NPC Issuance Wiki

NPC BN 18-097: In re: Department of Social Welfare and Development - MIMAROPA Field Office

Issued Order

Order Text

IN RE: DEPARTMENT OF SOCIAL WELFARE AND DEVELOPMENT-MIMAROPA FIELD OFFICE NPC BN 18-097

x----------------------------------------------------x

ORDER

On 25 July 2018, Department of Social Welfare and Development-MIMAROPA Field Office (DSWD MIMAROPA) notified the Commission regarding a breach incident due to a lost parcel containing the accomplished House Validation Forms (HVFs) of one hundred sixteen (116) identified poor households from the municipalities of Magdiwang, Cajidiocan, and San Fernando, Romblon.1

According to DSWD MIMAROPA, it spearheaded the Unconditional Cash Transfer (UCT) household validation from March to April 2018 which aims to “identify potential beneficiaries of government financial assistance as a mitigating measure to the effect of rising prices of basic commodities due to Tax Reform for Acceleration and Inclusion (TRAIN) law.”2

In administering UCT validation, DSWD MIMAROPA described its process as:

The UCT validation was administered by hired Administrative Assistants and validators regionwide. After house-to-house interviews using the DSWD [HVFs], all accomplished forms from the municipal level were forwarded to our MIMAROPA five (5) provincial offices for logging and consolidation as our standard protocol. Then, our SWAD [Social Welfare and Development] team facilitated the transmittal to the regional office in Malate, Manila for the encoding as the last process of the validation activities. However, in some instances, HVFs from the Calamianes Group of Islands in Palawan, Lubang Island in Occidental Mindoro, and Sibuyan Island in Romblon were sent directly to the regional office via courier.

Given the geographical setting of the region, the Department relies heavily on the available mode on transport and courier services in the areas to transmit/ship various documents.3

DSWD MIMAROPA also narrated the chronology of events leading to the loss of the HVFs containing the personal data of the affected data subjects.4 DSWD MIMAROPA stated that on 14 May 2018, its field staff forwarded to LBC Express, Inc.-Romblon the parcel containing the following: (a) one hundred eleven (111) HVFs validated with Household Validation Logs (HVLs); (b) five (5) HVFs from vacant housing unit and transferred residence with HVLs; (c) two (2) barangay certificates of validation completes; and (d) traveling expenses of five (5) field staff.5

According to DSWD MIMAROPA, the delivery period was after three (3) to four (4) days.6 On 17 May 2018, an LBC staff stated that the parcel was already transmitted to Batangas which was reflected in the LBC tracking system.7 DSWD MIMAROPA alleged that the parcel was expected to be delivered the next day, but no shipment arrived.8

On 22 May 2018, DSWD MIMAROPA, through its field staff, MRM, personally asked the status of the delivery where she was informed that the parcel, together with other documents from different LBC customers, were already forwarded to Batangas on 15 May 2018 via M/V DM.9 However, based on the crew of M/V DM, no LBC porter has picked up the packages.10

Consequently, the LBC Romblon team head confirmed that the parcel was missing.11 The LBC Romblon team head stated that an investigation on the matter will be conducted and that the missing parcel will be retrieved.12 Meanwhile, MRM requested from LBC a certificate regarding the loss of the parcel.13 MRM likewise prepared an incident report about the case.14

To act on the incident, DSWD MIMAROPA issued a demand letter to LBC-Romblon to locate and recover the missing parcel.15

On 20 June 2018, DSWD MIMAROPA was called by LBC Romblon to offer eight hundred pesos (P800.00) as a form of settlement on the lost parcel, which was the declared value in the delivery receipt.16 However, on 21 June 2018, the offered amount was disagreed upon by DSWD MIMAROPA and LBC Romblon raised the issue to its legal team in order to respond to the demand letter from DSWD MIMAROPA for the negligent disposal, discarding or abandonment of the parcel containing the personal information of 116 individuals.17 Unfortunately, it was the last communication received by DSWD MIMAROPA from LBC Main Office.18 Accordingly, DSWD MIMAROPA submitted its Data Breach Notification Report dated 25 July 2018 informing the Commission of the incident.19

