NPC Issuance Wiki

NPC BN 18-046: In re: City Government of Iloilo – Internal Audit Services

Issued Resolution

Resolution Text

IN RE: CITY GOVERNMENT OF ILOILO – INTERNAL AUDIT SERVICES

x----------------------------------------------------x

Deputy Privacy Commissioner Leandro Angelo Y. Aguirre

Before the Commission is the breach notification submitted by the City Government of Iloilo – Internal Audit Services (City of Iloilo) relating to the hacking of its website (iloilocity.gov.ph) resulting in the leakage of information on its Taxpayers Dashboard Services (TDS).

Facts

On 16 March 2018, FTC, head of the Information Systems Office (ISO) of the City of Iloilo, discovered that the City’s website was hacked, and information included in the TDS was posted on a Facebook page known as “Iloilo Blackhats.”1 FTC then took down the website immediately.2

On 19 March 2018, FTC reported the incident to the Philippine National Police – Anti-Cybercrime Group (PNP-ACG) Visayas Field Unit.3

On 11 April 2018, the City of Iloilo notified the National Privacy Commission (NPC) of the breach.4

The City of Iloilo reported that one hundred thirty-one (131) businesses utilized the TDS for their Online Business Permits Renewal Process for the Calendar Year (CY) 2018.5

The TDS contains taxpayers’ information specifically their account numbers, business names, business addresses, contact persons/representatives, genders, e-mail addresses, contact numbers, gross sales/receipts per month for CY 2017, and lines of business.6

On 25 October 2018, the NPC, through the Complaints and Investigation Division (CID), invited the City of Iloilo’s City Government Department Head II who was the designated Data Protection Officer (DPO), for a meeting on 03 December 2018 to discuss the breach incident.7

On 19 October 2021, the NPC, through the CID, required the City of Iloilo to submit a Post Breach Report containing:

  1. Results of the investigation conducted by the Internal Audit Services of Iloilo City as well as the PNP Anti-Cyber Crime Group;

  2. Proof of notification conducted on the affected data subjects;

  3. Documentation on the security measures conducted before, during, and after the incident; and

  4. Remedial measures undertaken to address the incident and prevent its recurrence.8

On 08 November 2021, the City of Iloilo filed a Motion for Additional Time to Submit the Post-Breach Report for the following reasons: (1) change in DPO, (2) physical transfer of the Office of the Internal Audit Services which resulted to the difficulty of locating most of the documents on the matter, (3) another case load of the DPO.9

On 09 November 2021, the NPC granted the Motion.10

On 11 November 2021, the City of Iloilo submitted its Compliance.11

The City of Iloilo reported that there were one hundred thirty-one (131) business establishments affected by the hacking of the website: “sixty-one (61) were corporations, one (1) was a cooperative, sixty-five (65) were sole proprietorships, two (2) were partnerships, and two (2) were only test data.”12

The City of Iloilo explained that the PNP-ACG discovered that the Iloilo Blackhats also posted about the hacked websites of West Visayas State University and Central Philippine University13 and that in all of these instances, the PNP-ACG was unable to identify the perpetrator.14

As an immediate measure, the City of Iloilo temporarily shut down the website “to safeguard the other information posted and for the PNP to take control and continue their probe.”15

The City of Iloilo reported that passwords for the website are already encrypted and it has adopted “different levels of security” on its other online platforms.16

It also procured licensed operating systems (OS) “to prevent the easy invasion of the unit itself.”17 When it comes to transfer of data within the department, the City of Iloilo also advised employees to utilize the Local Area Network (LAN) or e-mail or as long as transfer is not made through external drive or universal serial bus (USB).18

On 31 January 2022, the CID ordered the City of Iloilo to submit a report containing the proper documentation of the actions already taken.19

On 17 February 2022, the City of Iloilo submitted its Compliance.20

The City of Iloilo added that the TDS has a “dedicated firewall in place” and it can only be accessed by authorized personnel of the City of Iloilo.21 It emphasized that upon knowledge of the incident, it promptly disabled online access to the TDS.22 The City of Iloilo attached proof of its allegations to the Compliance.23

Based on the CID’s assessment dated 11 January 2023, the City of Iloilo implemented appropriate security measures to address the incident.24

Issue

Whether the City of Iloilo conducted proper breach management, including the implementation of reasonable and appropriate security measures pursuant to NPC Circular 16-03 (Personal Data Breach Management).

Discussion

The Commission finds that the City of Iloilo conducted proper breach management and implemented reasonable and appropriate security measures in addressing the breach. Thus, the Commission resolves to close the case.

Section 17(D)(3) of NPC Circular 16-03 provides the obligation of a Personal Information Controller (PIC) to notify the Commission of a personal data breach.25 It provides the content of notification specifically the measures that a PIC must take to address the breach:

Section 17. Notification of the Commission. The personal information controller shall notify the Commission of a personal data breach subject to the following procedures:

…

D. Content of Notification. The notification shall include, but not be limited to:

…

  1. Measures Taken to Address the Breach

A. description of the measures taken or proposed to be taken to address the breach;

B. actions being taken to secure or recover the personal data that were compromised;

C. actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident;

D. action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification;

E. the measures being taken to prevent a recurrence of the incident.26

Based on the records, the City of Iloilo implemented security and subsequent measures to ensure that the risk of harm will not materialize.

