 2023.10 It stated that “GoAnywhere was patched on 07 February 2023. This patch, per Intellicare, prevents any attempt to successfully exploit their systems.”11 Moreso, IQOR claimed that GoAnywhere has never been deployed for commercial use and that the information exposed are members’ names, birthdates, gender, maximum benefit limits, and the relationship of the dependents with their principals.12 It also claimed that there is no health-related information or government-issued numbers involved.13
In the same compliance, IQOR asserted that the breach incident occurred on Intellicare’s end and that it is indeed a personal controller information (PIC).14 Despite that Intellicare is the PIC in the incident, IQOR manifested that “out of abundance of caution and to comply in good faith with NPC Circular 16-03”, it reported the breach to the National Privacy Commission (Commission) through the DBNMS.15
Accordingly, IQOR stated that the final number of affected data subjects is twenty-two thousand five hundred twenty-nine (22,529) and that data subject notification was initiated on 11 April 2023.16
Therefore, to substantiate its request for alternative means of notification, IQOR prays that it be allowed by the Commission to “adopt the data subject notification through Intellicare to the effect that the same shall be considered as the data subject notification by IQOR.”17
In view of the foregoing, the Commission grants the request for alternative means of notification to the affected data subjects by considering Intellicare’s data subject notification as IQOR’s notification. Considering that the breach incident and the affected data subjects involved in this case are one and the same as Intellicare’s breach incident, thus, the latter’s notification would already carry out the purpose of notifying the data subjects. The essence of notifying the affected data subjects is to inform them that their data was involved in a breach and to prevent any unwarranted use of their data. Hence, Intellicare’s notification to the affected data subjects can be considered as IQOR’s notification.
In this breach incident, Intellicare is the PIC being the HMO provider of IQOR. Hence, the former as the PIC should be the one to comply with the notification requirements pursuant to NPC Circular 16-03 Personal Data Breach Management.
Also, it is noteworthy that the submitted copy of the data subject notification sent to the data subjects was addressed to IQOR members due to the fact that the exfiltrated data is the membership list used for enrollment in the HMO program of IQOR for contract year two-thousand twenty-two (2022).18 Finally, IQOR has manifested that it is in close coordination with Intellicare to notify the affected data subjects.19
Thus, the Commission grants the request of IQOR for alternative means of notification to the affected data subjects. Accordingly, the Commission deems it proper to consider the notification of Intellicare to the affected data subjects as IQOR’s notification.
WHEREFORE, premises considered, this Commission GRANTS IQOR Philippines, Inc. requests for alternative means of notification to the affected data subjects by considering Intellicare’s notification to the affected data subjects as its notification.
Further, the Commission DIRECTS the Compliance and Monitoring Division (CMD) to issue appropriate orders necessary to evaluate and monitor the completeness of the IQOR Philippines, Inc. data breach notification and assess its breach management pursuant to NPC Circular 16-03 (Personal Data Breach Management).
SO ORDERED.
City of Pasay, Philippines. 04 July 2023.
JOHN HENRY D. NAGA Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
(on official leave) NERISSA N. DE JESUS Deputy Privacy Commissioner
Copy furnished:
CPM Data Protection Officer IQOR PHILIPPINES, INC.
COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
In re: IQOR Philippines, Inc., Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), (11 April 2023). ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
In re: IQOR Philippines, Inc., Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), (11 April 2023). ↩
-
In re: IQOR Philippines, Inc., Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), (11 April 2023). ↩
-
Id. ↩
-
In re: IQOR Philippines, Inc, NPC BN 23-102, Minute Resolution dated 02 May 2023, at p. 1. ↩
-
Compliance dated 13 May 2023 by IQOR Philippines Inc. ↩
-
Id. at pp. 1-2 ↩
-
Id. at p. 2 ↩
-
Id. at p. 2 ↩
-
Compliance dated 13 May 2023 by IQOR Philippines Inc. at pp. 2-3 ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
Compliance dated 13 May 2023 by IQOR Philippines Inc. at p. 5 ↩
-
Id. Annex “B” ↩
-
Id. ↩