Resolution Text
IN RE: SOCIAL SECURITY SYSTEM
x----------------------------------------------------x
NAGA, D.P.C.:
This refers to the breach notification report of Social Security System (SSS) dated 28 January 2017 concerning the loss of a paper bag containing documents and a USB flash drive with the information of Five thousand six hundred ninety-four (5,694) SSS employees. The flash drive contains an electronic report of SSS to PHILHEALTH and PAG-IBIG.
Facts
On 13 July 2018, the Commission issued a Compliance Order with a dispositive portion as follows:
“The Commission, pursuant to Section 7(a), 7(b), 7(d) and 7(e) of the Data Privacy Act of 2012, and NPC Circular 16-03 on Personal Data Breach Management, finding the need for measure to address the current breach and to minimize the likelihood of the occurrence of another data breach, hereby ORDERS SSS to submit a report to this Commission on the status of the security measures being and proposed to be implemented within three (3) months from receipt of this Order.”
On 19 November 2018, SSS submitted a report on the status of the security measures being and proposed to be implemented. After evaluating said report, the Enforcement Division of this Commission directed the Data Protection Officer (DPO) of SSS to submit copies of the agency’s policies and procedures on the storage and transfer of personal data.
On 15 August 2019, in compliance to the order of the Enforcement Division, SSS submitted the following documents:
- Revised Guidelines on Records Management;
- General Information and Communication Technology Security Policy;
- Electronic File Transfer Policy;
- Password Policy; and
- The Implementation of the Data Privacy Manual.
Further, SSS reported that they are implementing the following measures to ensure security of data stored and transported through removable media:
- All files must be protected with encrypted passwords to prevent unauthorized disclosure and modification of files. Passwords must be in accordance with the Password Policy;
- Ensure that only necessary files are copied and stored;
- Full implementation of the Endpoint Encryption software acquired in May 2019. This software is capable of full disk and removable media encryption;
- As a matter of policy, the SSS has discontinued acquisition and issuance of removable media;
- Ensure the utmost security of removable media while in transport including provision of service vehicle; and
- Preparation of the SSS Information Security Manual.
Discussion
The Enforcement Division, through the assistance of this Commission’s Data Security and Technology Standards Division (DSTSD), issued its findings on the compliance of SSS, viz:
“The measures in the Letter that the SSS are currently implementing appear to be adequate. These measures can be improved by using AES-256 encryption for USB flash drives and to the individual records or files contained thereto. Further, whenever using removable media, the transfer of information to such media should be monitored, and procedures and authorization levels should be documented accordingly. The policies and procedures met most of the matching requirements from the NPC Circular 16-01 and ISO/IEC 27002. WHEREFORE, premises considered, the Enforcement Division respectfully recommends to CLOSE the instant case.”
Given the sufficiency of the submissions of SSS in compliance with the orders of this Commission, and the absence of error and abuse of discretion on the part of the Enforcement Division and DSTSD, this Commission finds no reason to disturb their recommendations.
WHEREFORE, premises considered, it is resolved that the matter of NPC BN 17-048 “In re: Social Security System” is hereby considered CLOSED.
SO ORDERED.
Pasay City, Philippines. 21 January 2021.
JOHN HENRY D. NAGA
Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO
Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner
Copy furnished:
GDS Data Protection Officer
JAV Data Protection Officer
RCG Data Protection Officer
ENFORCEMENT DIVISION COMPLIANCE AND MONITORING DIVISION GENERAL RECORDS UNIT