NPC Issuance Wiki

NPC BN 17-010: In re: Movie and Television Review and Classification Board

Issued Resolution

Resolution Text

IN RE: MOVIE AND TELEVISION REVIEW AND CLASSIFICATION BOARD

AGUIRRE, D.P.C.

Facts

Before the Commission is the Movie and Television Review and Classification Board’s (MTRCB) breach notification and management in compliance with NPC Circular 16-03 (Personal Data Breach Management).

To recall, MTRCB requested for exemption from notification of its data subjects on 07 March 2018.1 MTRCB also requested for a sixty-day extension period if the exemption is not feasible.2

On 15 April 2021, the Commission denied MTRCB’s request for exemption and extension, ordered MTRCB to submit proof of notification to its data subjects, and submit the results of its independent security audit. The Commission issued an order directing the Movie and Television Review and Classification Board to comply with the following:

(1) NOTIFY the data subjects affected by the breach incident within fifteen (15) days from receipt of this Order;

(2) SUBMIT proof of notification that ensures all data subjects were made aware of the breach within fifteen (15) days from receipt of this Order; and

(3) SUBMIT the results of the independent security audit within three (3) months from receipt of this Order.

SO ORDERED.3

The Commission explained that MTRCB had not submitted proof of notification of its data subjects.4 If MTRCB deemed it necessary to notify the data subjects and asked for the extension in good faith, it should have proceeded to notify the data subjects after the lapse of sixty (60) days.5 The Commission also highlighted the fact that the sensitive personal information or other information that may enable identity fraud of at least five hundred seventy-three (573) individuals were compromised.6 Taking everything into consideration, the breach was likely to give rise to a real risk to the data subjects’ rights and freedoms.7 Finally, the Commission also considered the issuance of the Compliance Order dated 31 January 2018 as proof that the Commission had not found ground to dispense with the notification requirement.8 The Commission maintained that MTRCB failed to prove it was entitled to exemption, even after multiple requests for postponement or exemption from notification.9

MTRCB manifested that it received the Order dated 15 April 2021 on 06 May 2021.10 MTRCB posted a Notice of Data Breach (Notice) on its website (www.mtrcb.gov.ph) on 12 May 2021.11 It also informed the Commission that it notified its data subjects by posting the Notice on its website as an alternative means of notification instead of individual notification. MTRCB explained that while “[it is] aware of the requirements of NPC Circular 16-03 regarding the sending of an individual notification to affected data subjects. However, [it finds] the individual notification an arduous task, as [it] learned that the number of affected data subjects amounted to five hundred seventy-three (573).”12 The Notice states:

NOTICE OF DATA BREACH

On 19 September 2017, 10:27 a.m. we became aware of unauthorized access to our server. Upon investigation, we learned that certain data from our server was subsequently locked due to the ransomware attack, the extent of which is that all files within the affected servers have been maliciously encrypted and have been renamed with a file extension. This data may include name and Tax Identification Numbers (TIN) of MTRCB personnel, contracted vendors and supplier’s business name.

At present, we have no indication that there has been unauthorized activity with respect to any user’s account on our website. We are not currently aware of evidence of access to any databases that host user data.

As a precaution, the Agency has strengthened its information security by implementing various and strict security measures, such as, the conduct of regular vulnerability assessments and the creation of projects that enhance the current security measure of the Agency.

We have already set up a MTRCB Data Action Response Center to provide assistance to those who may have been affected by the data breach in which information is access without authorization. For more information, contact the MTRCB Data Action Response Center at 8376-7380 loc. 115.

We apologize for, and deeply regret, any inconvenience this may cause. We take the security of information very seriously and appreciates everyone’s continued support.13

The National Privacy Commission (NPC), through its Enforcement Division (EnD), issued a Compliance Letter on 15 October 2021 and directed MTRCB to comply strictly with the Order dated 15 April 2021:

In your letter, you informed the Commission that you have posted a notice of a data breach on your website on May 12, 2021. However, this could not be considered as a valid form of notification absent prior approval of the NPC.

The Enforcement Division (EnD) reiterates that individual notification is the general rule. The Commission has repeatedly ordered MTRCB to individually notify the data subjects despite its prior request for alternative means of notification. Moreover, we would like to take this opportunity to remind you that it is the Personal Information Controller’s (PIC) responsibility to ensure that all data subjects are made aware of the breach.14

On 02 November 2021, MTRCB reported that the affected data subjects were already notified via email on 25 to 29 October 2021.15 MTRCB submitted a list of two hundred seventy-four (274) individuals and their notification status,16 and a list of two hundred ninety-nine (299) companies affected.17 MTRCB explained:

[F]rom the 274 affected individuals, the breakdown below shows the number of individuals notified, deceased and those not notified due to the unavailability of contact records from the Information Technology Unit, Human Resources Management Unit and Property and Supply Unit, to wit:

  • Emailed: 180 individuals
  • Deceased: 17 individuals
  • No Record: 77 individuals18

MTRCB also submitted copies of the email notification sent to the data subjects, which showed multiple recipients under the “Bcc:” field.19

On 28 January 2022, the EnD issued another Compliance Letter to the MTRCB.20 The EnD requested MTRCB to submit proof that it sent the notifications and that the affected data subjects received the same.21 As for the seventeen (17) deceased data subjects, the EnD requested that MTRCB notify their next of kin, if they can be ascertained from company records.22 The EnD further provided:

If MTRCB, even after diligent search, still renders it unable to determine the contact of a deceased data subject’s kin, it may seek approval of the Commission to use alternative means of communication in accordance with Section 18(D) of NPC Circular 16-03.

As it appears that 77 individuals were not notified due to the unavailability of contact records, MTRCB may likewise seek approval of the Commission to use alternative means of communication under Section 18(D) of NPC Circular 16-03.

We note that MTRCB has earlier posted a public notification of the breach through its website. However, individual notification of data subjects remains to be the general rule. Hence, prior approval of the Commission is required.23

Thus, the EnD directed the MTRCB to submit proof of receipt of notification of the data subjects and to notify the next of kin of the deceased data subjects pursuant to the transmissibility of rights of data subjects.24 The EnD also directed MTRCB to submit the results of an independent security audit.25

MTRCB submitted its Compliance to the Order dated 15 April 2021 with Motion for Extension of Time to comply with Directives and for Permission for Other Modes of Public Notification (Compliance with Motion) dated 14 February 2022.26 It reported that one hundred three (103) out of one hundred seventy-seven (177) individuals notified acknowledged receipt and it attached proof of the individual acknowledgments.27

MTRCB also reported that it found the contact information for the next of kin of one (1) deceased data subject, and that they had acknowledged receipt of the notification.28 MTRCB requested that the Commission grant the use of alternative means of notification:

  1. As the MTRCB further exerts diligent efforts to locate the parties, it appears the contact details of those who have not been notified as of yet, are those not contained in the records existing with the Board, and as thus, the MTRCB prays for the allowance of other modes of public notification by allowing the posting of the Notice in its website.29

MTRCB also explained that it could not submit the results of the independent security audit and requested for extension:

  1. In further compliance with the Order dated 15 April 2021, on 15 December 2021, the MTRCB entered into a Contract for the Conduct of Vulnerability Assessment and Penetration Testing of MIDAS with NEXT GENERATION TECHNOLOGIES GLOBAL, INC. (NEXT GENERATION) for NEXT GENERATION to conduct an independent audit into MTRCB’S systems;

  2. However, the testing has not been completed due to administrative and budgetary constraints. Thus, MTRCB humbly prays for an extension of until 31 July 2022, the expected end of contract, to comply with the directive to comply with the submission of the independent security audit. Should the audit be completed earlier, MTRCB endeavors to provide the results of the independent security audit to the Honorable Commission, immediately upon its receipt.30

Thus, MTRCB prayed for the following reliefs:

WHEREFORE, premises considered, the MTRCB respectfully prays from the Honorable Commission that:

  1. The submission on the 103 data subjects acknowledging receipt of Notice be NOTED as compliance to this Honorable Commission’s Order dated 15 April 2021;

  2. MTRCB be granted alternative means of public notice, by posting the notice in MTRCB’s website for the data subjects of which it has not located; and

  3. MTRCB’s be granted an additional three (3) months of time to allow NEXT GENERATION to finish the independent security audit;

Other reliefs just and equitable under the premises are likewise prayed for.31

On 23 June 2022, the EnD issued another Compliance Letter to the MTRCB.32 It found that the MTRCB provided proof of notification sent to only 103 out of 177 data subjects.33 Further, the EnD explained there was a “considerable amount of delay in MTRCB’s responsive action to prevent the likelihood of another breach from occurring since the breach incident occurred in September 2017.”34 As such, it directed MTRCB to comply with the following:

In view of the foregoing, you are hereby required to:

(1) SUBMIT proof of receipt of the remaining 74 out of the 177 individuals who were sent Notices within ten (10) days from receipt of this letter;

(2) SUBMIT a written explanation for the cause of delay of conducting the security audit with supporting documentary evidence within ten (10) days from receipt of this letter;

(3) SUBMIT a report on the results of the security audit within thirty (30) days from receipt of this letter.

We urge you to comply with this directive to avoid further liabilities in accordance with law.35

On 07 July 2022, the MTRCB responded to the EnD.36 MTRCB reported that fifty-four (54) more recipients sent their acknowledgment, bringing the total to one hundred fifty-seven (157) individuals notified37 and attached copies of the acknowledgement of receipt.38

MTRCB also reported that despite continuous efforts, it was unable to obtain confirmation from the remaining twenty (20) recipients.39 It submitted an Affidavit of the Head of MTRCB’s Information Technology Unit, which states that the Head of the IT Unit personally sent out the Notice of Data Breach to all the affected data subjects, including the remaining twenty (20) individuals.40

MTRCB explained that the delay in the conduct of the independent security audit was due to several factors: constraints in the approved budget for procurement;41 subsequent delays in bidding and procurement;42 the delayed release of the Notice of Award (NOA) and Notice to Proceed (NTP) dated 30 June 2021 to Next Generation;43 and the need to redo the bidding process under Section 38.1 of the Implementing Rules and Regulations of Republic Act No. 9184, or the Government Procurement Act.44 Nonetheless, MTRCB stated that the audit was eventually and successfully completed on 27 May 2022.45 It reported:

In the course of the audit, Next Generation identified the following areas of weakness that require the attention of the Board:

a. Remote Code Executions

b. SQL Injections

c. Cross Site Scripting

d. Insecure Communications

Next Generation likewise made recommendations on how to resolve the issues they identified and the MTRCB IT Unit is currently working to implement these recommendations, including the procurement of a web application firewall and Endpoint Detection and Security Solution within the year. Upon the Commission’s request, we will be glad to provide it a copy of the Report of the Final Vulnerability Assessment and Penetration Testing Report dated 27 May 2022 submitted by Next Generation which we have kept in confidence in light of the sensitive security matters contained therein.46

On 14 July 2022, the Commission issued an Order granting the MTRCB’s request for alternative means of notification.47 The Commission emphasized that what is important is that the email notification was sent and the data subject has access to the information contained in the notification, should he or she need it.48 As such, the remaining seventy-four (74) out of one hundred seventy-seven (177) data subjects who did not reply were still considered to have been sufficiently notified.49 The Commission also acknowledged the diligent and exhaustive efforts exerted by MTRCB to locate the parties and their next of kin.50 Given that MTRCB does not have their contact information, individual notification would be impossible.51 As such, the Commission granted the request for alternative means of notification for the remaining ninety-seven (97) data subjects whose contact details were missing or who were determined to be deceased.52

The Commission, however, denied MTRCB’s request for an extension to submit the results of the independent security audit.53 The Commission emphasized that PICs should comply with obligations they themselves undertake,54 and that “it was MTRCB that specified the date for extension, but it itself has not complied with its own deadline.”55

Thus, the Commission directed MTRCB to comply with the following:

WHEREFORE, premises considered, Movie and Television Review and Classification Board is hereby ORDERED within fifteen (15) days from the receipt of this Order to comply with the following:

(1) NOTIFY and SUBMIT to the Commission proof that it implemented notification through alternative means together with the text of the notification; and

(2) SUBMIT a report on the results of the independent security audit.

SO ORDERED.56

On 18 August 2022, the EnD issued another Compliance Letter to the MTRCB.57 The EnD directed the MTRCB to submit hardcopies of its letter dated 07 July 2022, the original or certified true copies of the letter’s annexes, and the Final Vulnerability Assessment and Penetration Testing Report dated 27 May 2022 prepared by Next Generation.58

On 31 August 2022, the MTRCB responded to the EnD’s Compliance Letter dated 18 August 2022.59 It submitted the hardcopy of its letter dated 07 July 2022, along with original or certified true copies of the annexes,60 a certified true copy of the Final Vulnerability Assessment and Penetration Testing Report dated 27 May 2022 by Next Generation,61 and the Affidavit by the Head of the Information Technology Unit of the MTRCB dated 07 July 2022.62

On 03 November 2022, MTRCB submitted its compliance with the Order dated 14 July 2022.63 MTRCB confirmed that the Notice of Breach on 19 September 2017 was posted on the advisory page of its website, https://midas.mtrcb.gov.ph/site/#!/advisories, and on its official Facebook page.64 To support this, MTRCB submitted a copy of the “Notice of Data Breach on 19 September 2017,”65 a screenshot of MTRCB’s advisory page where the Notice was posted,66 and a screenshot of MTRCB’s Facebook page.67 The notification states:

NOTICE OF DATA BREACH ON 19 SEPTEMBER 2017

Pursuant to the approval for alternative means of notification by the National Privacy Commission in its Order dated 17 July 2022, the Movie and Television Review and Classification Board (MTRCB) seeks to advice all affected parties of the Data Breach subject of this Notice.

On 19 September 2017, we became aware of an unauthorized access to our server. Upon investigation, we learned that a certain set of data from our server was locked due to a ransomware attack. The files within the data set were encrypted and renamed with a file extension. Said data may include the name and Tax Identification Number (TIN) of MTRCB personnel, as well as contracted vendors, and suppliers’ business names.

Of the two hundred seventy-four (274) user accounts affected, seventy-seven (77) were not notified because of lack of contact information.

To date, there is still no indication of any unauthorized activity in connection to the user accounts affected by the data breach. Be that as it may, we have applied stricter data security measures, including the conduct of a vulnerability assessment to enhance MTRCB’s data security.

We have tasked our MTRCB Data Action Response Center to aid those who believe they may have been affected by the data breach. If you have concerns or need for further information, kindly contact them at 8376-7380 loc. 115.

Again, we apologize for the inconvenience brought about by this incident.68

MTRCB also manifested that on 30 August 2022, it received the Compliance Letter dated 18 August 2022 from the EnD.69 MTRCB stated that it had filed its compliance on 31 August 2022. It also stated that the hard copy of its letter dated 07 July 2022 with original or certified true copies of the annexes and the Final Vulnerability Assessment and Penetration Testing Report dated 27 May 2022 were sent to and received by the Commission on 01 September 2022.70

MTRCB stated that “in the interest of limiting the exposure of the sensitive security matters contained in the Assessment,” it hoped this initial submission last 31 August 2022 satisfied the Commission’s directive in the Order dated 14 July 2022.71 MTRCB also submitted a copy of the EnD’s Compliance Letter dated 18 August 2022,72 a screenshot of EnD’s acknowledgment email dated 01 September 2022,73 and finally, a screenshot of LBC Track and Trace.74

Issue

Whether the MTRCB conducted proper breach notification and management in compliance with NPC Circular 16-03.

Discussion

MTRCB conducted proper breach management through notification of data subjects through individual and alternative means, and implementation of security measures. Thus, the Commission resolves to close the matter.

The notification of data subjects is an essential obligation of a Personal Information Controller (PIC).75 The purpose of notification is to provide data subjects with an opportunity to take the necessary precautions to protect their own data against the possible effects of the breach.76 As such, PICs are required to “establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach.”77

Section 18 (C) of NPC Circular 16-03 (Personal Data Breach Management) provides the required contents of proper notification of affected data subjects:

Section 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

[…]

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.78

The notification sent to the affected data subjects must contain sufficient information on the nature of the breach incident, the personal data involved, the measures taken by the PIC to address the breach and to reduce harm or negative consequences of the breach, and the assistance it extended to its affected data subjects.79

MTRCB complied with the contents of notification required under Section 18 (C) of NPC Circular 16-03. Both the Notice dated 12 May 202180 and the “Notice of Data Breach on 19 September 2017”81 narrated how the breach occurred through a ransomware attack and the information that was compromised, an explanation of the security measures taken by MTRCB to address the breach, and the contact number of its Data Action Response Center to enable the data subjects to obtain information and assistance. As such, both notifications, sent individually and through alternative means, enabled the affected data subjects to take measures to protect themselves from the consequences of the breach.

Further, Section 18 (D) of NPC Circular 16-03 provides the form of notification:

Section 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

[…]

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.82

The form of notification must be individual and must be made through secure means of communication, whether written or electronic.83 The PIC must provide the data subject the means to exercise their rights and obtain more detailed information relating to the breach.84

MTRCB properly notified the affected data subjects through individual and alternative means of notification.

MTRCB individually emailed a copy of the Notice dated 12 May 2021 to the affected data subjects.85 As proof, it attached a list of the two hundred seventy-four (274) data subjects’ notification status86 and copies of the individual email notifications it sent from 25 to 29 October 2021.87

In its Compliance with Motion dated 14 February 2022,88 MTRCB submitted proof that one hundred three (103) out of one hundred seventy-seven (177) individuals notified through email acknowledged receipt.89 Nonetheless, the EnD found that MTRCB’s individual notification complied with the Commission’s directive in the Compliance Order dated 31 January 2018:

The EnD finds that MTRCB has exerted diligent efforts and exhausted available means to ascertain in entirety the contacts of the affected data subject from the records of its Board Secretary, Human Resources Unit, and the Property and Supply Unit. It even searched for the contacts of the next of kin of the deceased data subjects.

To comply with EnD’s Compliance letter dated 23 June 2022, informing MTRCB of the need to comply with the Decision of the Commission, MTRCB sent a letter dated 07 July 2022 and reported to the Commission that fifty-four (54) out of the seventy-four (74) individuals sent with Notice of Data Breach acknowledged its email. The remaining twenty (20) has yet to acknowledge the email. To cure this lacking compliance, its IT Unit Head executed an affidavit with the attached acknowledgment receipt of the individuals who were sent notices attesting that she personally sent the email but has yet to receive the acknowledgment.90

In the Order dated 14 July 2022, the Commission considered MTRCB to have sufficiently individually notified all one hundred seventy-seven (177) affected individuals that were notified by email.91 The Commission held:

[T]he remaining seventy-four (74) data subjects, however, are still considered to have been sufficiently notified despite their lack of reply. The Circular on Personal Data Breach Management only mandates that the data subject be sufficiently informed and notified. Data subjects cannot be forced to respond to the notification, provided that proper notification is done. The obligation of the PIC to notify affected data subjects is fulfilled regardless of the data subject’s response to the notification. What is important is that the email notification was sent and the data subject has access to the information contained in the notification should he or she need it.92

Section 18 (D) of NPC Circular 16-03 provides that a PIC may seek the Commission’s approval to use alternative means of notification in lieu of individual notification in certain cases:

Section 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

[…]

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.93

In the Order dated 14 July 2022, the Commission granted MTRCB’s request for alternative means of notification.94 The Commission explained:

The Commission acknowledges the diligent efforts exerted by MTRCB by attempting to locate the parties and going through its Board Secretary, Human Resources Unit, and Property and Supply Unit records. Given, however, that it does not have the contact information of the remaining affected data subjects and the next of kin of deceased data subjects, the Commission notes that individual notification to the remaining unnotified ninety-seven (97) data subjects is impossible. As such, the Commission grants the MTRCB’s request for alternative means of notification for the remaining data subjects who have not been individually notified due to the unavailability of contact information despite its exhaustive efforts to locate them.95

Following this, MTRCB implemented notification through the use of alternative means provided in Section 18(D) of NPC Circular 16-03. It posted the “Notice of Data Breach on 19 September 2017” on the advisory page of its website, https://midas.mtrcb.gov.ph/site/#!/advisories,[^96] and on its official Facebook page.96 MTRCB attached screenshots of the posts to its compliance dated 03 November 2022 as proof.97

Further, the EnD found that the MTRCB implemented proper notification through alternative means in posting both the Notice of Data Breach (uploaded on 12 May 2021)98 and the “Notice of Data Breach on 19 September 2017”99 on its website:

Both notifications describe the nature of the breach, which the MTRCB depicts as unauthorized access to its server due to a ransomware attack. It further identified the personal data possibly involved, i.e., the name and Tax Identification Numbers (TIN) of MTRCB personnel, contracted vendors, and supplier’s business name. The second notification also provided measures taken by the MTRCB to address the breach such as strengthening its information security by implementing various and strict security measures, particularly the conduct of regular vulnerability assessments and the creation of projects that enhance the current security measure of the Agency. Lastly, the notification also informed the public that the MTRCB has set up the MTRCB Data Action Response Center to assist those who may have been affected by the data breach in which information is accessed without authorization.100

Thus, MTRCB properly notified the remaining ninety-seven (97) data subjects through the use of alternative means of notification.

Finally, MTRCB complied with the directive to submit the results of an independent security audit.

MTRCB manifested that the audit was eventually and successfully completed on 27 May 2022.101 It submitted its Final Vulnerability Assessment and Penetration Testing Report.102 When the Commission issued the Order dated 14 July 2022 directing the submission of the results of the independent security audit,103 MTRCB requested that the Commission consider its initial submission to the EnD as its compliance.104

The Commission considers MTRCB’s submission to the EnD as its compliance with the directive in the Order dated 14 July 2022.

In the course of the audit, Next Generation identified “areas of weakness” and issues that should be resolved by MTRCB.105 For its part, MTRCB manifested that its IT unit was working to implement these recommendations, “including procurement of a web application firewall and Endpoint Detection and Security Solution within the year.”106

The EnD also conducted its own assessment of the MTRCB website https://midas.mtrcb.gov.ph and found that it was “likely vulnerable to digital attacks.”107 The EnD reported that while these findings that are significant, “they do not pose as much of a threat as high or critical.”108 It recommended that MTRCB update its website to address existing vulnerabilities and conduct periodical vulnerability assessment to address its “Medium to Low” risk level.109

The EnD also verified that MTRCB complied with the Commission’s directives in Compliance Order dated 31 January 2018:

Based on a careful review of the orders issued by the Commission En Banc and the available documents on record, the Enforcement Division finds that MTRCB has complied with the following directives: (1) Appointment of a Data Protection Officer; (2) Creation of a Privacy Management Program based on risk assessment; (3) Implementation of appropriate organizational, physical and technical security measures in accordance with the provisions of NPC Circular No. 16-01 on Security of Personal Data in Government Agencies and Submission of a progress report within six (6) months from receipt of the order.110

Given the foregoing, the Commission finds that MTRCB conducted proper breach notification and management in compliance with Section 18 (C) and Section 18 (D) of NPC Circular 16-03.

