Order Text
IN RE: PHILIPPINE NATIONAL POLICE NPC BN 23-179
x----------------------------------------------------x
ORDER
Before the Commission is the Compliance of the Philippine National Police (PNP) dated 22 August 2023 in accordance with the Minute Resolution dated 14 August 2023.
On 25 July 2023, DS posted on Facebook a screenshot of pictures of persons with warrants of arrest.1 Said post was discovered through Viber message on 26 July 2023.2
In PNP’s Preliminary Breach Notification Form, PNP stated that it changed the path of uploaded pictures in the system and the password of all users as a measure to address the breach and mitigate harm.3 Further, to prevent recurrence of the incident, the PNP will issue a memorandum recommending that all users become more security conscious in using their account.4 It also plans to rewrite the system’s code and add two-factor authentication on user’s login with a code to be sent on their mobile phones.5
On 28 July 2023, the PNP notified the National Privacy Commission (NPC) through the Data Breach Notification Management System (DBNMS) and requested for exemption from notifying the affected data subjects on the basis that he/she is a wanted person.6 Also, it requested for an extension of forty-five (45) days to submit the required documents because the incident is still under investigation.7
At the time of said notification, the PNP averred that there was no data loss based on the database file size and record count, unless otherwise proven by the investigation of the PNP Anti-Cybercrime Group (ACG).8
On 14 August 2023, the Commission issued a Minute Resolution with the following dispositive portion:
Pursuant to Section 17 (D) of NPC Circular No. 16-03 (Personal Data Breach Management), the Commission may require additional information, if necessary, for the proper resolution of the requests for exemption to notify the affected data subjects and extension of forty-five (45) days to submit its full report.
WHEREFORE, premises considered, the Commission hereby ORDERS the Philippine National Police to SUBMIT within five (5) days upon receipt of this Minute Resolution proof to substantiate the requests for exemption to notify the affected data subjects and extension of forty-five (45) days to submit its full report.
Should the Philippine National Police fail to provide the foregoing, this matter shall be submitted for resolution based on the records before the Commission.
SO ORDERED.9
On 24 August 2023, the PNP submitted its Compliance to the Commission’s Order.10
The PNP stated that it is withdrawing its request for exemption to notify the affected data subjects because its Compliance to Privacy Officer of the Directorate for Investigation and Detective Management (DIDM) has already individually notified the five (5) data subjects affected by the incident.11
The PNP alleged that it was able to identify the affected data subjects by comparing the artifacts with the files in the e-Warrant and found them to be matched.12
Nonetheless, the PNP reiterated its request for extension to submit full report because the investigation by the ACG is still ongoing and the DIDM is yet to determine the scope of the incident for purposes of the investigation.13 Such request was granted by the NPC’s Compliance and Monitoring Division (CMD).
Accordingly, the Commission notes PNP’s Compliance dated 22 August 2023. In PNP’s Compliance, it withdrew the request for exemption, rendering such request moot. However, the Commission orders PNP to submit proof of notification directly to the CMD.
At the outset, it should be emphasized that notification of data subjects of data breaches is the general rule. Section 18 (A) of NPC Circular 16-03 provides:
A. When should notification be done. The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred.
The notification may be made on the basis of available information within the 72-hour period if the personal data breach is likely to give rise to a real risk to the rights and freedoms of data subjects. It shall be undertaken in a manner that would allow data subjects to take the necessary precautions or other measures to protect themselves against the possible effects of the breach. It may be supplemented with additional information at a later stage on the basis of further investigation.14
Section 18 (B) of the same Circular provides for the circumstances where exemption may be allowed, thus:
B. Exemption or Postponement of Notification. If it is not reasonably possible to notify the data subjects within the prescribed period, the personal information controller shall request the Commission for an exemption from the notification requirement, or the postponement of the notification.
A personal information controller may be exempted from the notification requirement where the Commission determines that such notification would not be in the public interest or in the interest of the affected data subjects.
The Commission may authorize the postponement of notification where it may hinder the progress of a criminal investigation related to a serious breach, taking into account circumstances provided in Section 13 of this Circular, and other risks posed by the personal data breach.15 (Emphasis supplied)
In this case, aside from justifying its request on the basis that the affected data subject is a wanted person,16 the PNP failed to adduce sufficient evidence for the Commission to conclude that notification would not be in the public interest or in the interest of the affected data subjects.
Furthermore, notwithstanding PNP’s request for exemption, it already purportedly notified its affected data subjects.17 In this regard, Section 18 (D) of NPC Circular 16-03 states:
D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data.
The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.18 (Emphasis supplied)
However, the PNP only posited in its Compliance that it notified the affected data subjects.19 Without any substantiation, such bare allegations do not conform with the purpose of the notification requirement.
In re: Health Delivery System, Inc. underscored the importance of ensuring that affected data subjects receive timely notification, viz:
It is noteworthy that the avowed purpose of the required notification to data subjects of a breach incident is for them to take the necessary precautions or other measures to protect themselves against possible effects of the breach. Moreover, personal information controllers (PICs) are required to establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach. It therefore follows that PICs should guarantee that the notification they sent to data subjects has been received. Otherwise, it defeats the very purpose of notification of data subjects.20
To reiterate, the Commission stresses that “the purpose of the required notification to the affected data subjects of a breach incident is for them to protect themselves against possible negative consequences or effects of the data breach. That is why if the PIC cannot prove that it will not be in the public interest or in the interest of the affected data subjects, a breach notification is required.”21
WHEREFORE, premises considered, the Commission resolves to:
- ORDER the Philippine National Police to submit proof of notification directly to the Compliance and Monitoring Division (CMD) within fifteen (15) days from receipt of this Order; and
- DIRECT the CMD to issue the appropriate orders necessary to evaluate and monitor the completeness of the Philippine National Police’s data breach notification and assess its breach management pursuant to NPC Circular 16-03 (Personal Data Breach Management).
SO ORDERED.
City of Pasay, Philippines. 13 November 2023.
JOHN HENRY D. NAGA Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
NERISSA N. DE JESUS Deputy Privacy Commissioner
Copy furnished:
BMB Data Protection Officer Philippine National Police
CTE Representative Philippine National Police
COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
In re: Philippine National Police, NPC BN 23-179, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Brief Summary. ↩
-
Id, 1.b Chronology. ↩
-
Id, 3.a Measures to Address the Breach, and 3.c Actions to Mitigate Harm. ↩
-
Id, 3.e Measures to Prevent Recurrence of Incidence. ↩
-
In re: Philippine National Police, NPC BN 23-179, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 3.e Measures to Prevent Recurrence of Incidence. ↩
-
Id. ↩
-
Id. ↩
-
Id, 3.b Measures to Secure/Recover Personal Data. ↩
-
In Re: Philippine National Police, NPC BN 23-179, Minute Resolution dated 14 August 2023, at p. 1. ↩
-
Compliance dated 22 August 2023 of Philippine National Police, at p. 1. ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18 (A) (15 December 2016) (NPC Circular 16-03). ↩
-
NPC Circular 2016-03, rule V, § 18 (B). ↩
-
In re: Philippine National Police, NPC BN 23-179, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS). ↩
-
Compliance dated 22 August 2023 of Philippine National Police, at p. 1. ↩
-
National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18 (D) (15 December 2016) (NPC Circular 16-03). ↩
-
Compliance dated 22 August 2023 of Philippine National Police, at p. 1. ↩
-
In Re Health Delivery System, Inc., NPC BN 20-049, Resolution dated 01 July 2021, at p. 5. ↩
-
Id, at p. 4. ↩