As an immediate measure, the City of Iloilo reported the incident to the PNP-ACG and a blotter was made.27 Temporarily, the TDS and the official website were shut down and the City of Iloilo utilized the Bulletin Board Service (BBS).28

According to the City of Iloilo, the National Bureau of Investigation (NBI), together with its Information Technology Specialist, assisted its ISO in conducting a system audit to “locate the whereabouts of the perpetrator.”29

It sought the assistance of the Department of Information and Communication Technology (DICT) in “identifying the system’s security flaws and ensuring that the system adheres to security standards.”30

To prevent the recurrence of the breach, the City of Iloilo utilized “security tokens” for each user to facilitate access to the website.31

As an organizational measure, the City of Iloilo advised its employees to use the LAN or e-mail when transferring files or data.32

The City of Iloilo procured licensed OS to prevent infiltration of data.33

It reported that passwords are already encrypted and adopted “different levels of security” in its online service platforms.34

The security incident also prompted the City of Iloilo to improve its security infrastructure.35 It stated that “web monitoring services and anti-denial of service” were implemented in every online service.”36

Further, the City of Iloilo stressed that the TDS has a “dedicated firewall in place” and access is limited to authorized personnel of the City of Iloilo.37 It also disabled online access to the TDS and “checked its readiness before it was put back online.”38

The City of Iloilo recounted that among the one hundred thirty-one (131) registrants of the TDS: “sixty-one (61) were corporations, one (1) was a cooperative, sixty-five (65) were sole proprietorships, two (2) were partnerships, and two (2) were merely test data.”39

Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA) protects the processing of personal data of an individual or natural person.40

Given this, the information relating to a juridical entity does not constitute personal data.

Here, since most of the information possibly leaked from the website were information on juridical entities, the City of Iloilo is not mandated to notify these affected entities.

Nonetheless, the City of Iloilo is reminded of its obligation to continuously update its security measures and ensure that it will be in a position to safeguard the personal data of its constituents.

Based on the foregoing, the measures that the City of Iloilo took after the incident enabled it to strengthen its security measures in compliance with the DPA and its Implementing Rules and Regulations (IRR).41 Given this, following NPC Circular 16-03, the actions that the City of Iloilo took are sufficient to close the matter.

Dispositive Portion

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-046 In re: City Government of Iloilo – Internal Audit Services is considered CLOSED.

SO ORDERED.

City of Pasay, Philippines.

17 August 2023.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

ATTY. FGG City Legal Officer III/Data Protection Officer City Government of Iloilo – Internal Audit Services

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Notification to the Commission, 11 April 2018, at 1, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2018). ↩

  2. Post-Breach Report, 11 November 2021, at 1, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2021). ↩

  3. Id. Annex D. ↩

  4. Notification to the Commission, 11 April 2018, at 1, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2018). ↩

  5. Id. ↩

  6. Id. ↩

  7. Breach Notification of the Office of the Internal Audit Services of the City of Iloilo, 25 October 2018, at 1, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2018). ↩

  8. Order, 19 October 2021, at 1, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2021). ↩

  9. Motion for Additional Time (To Submit the Post-Breach Report), 08 November 2021, at 1, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2021). ↩

  10. Resolution (of the Motion for Extension of Time dated 08 November 2021), 09 November 2021, at 1, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2021). ↩

  11. Post-Breach Report, 11 November 2021, at 1, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2021). ↩

  12. Id. at 6. ↩

  13. Id. at 2. ↩

  14. Id. ↩

  15. Breach Notification of the Office of the Internal Audit Services of the City of Iloilo, 25 October 2018, at 1, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2018). ↩

  16. Post-Breach Report, 11 November 2021, at 3, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2021). ↩

  17. Id. ↩

  18. Id. ↩

  19. Order (To submit supporting documents/proof), 31 January 2022, at 1, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2022). ↩

  20. Compliance, 17 February 2022, at 1, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2022). ↩

  21. Id. ↩

  22. Id. ↩

  23. Post-Breach Report, 11 November 2021, annexes I-R, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2021). ↩

  24. Final Breach Notification Evaluation Report, 11 January 2023, at 7, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2023). ↩

  25. National Privacy Commission, Personal Data Breach Management, Circular No. 3, Series of 2016 NPC Circ. No. 16-03, § 17(D)(3) (15 December 2016). ↩

  26. Id. ↩

  27. Post-Breach Report, 11 November 2021, annex N, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2021). ↩

  28. Id. at 5. ↩

  29. Id. Annex N. ↩

  30. Id. at 5. ↩

  31. Id. ↩

  32. Id. ↩

  33. Post-Breach Report, 11 November 2021, at 3, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2021). ↩

  34. Id. ↩

  35. Id. Annex N. ↩

  36. Id. ↩

  37. Compliance, 17 February 2022, at 1, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2022). ↩

  38. Id. ↩

  39. Post-Breach Report, 11 November 2021, annex O, in In re: City Government of Iloilo – Internal Audit Services, NPC BN 18-046 (NPC 2021). ↩

  40. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 4 (2012). ↩

  41. See National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule VI, § 25 (2016). ↩

Backlinks

  • No backlinks found