Resolution Text
IN RE: JOBSTREET.COM
x----------------------------------------------------x
NAGA, D.P.C.:
This Resolution refers to the data breach notifications that the Commission received on four (4) separate occasions dated as follows: 17 December 2016; 18 October 2017; 25 October 2017; and 26 October 2017 from Jobstreet.com (Jobstreet) in relation to a data breach pertaining to a single data set containing sensitive personal information of more than seventeen (17) million users.1
Facts
In 2017, Jobstreet submitted data breach notifications on four (4) separate occasions dated 17 December 2016, 18 October 2017, 25 October 2017, and 26 October 2017 before this Commission. The notifications involve a similar incident in which Jobstreet’s IT Manager discovered a website forum concerning the purported sale of data belonging to “Jobstreet.com”.
On 09 November 2017, Jobstreet submitted a Cyber Incident Analysis which stated that the data pertains to a single set and contains the personal information of more than seventeen (17) million users. According to the said report, the data set was not recent and was last updated on 07 March 2012. The report also stated that the data set was more likely obtained before June 2012. Lastly, Jobstreet’s investigation concluded that there were no evidence that the compromised accounts were accessed by unauthorized person/s.
In terms of security and remediation measures, Jobstreet has implemented the following actions:
- notified the affected data subjects;2
- implemented a password reset policy; and
- provided information on how data subjects can secure their personal information.
On 01 August 2019, this Commission issued a Resolution3 directing Jobstreet to submit a complete report on its Personal Data Breach Management within thirty (30) days upon receipt of the Order. The said Resolution was delivered to Jobstreet in Malaysia through DHL Express4 on 16 August 2019; however, Jobstreet failed to comply within the prescribed period.
On 15 July 2020, this Commission’s Enforcement Division (EnD) sent a Compliance Letter to Jobstreet’s Data Protection Officer (DPO), MM, instructing Jobstreet to comply with the abovementioned Resolution. The said letter was received on 03 August 2020,5 where again, Jobstreet failed to submit the report required by this Commission.
Discussion
This Commission finds that the submission of Personal Data Breach Management report as a necessary step to improve the personal data breach management and policies of Personal Information Controllers (PICs) such as Jobstreet. Section 9 of the NPC Circular 16-03 provides:
All actions taken by a personal information controller or personal information processor shall be properly documented. Reports should include:
a. Description of the personal data breach, its root cause and circumstances regarding its discovery;
b. Actions and decisions of the incident response team;
c. Outcome of the breach management, and difficulties encountered; and
d. Compliance with notification requirements and assistance provided to affected data subjects.
A procedure for post-breach review must be established for the purpose of improving the personal data breach management policies and procedures of the personal information controller or personal information processor. (Emphasis Supplied)
As often reminded by this Commission in previous cases, the complete submission of reports, including the policies and procedures that govern imperative actions performed by PICs in cases of data breach, are one of its strict responsibilities under the Data Privacy Act (DPA) and the NPC Circular 16-03. Further, this Commission deems such reports as necessary not only for the Commission to ascertain the actions implemented by Jobstreet to prevent the recurrence of the breach, reduce its harm, and protect the affected data subjects, but to provide the opportunity to continuously develop and strengthen its personal data breach management policies and procedures to lessen the risks of serious harm and protect personal information in the event of a data breach.
Such is also in accordance with Section 20(a) of the DPA, viz: “(a) The personal information controller must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.”
While Jobstreet sent several submissions, participated in coordination meetings, and provided numerous updates to the Commission on its investigation, security and remediation measures, and breach management, it failed to provide the proper documentation of such actions which is required under NPC Circular 16-03. Despite the Commission’s reminder to Jobstreet of its obligation to comply to its Resolution dated 01 August 2019, which was reiterated through the Compliance Letter dated 15 July 2020 sent by EnD, the Commission has not yet received Jobstreet’s Personal Data Breach Management report.
Furthermore, this Commission clarifies and reiterates that in cases of data breach, the PICs’ obligations does not end with the mere provisions of updates on their investigation and the measures it implemented. Compliance with the law also warrants the PICs’ rigorous and complete submission of documents required by the Commission and timely observance of its orders.
WHEREFORE, premises considered, Jobstreet.com is hereby ORDERED to comply with the following within ten (10) days from receipt of this Order:
- SUBMIT a Personal Data Breach Management report in compliance with Section 9 of the NPC Circular 16-03; and
- SHOW CAUSE in writing why it should not be subject to contempt proceedings, as permitted by law, before the appropriate court, and other actions as may be available to the Commission, for its failure to comply with the Resolution dated 01 August 2019 and the Compliance Letter dated 15 July 2020.
SO ORDERED.
Pasay City, Philippines. 17 December 2020.
JOHN HENRY D. NAGA
Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO
Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner
Copy furnished:
MM Data Protection Officer, General Counsel Seek Asia (Jobstreet.com Shared Services Sdn. Bhd.)
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT