Resolution Text
IN RE: TULAY SA PAG-UNLAD, INC. CID BN NO. 18-086
x----------------------------------------------------x
NAGA, D.P.C.:
Before this Commission is a data breach notification from Tulay sa Pag-unlad, Inc. (“TSPI”) in relation to the personal data breach on one of its employee’s personal bank account.
Facts
On 04 June 2018, an employee of TSPI went to the Banco De Oro (“BDO”) ATM in Paniqui, Tarlac to withdraw from her personal account. Upon checking the balance, she found out that the amount of P10,000.00 had been deducted from the account.
BDO then informed the TSPI employee that there had been two (2) debit transactions in her account amounting to P5,000.00 each occurred on 03 June 2018, and both consummated at Makati City. Said payments were used for purchases made from Lazada.
On 05 June 2018, FSS, Data Protection Officer (“DPO”) of TSPI, submitted a breach notification report to the Commission involving the incident.
On 13 June 2018, upon the query of the Complaints and Investigation Division (“CID”), the DPO of TSPI confirmed that the account involved was the personal account of their employee and not the actual account of the TSPI. The DPO also informed the CID that the amount deducted had already been credited back to the employee on 11 June 2018.
On 28 April 2020, the case was submitted by the CID for Resolution of this Commission.
Discussion
The Data Privacy Act (“DPA”) and the NPC Circular 16-03 require every Personal Information Controller (“PIC”) the twin responsibility of notifying the Commission and the affected data subjects when personal data breach occurs. Section 20 (f) of the DPA provides:
“(f) The personal information controller shall promptly notify the Commission and affected data subjects when sensitive personal information or other information that may, under the circumstances, be used to enable identify fraud are reasonably believed to have been acquired by an unauthorized person, and the personal information controller or the Commission believes that such unauthorized acquisitions is likely to give rise to real risk of serious harm to any affected data subjects…” (Emphasis supplied)
Further, Section 15 of NPC Circular 16-03 states:
“The personal information controller shall notify the Commission and the affected data subjects upon knowledge of, or when there is reasonable belief that a personal data breach has occurred. The obligation to notify remains with the personal information controller even if the processing of information is outsourced or subcontracted to a personal information processor. The personal information controller shall identify the designated data protection officer of other individual responsible for ensuring its compliance with the notification requirements provided in this Circular…” (Emphasis supplied)
It can be inferred from the above that the PIC has the responsibility of notifying both the Commission and the affected data subjects when personal data breach occurs. Notification becomes necessary if the personal or sensitive personal information may be used for identity fraud, may have been acquired by an unauthorized person, and the PIC or this Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.
In the case at hand, TSPI was clearly not the PIC responsible to report the incident to the Commission considering that it does not decide on what information is collected, or the purpose or extent of the processing in the TSPI employee’s personal bank account. Otherwise stated, TSPI is not the PIC that has the duty to notify the Commission about the personal data breach. However, reviewing the factual antecedents of the case, BDO and Lazada are the proper PICs that should have reported this breach to the Commission. BDO as the bank who holds the personal account of the TSPI employee and Lazada as the merchant who processed the payments made on 03 June 2018.
Further, the return of the P10,000.00 to the TSPI employee’s personal account would reveal that his or her account was accessed and used by an unauthorized person. Clearly, this case falls under the required notification as provided in the above-cited Section 15 of NPC Circular 16-03.
This Commission will then carry out its solemn duty of ensuring compliance of PICs with the DPA and its issuances in the end of protecting the rights of the affected data subject.
WHEREFORE, premises considered, this Commission resolves to CLOSE AND TERMINATE this particular case, In Re: Tulay sa Pag-Unlad Inc., without prejudice to the sua sponte investigation that the CID shall be conducting as to the responsibility of both BDO and Lazada under the DPA and the issuances of the Commission.
SO ORDERED.
Pasay City, 21 May 2020.
JOHN HENRY D. NAGA Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
Copy furnished:
FSS Data Protection Officer Tulay sa Pag-unlad, Inc
COMPLAINTS AND INVESTIGATION DIVISION GENERAL RECORDS UNIT National Privacy Commission