Dispositive Portion

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 17-010 In re: Movie and Television Review and Classification Board is CLOSED.

SO ORDERED.

City of Pasay, Philippines.

13 July 2023.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

(on official leave)

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

Office of the Executive Director Movie and Television Review and Classification Board

ATTY. JSP Data Protection Officer Movie and Television Review and Classification Board

ATTY. CAN Legal Affairs Division Movie and Television Review and Classification Board

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Letter Re: Request for Exemption, Extension and Alternate means of Notification for Affected Data Subjects, 07 March 2018, at 1, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2018). ↩

  2. Id. ↩

  3. Order, 15 April 2021, at 7, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2021). ↩

  4. Id. at 6. ↩

  5. Id. ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. at 7. ↩

  9. Order, 15 April 2021, at 7, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2021). ↩

  10. Letter Re: Compliance to the National Privacy Commission (NPC) Order No. CID BN 17-010, 18 May 2021, at 1, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2021). ↩

  11. Id. ↩

  12. Id. ↩

  13. Id. Annex A. ↩

  14. Enforcement Division Letter Re: Compliance to the National Privacy Commission (NPC) Order No. CID BN 17-010 dated 15 April 2021, 15 October 2021, at 1, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2021). Emphasis supplied. ↩

  15. Letter Re: Compliance to National Privacy Commission Order No. CID BN 17-010 dated 15 April 2021, 02 November 2021, at 1, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2021). ↩

  16. Id. Annex A. ↩

  17. Id. Annex B. ↩

  18. Id. at 1. ↩

  19. Id. ↩

  20. Enforcement Division Letter Re: Compliance to the National Privacy Commission (NPC) Order No. CID BN 17-010 dated 15 April 2021, 28 January 2022, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  21. Id. at 1. ↩

  22. Id. at 2. ↩

  23. Id. ↩

  24. Id. ↩

  25. Id. at 2-3. ↩

  26. Compliance to the Order dated 15 April 2021 with Motion for Extension of Time to comply with Directives and for Permission for Other Modes of Public Notification, 14 February 2022, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  27. Id. Annex A-1 to A-103. ↩

  28. Id. at 2. ↩

  29. Id. ↩

  30. Id. Emphasis supplied. ↩

  31. Id. at 2. ↩

  32. Enforcement Division Letter Re: Compliance to the Order dated 15 April 2021 with Motion for Extension of Time to comply with Directives and for Permission for Other Modes of Public Notification, 14 February 2022, 23 June 2022, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  33. Id. at 1. ↩

  34. Compliance Letter from Enforcement Division, 23 June 2022, at 3, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  35. Id. ↩

  36. Letter Re: Compliance with National Privacy Commission (NPC) Order No. CID BN 17-010 dated 15 April 2021, 07 July 2022, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  37. Id. at 1-2. ↩

  38. Id. Annex A. ↩

  39. Id. at 2. ↩

  40. Id. Annex B. ↩

  41. Id. at 2. ↩

  42. Id. ↩

  43. Id. at 2-3. ↩

  44. Id. at 3. ↩

  45. Id. ↩

  46. Id. at 3-4. ↩

  47. Order, 14 July 2022, at 5, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  48. Id. at 6. ↩

  49. Id. at 9. ↩

  50. Id. at 7. ↩

  51. Id. ↩

  52. Id. ↩

  53. Order, 14 July 2022, at 5, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  54. Id. at 8. ↩

  55. Id. ↩

  56. Id. at 9. ↩

  57. Enforcement Division Letter Re: Compliance with National Privacy Commission (NPC) Order No. CID BN 17-010 dated 15 April 2021, 18 August 2022, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  58. Id. at 2. ↩

  59. Letter Re: Compliance with National Privacy Commission (NPC) Order No. CID BN 17-010 dated 15 April 2021, 31 August 2022, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  60. Id. Annex A. ↩

  61. Id. Annex B. ↩

  62. Id. Annex C. ↩

  63. Compliance, 03 November 2022, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  64. Letter Re: Compliance with National Privacy Commission (NPC) Order dated 14 July 2022 for NPC BN 17-010, 03 November 2022, at 1, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  65. Id. Annex A. ↩

  66. Id. Annex B. ↩

  67. Id. Annex A. ↩

  68. Id. ↩

  69. Id. ↩

  70. Id. at 2. ↩

  71. Id. ↩

  72. Id. Annex D. ↩

  73. Id. Annex E. ↩

  74. Id. Annex F. ↩

  75. NPC BN 21-035, 01 June 2021, at 4 (NPC 2021) (unreported). ↩

  76. National Privacy Commission, Personal Data Breach Management, Circular No. 03, Series of 2016 NPC Circ. No. 16-03, § 18 (D) (15 December 2016). ↩

  77. Id. ↩

  78. Id. § 18 (C). ↩

  79. NPC BN 18-198, 23 September 2021, at 4 (NPC 2021) (unreported). ↩

  80. Letter Re: Compliance to the National Privacy Commission (NPC) Order No. CID BN 17-010, 18 May 2021, at 1, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2021). ↩

  81. Compliance, 03 November 2022, Annex A, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  82. NPC Circ. No. 16-03, § 18 (D). Emphasis supplied. ↩

  83. Id. ↩

  84. Id. ↩

  85. Letter Re: Compliance to the National Privacy Commission (NPC) Order No. CID BN 17-010, 18 May 2021, at 1, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2021). ↩

  86. Id. Annex A. ↩

  87. Id. Annex C. ↩

  88. Compliance to the Order dated 15 April 2021 with Motion for Extension of Time to comply with Directives and for Permission for Other Modes of Public Notification, 14 February 2022, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  89. Id. Annex A-1 to A-103. ↩

  90. Final Enforcement Assessment Report, 23 November 2022, at 9-12, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  91. Order, 14 July 2022, at 6, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  92. Id. at 6. ↩

  93. NPC Circ. No. 16-03, § 18 (D). Emphasis supplied. ↩

  94. Order, 14 July 2022, at 7, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  95. Id. ↩

  96. Id. Annex A. ↩

  97. Id. ↩

  98. Letter Re: Compliance to the National Privacy Commission (NPC) Order No. CID BN 17-010, 18 May 2021, at 1, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2021). ↩

  99. Compliance, 03 November 2022, Annex A, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  100. Final Enforcement Assessment Report, at 9, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2017). ↩

  101. Letter Re: Compliance with National Privacy Commission (NPC) Order No. CID BN 17-010 dated 15 April 2021, 07 July 2022, at 3, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  102. Id. at 3. ↩

  103. Order, 14 July 2022, at 9, in In re: Movie and Television Review and Classification Board, NPC BN No. 17-010 (NPC 2022). ↩

  104. Letter Re: Compliance with National Privacy Commission (NPC) Order dated 14 July 2022 for NPC BN 17-010, 03 November 2022, at 2, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  105. Letter Re: Compliance with National Privacy Commission (NPC) Order No. CID BN 17-010 dated 15 April 2021, 07 July 2022, at 3, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2022). ↩

  106. Id. at 4. ↩

  107. Final Enforcement Assessment Report, at 12, in In re: Movie and Television Review and Classification Board, NPC BN 17-010 (NPC 2017). ↩

  108. Id. ↩

  109. Id. ↩

  110. Id. at 7-8. Emphasis supplied. ↩

Backlinks

  • No backlinks found