NPC Issuance Wiki

NPC BN 18-095: In re: DMCI Project Developers, Inc.

Issued Order

Order Text

IN RE: DMCI PROJECT DEVELOPERS, INC. NPC BN 18-095

x-------------------------------------------------x

ORDER

Before the Commission is a Supplemental Post Breach Report dated 26 August 2022 submitted by DMCI Project Developers, Inc. (DMCI).1

In its Personal Data Security Breach Report dated 11 June 2018, submitted on 21 June 2018, DMCI stated that “[o]n September 3, 2016, RH received an email with [sic] email address [] requesting for a copy of title and tax declaration for unit XXX, XXX, XXX Residences.”2

DMCI continued that on 06 September 2016, “[u]pon confirmation from record that KP was indeed the unit owner of the said unit, RH released the scanned copy of the title and the tax declaration as a response to the email address.”3

On 07 September 2016, DMCI further alleged that “another email from [] was received by Customer Care through M requesting this time for the copy of the Deed of Absolute Sale (DOAS).”4 As a response to the said request, DMCI averred that a scanned copy of the DOAS was sent to the said email address on 30 September 2016.5

On 24 October 2016, the mother of KP, EP, called DMCI’s customer care, through TA, and inquired on the status of the mentioned unit.6 EP “learned that the copies of the title and tax declaration was [sic] already provided to her son’s email address.”7 EP “informed TA that the email address was allegedly fabricated by her son’s former lived [sic] in partner[,] DS.”8

DMCI declared that only one data subject was affected by the breach.9

On 25 October 2016, DMCI also reported that “Customer Care apologized to EP about the incident and assured that such incident would not happen again.”10 DMCI alleged that EP only complained to CD regarding the issue on data privacy on 04 June 2018.11

On 23 July 2018, the Commission, through its Complaints and Investigation Division (CID), issued a Memorandum requiring DMCI to submit a full report detailing the incident.12

In compliance with the aforementioned Memorandum, DMCI submitted its Incident Report dated 30 July 2018 and clarified that the subject email address was not registered in their records.13 Further, it also stated that the “[s]canned copy of the documents were provided and sent to the above-mentioned email address by [RH] without verifying from [sic] the veracity of the email address.”14 DMCI also admitted that it did not exert any effort to validate the authenticity of the email address through phone call.15

DMCI further clarified that on 30 September 2016, a “[s]canned copy of the DOAS (for the parking slot) was provided and sent to the above mentioned email address again by RH without confirming the identity of the person sending the email.”16

On 05 October 2016, a third email was received from the subject email address, requesting for a copy of the DOAS of the unit.17 On same date, DMCI also received a subpoena requesting to stand as witness for DS.18

On 06 October 2016, for the third time, the “scanned copy of the DOAS (for the unit) was provided and sent to the above-mentioned email address by RH without confirming the identity of the person sending the email.”19

On 24 October 2016, through phone call, EP requested for the status of the titles for the units and parking slot, which TA replied that the information had already been disclosed to her son.20 DMCI stated that its “Customer Care spoke to the client and extended their apologies” the next day.21

On 30 April 2018, DMCI also reported that a deed of donation will be executed in favor of the non-marital child of DS and KP as a case resolution.22 Also, EP signed a conformity for the turnover of Unit XXX to transfer ownership from KP to AP.23

On 05 June 2018, EP filed a complaint to DMCI’s Customer Care regarding the sharing of her son’s information resulting to the donation to the child.24

DMCI averred that the personal data involved are the full name and residence address of KP, his civil status and age, the unit number, project name, location and selling price.25

As to the measures taken to address the breach, DMCI explained that “[u]pon learning that the recipient of the document was not the legitimate person, Customer Care thru TA, apologized to Mrs. EP.”26

Further, DMCI states that “[b]eginning October 2016, identity validation spiels are implemented.”27 “Upon learning of the complaint of EP[,] who divulged the resolution of the case filed by DS against them and identified Unit XXX as a sort of alimony, [DMCI] Customer Care reported this to [their] DPO [Data Protection Officer].”28

DMCI also admitted that RH “was not aware that the person she was transacting to was not the legitimate person.”29

To mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident, DMCI assured the following:

  • Beginning October 2016, the following verification controls was [sic] put in place:
    • Verification of client’s name in our records
    • Verification of declared contact numbers/email addresses
    • Other relevant verification needed
  • Security Questions indicating relevant information that the client provides in their Registration Forms
  • Orientation Materials regarding Data Privacy which are being used during orientation/training of Customer Care personnel.30

On 15 July 2022, the CID issued an order directing DMCI to submit a Supplemental Post-Breach Report.31

On 30 August 2022, DMCI requested for ample time, or until 09 September 2022, to submit their Supplemental Post Breach Report since their “records for 2018 is [sic] still being retrieved due to the change of personnel in [their] Data Protection Unit.”32

On 09 September 2022, DMCI submitted its Supplemental Post Breach Report dated 26 August 2022 listing down the actions it has undertaken since the subject breach, to wit:

  • a. Erring Customer Care representatives were instructed to throw security questions to verify if client’s identity and account details match the documents given before releasing the account details. See ANNEX A- Acknowledgement Template indicating matching or records during request and polite refusal if information does not match. Since then, no similar incident transpired.
  • b. Effective December 7, 2017, orientation on Data Privacy became a regular segment for newly hired employees. Kindly see attached Annex A representing the orientation material.
  • c. For proof of training, please refer to Annex B for the attendance sheets of those who are oriented with Data Privacy Awareness. Aside from those, there is also this Training Checklist (Annex C) which is acknowledged by the trainee as the topics trained.
  • d. DMCI homes has already initiated a lot of measures to protect the client information such as:
    • d.1 Declaration of Data Protection policy to the DMCI homes website
    • d.2 Posting of CCTV camera notification in the lobby of the office to inform client that CCTV footages are being taken
    • d.3 Inclusion of accountability in the processes of the company where client information is to be taken
    • d.4 Inclusion of internal penalty system for breaches involving client information
    • d.5 Preparation of Data Risk Assessment.33

The Commission resolves to direct the CID to conduct a sua sponte investigation for concealment and/or possible violation of the DPA and consolidate the present breach notification with the investigation.

It was only on 24 October 2016 when EP informed DMCI, through TA, that the email address was allegedly fabricated by her son’s former live-in partner, DS.34 It turned out that the email address [] was created by the “ex-girlfriend” of KP and that his name was used to collect information and documents from DMCI.35

Based on the turn of events as dictated by DMCI, it led them to the conclusion that the information of the data subject was acquired by an unauthorized person.

Additionally, the Commission could not turn a blind eye on the delay committed by DMCI in notifying it of the breach incident.

As previously established, the breach occurred on different dates between September and October of 2016.36 Although EP informed DMCI of the alleged breach as early as 24 October 2016, it was only on 21 June 2018, or more than a year and a half, that DMCI notified the Commission of the data breach in its Personal Data Security Breach Report.37 DMCI did not immediately report the alleged breach despite learning the possibility of its occurence when EP complained to DMCI about the data privacy issue.38

Under Section 17 of NPC Circular 16-03, viz:

SECTION 17. Notification of the Commission. The personal information controller shall notify the Commission of a personal data breach subject to the following procedures:

A. When Notification Should be Done. The Commission shall be notified within seventy-two (72) hours upon knowledge of or the reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred.

B. Delay in Notification. Notification may only be delayed to the extent necessary to determine the scope of the breach, to prevent further disclosures, or to restore reasonable integrity to the information and communications system.

The personal information controller need not be absolutely certain of the scope of the breach prior to notification. Its inability to immediately secure or restore integrity to the information and communications system shall not be a ground for any delay in notification, if such delay would be prejudicial to the rights of the data subjects.

Delay in notification shall not be excused if it is used to perpetuate fraud or to conceal the personal data breach.39

In this case, DMCI made the notification more than seventy-two (72) hours from the breach incident. DMCI significantly exceeded the deadline as it was only on 21 June 2018 that it made the initial report to the Commission. Moreover, DMCI did not explain in its reports the reason why they failed to notify the Commission as early as possible of the breach incident and neither did it clarify the cause of the delay.

To the mind of the Commission, were it not for the complaint raised or filed by EP to DMCI, the latter would not have reported the incident. Considering the lapse of time from the dates of its occurrence to its formal submission of the report, DMCI simply reacted to the complaint of the affected data subject and treated the mandatory notification as a mere afterthought. Therefore, DMCI disregarded its duty as a PIC to inform the Commission at the earliest opportunity and attempted to conceal the personal data breach.

Further, in order to mitigate possible harm or negative consequences, as well as limit the damage or distress to the affected data subject, DMCI assured and placed several verification controls such as verification of client’s name in their records, verification of declared contact numbers/email addresses, security questions of relevant information as provided by their clients, and orientation materials regarding data privacy.40 DMCI also listed down several actions it has undertaken moving forward from the incident as enumerated in its Supplemental Breach Report.41

Nevertheless, all these actions taken together could not be held as sufficient excuse to justify the concealment committed by DMCI due to its delay in notifying the Commission of the breach incident.

Section 10, Rule XI of NPC Circular 2024-01 or the Amendments to Certain Provisions of the 2021 Rules of Procedure of the National Privacy Commission provides that:

SECTION 10. Failure to submit breach notification. – Should the NPC receive information that a possible data breach occurred but the PIC or PIP did not submit any notification to the NPC, the CID may use this information to initiate a sua sponte investigation under Rule X.

During the sua sponte investigation, if a breach notification is submitted by the PIC or PIP, the CID shall continue with its sua sponte investigation on violations of the DPA and NPC issuances for possible recommendations for prosecution with the Department of Justice or imposition of administrative fines. The CMD shall, for its part, evaluate the breach matter submitted and recommend the imposition of administrative fines, if warranted.42

In addition to the already established discussion on the instant breach notification, the concealment and belated notification committed by DMCI is tantamount to its failure to submit its breach notification to the Commission. As such, the present breach requires a sua sponte investigation by the CID for possible violation of the DPA, such as concealment of security breaches involving sensitive personal information under Section 30, or malicious disclosure or unauthorized disclosure under Sections 31 and 32, respectively, among others.

As the situation stands, DMCI needs to explain further the reason for its concealment and belated notification to the Commission of the personal data breach.

WHEREFORE, premises considered, the Commission DIRECTS the Complaints and Investigation Division to CONDUCT a sua sponte investigation on the circumstances surrounding the concealment of the personal data breach and possible data privacy violation committed by DMCI Project Developers Inc. and to CONSOLIDATE the said investigation with the present breach notification.

SO ORDERED.

City of Pasay, Philippines. 04 September 2024.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

JCI Data Protection Officer DMCI Project Developers, Inc.

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Supplemental Post Breach Report dated 26 August 2022 of DMCI Project Developers Inc. ↩

  2. Personal Data Security Breach Report, Report No. 2018/DPI-01 dated 11 June 2018 of DMCI Project Developers Inc. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Personal Data Security Breach Report, Report No. 2018/DPI-01 dated 11 June 2018 of DMCI Project Developers Inc. ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. ↩

  10. Personal Data Security Breach Report, Report No. 2018/DPI-01 dated 11 June 2018 of DMCI Project Developers Inc. ↩

  11. Id. ↩

  12. In re: DMCI Project Developers, Inc., NPC BN 18-095, Memorandum dated 23 July 2018. ↩

  13. Incident Report dated 30 July 2018 of DMCI Project Developers Inc. ↩

  14. Id. ↩

  15. Id. ↩

  16. Id. ↩

  17. Incident Report dated 30 July 2018 of DMCI Project Developers Inc. ↩

  18. Id. ↩

  19. Id. ↩

  20. Id. ↩

  21. Incident Report dated 30 July 2018 of DMCI Project Developers Inc. ↩

  22. Id. ↩

  23. Id. ↩

  24. Id. ↩

  25. Incident Report dated 30 July 2018 of DMCI Project Developers Inc. ↩

  26. Id. ↩

  27. Id. ↩

  28. Id. ↩

  29. Incident Report dated 30 July 2018 of DMCI Project Developers Inc. ↩

  30. Id. ↩

  31. In re: DMCI Project Developers, Inc., NPC BN 18-095, Order dated 15 July 2022. ↩

  32. Email dated 30 August 2022 of DMCI Project Developers Inc. ↩

  33. Supplemental Post Breach Report dated 26 August 2022 of DMCI Project Developers Inc. ↩

  34. Personal Data Security Breach Report, Report No. 2018/DPI-01 dated 11 June 2018 of DMCI Project Developers Inc. ↩

  35. Incident Report dated 30 July 2018 of DMCI Project Developers Inc., at p. 17. ↩

  36. Id. ↩

  37. Personal Data Security Breach Report, Report No. 2018/DPI-01 dated 11 June 2018 of DMCI Project Developers Inc. ↩

  38. Id. ↩

  39. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 17 (15 December 2016) (NPC Circular 16-03); emphasis supplied. ↩

  40. Id. ↩

  41. Supplemental Post Breach Report dated 26 August 2022 of DMCI Project Developers Inc. ↩

  42. National Privacy Commission, Amendments to Certain Provisions of the 2021 Rules of Procedure of the National Privacy Commission, NPC Circular 2024-01, rule XI, § 10 (26 January 2024); emphasis retained. ↩

Backlinks

  • No backlinks found