In its breach report, DSWD MIMAROPA stated that the incident “cause the delay in processing the approved list of UCT-Listahanan beneficiaries regionwide. Thus, affected the schedule on notification, registration, and pay-out activities of UCT program for Listahanan identified non-Pantawid poor household.”20 The incident was also said to cause the disenfranchisement of the 116 households from the program.21

DSWD MIMAROPA stated that the HVFs contain “pre-generated 29 indicators drawn from the Household Assessment Form (HAF) used in the 2nd nationwide assessment [which include] personal and sensitive personal information such as names, address, marital status, birthday and other socio-economic information of the households.”22

DSWD MIMAROPA further narrated:

…

Hired field staff are oriented to the salient features of the Data Privacy Act DPA of 2012, as it included in their training syllabus. Also, there are provisions in their contract on the confidentiality of the gathered information of the households.

Furthermore, as mandated by Executive Order No. 867 series of 2010, National Household Targeting System for Poverty Reduction (NHTS-PR) or Listahanan is the repository of data on poor households and directs all national government agencies to use the NHTSPR of the DSWD as the mechanism for identifying poor HH who shall be recipient of social protection programs nationwide.

Thus, missing HVFs of identified poor households may be used in cases of identifying fraud or theft particularly in accessing social protection programs intended for Listahanan identified poor households. Moreover, information on the poor households may be used for political and other personal interests.23

As to the measures taken to address the breach, DSWD MIMAROPA already informed “the municipal social welfare and development officers and barangay officials of the affected household on the missing HVFs” and that it “will conduct revisits to the said households for another assessment.”24 DSWD MIMAROPA added:

To facilitate the possible inclusion in the UCT program, the Listahanan-Regional Project Management Office (RPMO) conducted re-validation of the 110 household in the municipalities of Cajidiocan, Magdiwang and San Fernando, Romblon last 12-14 July 2018.

Moreover, RPMO staff also personally issued Data Breach Notification to the household heads or member of the households, as part of the compliance of the regional office to the DPA of 2012.

On the other hand, six (6) of the 116 household with missing HVFs were identified as Pantawid Pamilyang Pilipino Program beneficiaries by the name-matching conducted by National Household Targeting Office. Thus, Data Breach Notification was also issued to them and in coordination with Pantawid Municipal Links.25

Finally, DSWD MIMAROPA attached a copy of the breach notification letter given to the households whose HVFs went missing, as well as the sample HVF and LBC Romblon’s declaration of missing parcel.26

The Commission, through its Complaints and Investigation Division, issued an Order dated 15 April 2019 requiring LBC Express, Inc. to “provide evidence of compliance with the standard of diligence required of those handling personal data under [DPA] and explain circumstances behind the loss of the parcel.”27

On 8 July 2022, the CID issued another Order requiring DSWD MIMAROPA to submit a Post-Breach Report pursuant to Section 9, Rule IV of the NPC Circular 16-03 (Personal Data Breach Management).28

Accordingly, DSWD MIMAROPA submitted its Post-Breach Report dated 06 August 2022 in compliance with the Order of CID dated 08 July 2022.29 In its Post-Breach Report, DSWD MIMAROPA stated that among the measures taken to address the breach, it already requested technical assistance to the Postal Regulation Division of the Department of Information and Communications Technology (DICT) to trace the lost parcels as well as to the Department of Trade and Industry (DTI) for the possibility of misdelivered parcels to LBC’s branches nationwide.30

Furthermore, DSWD MIMAROPA narrated the following proposed specific actions and policies to prevent the recurrence of the incident:

Actions:

  • a. Regularly conduct information dissemination and series of orientation about the DPA while providing technical assistance to its internal and external staff and partner agencies most importantly on the data sharing agreement with the National Household Targeting System (NHTS) for Poverty Reduction.
  • b. DSWD MIMAROPA’s designation of Data Compliance Officer for Privacy and Personal Information Processor to all its programs and services.
  • c. During the occurrence of the data breach, DSWD MIMAROPA officially informed the Data Protection Officer of the DSWD at the Central Office, the concerned Program Office and the Office of the concerned Undersecretary, in order to institutionalize information and technical assistance within the Department.31

Established and ongoing measures:

  • a. DSWD MIMAROPA’s Data Privacy Manual is currently being developed.
  • b. An interim committee or office was assigned to address DPA concerns.
  • c. Requirement of data encryption on the electronic transmission of data or documents with personal and sensitive personal information depending on the sensitivity of the document, number of data subjects, and the purpose of requesting or destination office. The transmission is “stringed” with technical assistance on decryption (for password access) from the concerned program information technology officer.
  • d. Strict selection, engagement, and tracking of the third-party courier services, as well as the document or parcel handling.
  • e. Rigorous observation or monitoring on the distinction and identification of personal, sensitive personal information as well as privileged information prior sharing to its internal and external partners.
  • f. As standard procedure of DSWDDPC MIMAROPA, the processing of personal and sensitive personal information must bear a portion for declaration, information, and consent relative to the DPA.32

Proposed measures:

  • a. Development of Department-wide Privacy Manual for standard field offices relative to the delivery of the social welfare and social protection programs and services.
  • b. Establishment of non-interim Department and Field Officers Data Protection Office or Committee.33

On 11 November 2022, CID issued an Order requiring DSWD MIMAROPA to:

  1. TO SUBMIT proof of the security measures in place concerning the following:
    • a) delivery, transportation, and receipt of HVFs, and reporting and monitoring of the status of delivery between DSWD MIMAROPA and the third-party courier (i.e. As per letter response, “This includes our information and requests [sic] [for] technical assistance to the [DICT] x x x,” provide proof and status of such requests; also include proof of standards in choosing third-party courier);
    • b) actions taken to secure or recover the lost parcel (i.e. results of coordination with LBC, or if there was any, include incident report or result of investigation conducted, or actions taken by LBC);
  2. TO SUBMIT information regarding specific actions and policies being implemented or proposed to prevent a recurrence of the incident, including:
    • a) As mentioned in the initial report, “DSWD-MIMAROPA-Legal Division is preparing to file a complaint to the [DTI] and DICT against the said courier,” kindly indicate the status of such actions;
    • b) Provide proof of the actions indicated in the letter response dated 6 August 2022, including the dissemination of information, series of orientations and technical assistance to internal and external staff and partner agencies; and
    • c) Data Privacy Manual as stated in the letter response, or the draft thereof.

DSWD MIMAROPA is hereby given a period of fifteen (15) days from receipt hereof to submit their compliance through email at complaints@privacy.gov.ph.

SO ORDERED.34

On 03 January 2023, an Order was reissued by CID to DSWD MIMAROPA reiterating its previous Order dated 11 November 2022.35 In addition thereto, the CID also ordered DSWD MIMAROPA to submit: 1) Department-wide Data Privacy Manual as stated in the Post-Breach Report, or the draft thereof; 2) “Proof of ‘Establishment of official (not interim) Department and Field Officer Data Privacy Office/Committee through official special order,’ as stated in the Post-Breach Report; and 3) Information about the designated Data Protection Officer, including the name, contact information, and address.”36

On the other hand, CID issued an Order dated 21 November 2022 requiring LBC Express, Inc.:

[T]o SUBMIT PROOF OF COMPLIANCE with the standard of diligence required of those handling personal data under Section 20 of Republic Act 10173 (Data Privacy Act of 2012) and EXPLAIN circumstances behind the loss of the parcel.

LBC Express, Inc. is hereby given a period of fifteen (15) days from receipt hereof to submit compliance through email at complaints@privacy.gov.ph.

SO ORDERED.37

On 02 December 2022, LBC Express, Inc. sent an email requesting an extension to file its formal reply to the Order issued by CID dated 11 November 2022.38 In its email request, LBC Express, Inc. stated that it “will require some time to unearth [its] files and reports on this matter.”39

In a Resolution dated 05 December 2022, CID granted LBC Express, Inc.’s request for extension and was given an additional period of ten (10) calendar days to submit its compliance.40

Thereafter, LBC Express, Inc. submitted its compliance dated 15 December 2022 with the Order of the CID dated 11 November 2022.41 In the said compliance, LBC Express, Inc. provided an explanation on the loss of DSWD MIMAROPA’s parcels, as well as details on its standard operating procedures under the LBC Express, Inc.’s courier terms and conditions.42

Meanwhile, DSWD MIMAROPA submitted its Supplementary Proof to the Post-Breach Report dated 20 January 2023.43 In its compliance, DSWD MIMAROPA submitted the following supplementary documents:

  1. Proof of Letter of Demand to LBC Express, Inc. on the retrieval of the lost parcels;44
  2. Proof of Letter of Demand to LBC Express, Inc. for the payment of P112,294.00 representing the total amount of actual damages incurred for the re-validation for data gathering;45
  3. Proof of certification from LBC Express, Inc. regarding the lost parcel of DSWD MIMAROPA;46
  4. Proof of data breach notification to the Commission dated 25 July 2018;47
  5. Proof of letter to Department of Trade and Industry;48
  6. Sample breach letter-notification to the affected data subjects;49
  7. Sample HVF;50
  8. Incidental Report regarding the incident to the Regional Director of DSWD MIMAROPA;51
  9. LBC tracking number of the subject parcel;52
  10. Draft Data Privacy Manual of DSWD MIMAROPA;53
  11. Regional Special Order on the Designation of Compliance Officer for Privacy;54
  12. Regional Special Order on the Designation of Compliance Officers for Privacy, as well as Primary and Alternate Personal Information Processors on various programs or services of DSWD MIMAROPA;55
  13. Sample Data Release Form authorizing the internal and external partners to acquire and use the privileged data from the National Household Targeting Unit;56 and,
  14. Regional Special Order on the Establishment of Regional Data Privacy Office and Technical Committee Membership.57

Rule V, Section 18 (C) and (D) of NPC Circular 16-03 (Personal Data Breach Management) provide:

SECTION 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

…

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.58

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data.

The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.59

According to DSWD MIMAROPA, as one of the measures it took to address the breach, it “personally issued Data Breach Notification to the household heads or member of the households.”60 Breach notification was also said to have issued to the 6 of 116 households who were identified as beneficiaries of the Pantawid Pamilyang Pilipino Program, in coordination with Pantawid Municipal Links.61 Following this narrative is the attachment of the letter-notification allegedly sent to the affected data subjects.62

Based on the above provisions, the notification to the affected data subjects must contain sufficient information especially on the nature of the breach, personal data possibly involved, and the measures taken to address and mitigate the breach.63

In this case, the sample letter-notification submitted by DSWD MIMAROPA is not tantamount to actual notification to the affected data subjects. Therefore, such cannot be considered as substantial compliance to the notification requirements.

While the Commission recognizes the efforts exerted by DSWD MIMAROPA in undertaking mitigation measures to address the incident, it must be stressed that a mere narration of notification having been made to the affected data subjects without submitting any proof of such notification is not considered as substantial compliance with the DPA, its Implementing Rules and Regulations, as well as NPC Circular No. 16-03 (Personal Data Breach Management).

Thus, DSWD MIMAROPA shall submit proof of individual notification. Such proof of notification is necessary in order for the Commission to determine whether DSWD MIMAROPA has undertaken reasonable mechanisms to ensure that all affected data subjects are made aware of the breach.64

WHEREFORE, premises considered, Department of Social Welfare and Development (DSWD) MIMAROPA Field Office is hereby ORDERED to SUBMIT proof of notification to the affected data subjects to the Compliance and Monitoring Division (CMD) within fifteen (15) days from the receipt of this Order.

The Commission also DIRECTS CMD to issue the appropriate orders necessary to evaluate and monitor the completeness DSWD MIMAROPA Field Office’s data breach notification and assess its breach management pursuant to NPC Circular 16-03 (Personal Data Breach Management).

SO ORDERED.

City of Pasay, Philippines. 21 March 2024.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

LCR Regional Director

DPO DSWD

JSM OIC, Regional Director for Administration Regional Data Protection Officer

COMPLAINTS AND INVESTIGATION DIVISION COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Data Breach Notification dated 25 July 2018 of Department of Social Welfare and Development-MIMAROPA Field Office, at p. 1. ↩

  2. Id. ↩

  3. Id. ↩

  4. Id., at p. 2. ↩

  5. Data Breach Notification dated 25 July 2018 of Department of Social Welfare and Development-MIMAROPA Field Office, at p. 2. ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. Data Breach Notification dated 25 July 2018 of Department of Social Welfare and Development-MIMAROPA Field Office, at p. 2. ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Data Breach Notification dated 25 July 2018 of Department of Social Welfare and Development-MIMAROPA Field Office, at p. 2. ↩

  14. Id. ↩

  15. Id. ↩

  16. Id., at pp. 2-3. ↩

  17. Data Breach Notification dated 25 July 2018 of Department of Social Welfare and Development-MIMAROPA Field Office, at p. 3. ↩

  18. Id. ↩

  19. Id. ↩

  20. Id. ↩

  21. Data Breach Notification dated 25 July 2018 of Department of Social Welfare and Development-MIMAROPA Field Office, at p. 3. ↩

  22. Id. ↩

  23. Id. ↩

  24. Id. ↩

  25. Data Breach Notification dated 25 July 2018 of Department of Social Welfare and Development-MIMAROPA Field Office, at pp. 3-4. ↩

  26. Id., at p. 4. ↩

  27. CID BN 18-097 (unreported) Order dated 15 April 2019. ↩

  28. NPC BN 18-097 (unreported) Order (To Submit Post-Breach Report) dated 08 July 2022. ↩

  29. Post-Breach Report dated 06 August 2022 of Department of Social Welfare and Development-MIMAROPA Field Office. ↩

  30. Id., at p. 1. ↩

  31. Id., at p. 2. ↩

  32. Id., at pp. 2-3. ↩

  33. Supplementary to Post-Breach Report dated 03 January 2023 of Department of Social Welfare and Development-MIMAROPA Field Office. ↩

  34. NPC BN 18-097 (unreported) Order (To Submit Proof Supplementary to the Post-Breach Report) dated 11 November 2022. ↩

  35. NPC BN 18-097 (unreported) Order (To Submit Proof Supplementary to the Post-Breach Report) dated 03 January 2023. ↩

  36. Id. ↩

  37. NPC BN 18-097 (unreported) Order (To Submit Proof of Compliance and Explain Loss of Documents) 21 November 2022. ↩

  38. Electronic mail dated 02 December 2022 from LBC Express, Inc. ↩

  39. Id. ↩

  40. NPC BN 18-097 (unreported) Resolution (of the Request for Extension filed on 2 December 2022) 05 December 2022. ↩

  41. Response to the Order (to Submit Proof of Compliance and Explain Loss of Documents) dated 15 December 2022 of LBC Express, Inc. ↩

  42. Id. ↩

  43. Supplementary to Post-Breach Report dated 03 January 2023 of Department of Social Welfare and Development-MIMAROPA Field Office. ↩

  44. Id., attached as Letter of Demand dated 25 May 2018. ↩

  45. Id. ↩

  46. Supplementary to Post-Breach Report dated 03 January 2023 of Department of Social Welfare and Development-MIMAROPA Field Office, attached as Certification from LBC Express, Inc. ↩

  47. Id., attached as Data Breach Notification dated 25 July 2018. ↩

  48. Id., attached as Letter to Department of Trade and Industry dated 27 July 2018. ↩

  49. Id., attached as NHTSPR Breach Notification Letter. ↩

  50. Supplementary to Post-Breach Report dated 03 January 2023 of Department of Social Welfare and Development-MIMAROPA Field Office, attached as House Validation Form. ↩

  51. Id., attached as Incidental Report of UCT Documents Forwarded to LBC-Romblon dated 23 May 2018. ↩

  52. Id., attached as Tracking Number. ↩

  53. Id., attached as Data Privacy Manual. ↩

  54. Supplementary to Post-Breach Report dated 03 January 2023 of Department of Social Welfare and Development-MIMAROPA Field Office, attached as Regional Special Order Re: Designation dated 30 March 2022. ↩

  55. Id., attached as Regional Special Order Re: Designation. ↩

  56. Id., attached as Data Release Form. ↩

  57. Id., attached as Regional Special Order Re: Establishment of Regional Data Privacy Office and Technical Committee Membership dated 20 January 2023. ↩

  58. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18(C) (15 December 2016) (NPC Circular 16-03). ↩

  59. NPC Circular 16-03, rule V, § 18(D). ↩

  60. Data Breach Notification dated 25 July 2018 of Department of Social Welfare and Development-MIMAROPA Field Office, at pp. 3-4. ↩

  61. Id. ↩

  62. Id., at p. 4. ↩

  63. NPC Circular 16-03, rule V, § 18(C). ↩

  64. Id., § 18(D). ↩

Backlinks

  • No backlinks found