NPC Issuance Wiki

NPC BN 18-063: In re: Smart Communications, Inc.

Issued Resolution

Resolution Text

IN RE: SMART COMMUNICATIONS, INC.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before the Commission is a breach notification submitted by Smart Communications, Inc. (Smart) involving a Subscriber Application Form (SAF) of a Smart subscriber.

Facts

On 02 May 2018, Smart notified the National Privacy Commission (NPC) of a breach:

On 27 April 2018, the Smart and PLDT DPO Team received an SMS notification from one of its Relationship Manager (RM, for brevity), Ms. MCM, informing us of a possible data breach incident involving the Subscriber Application Form (SAF, for brevity) of a Smart subscriber employed with Puregold – MMO. In Ms. MCM’s attempts to secure applications from the other departments of Puregold and Officewarehouse, she e-mailed the subject SAF to 6 people belonging to a different department/division in Puregold and Officewarehouse. It has come to the data subject’s attention what Ms. MCM did and she immediately called her attention and told her of her privacy being violated due to the action done.1

In its breach notification, Smart stated that as soon as MCM reported the incident, it immediately contacted her to gather more information surrounding the incident.2 According to Smart, MCM, a Smart Relationship Manager, sent the Subscriber Application Form (SAF) containing MMO’s personal data to six (6) other employees of Puregold Price Club, Inc. (Puregold) and Office Warehouse, Inc. (Office Warehouse).3 Smart also stressed to MCM the importance of remediating the situation and the possible sanctions that might be meted out to her based on the Code of Discipline governing Smart and PLDT employees.4

Additionally, Smart stated in its data breach notification the remedial actions it took to address the breach.5 According to Smart, it focused on reducing the harm that may have been caused by the breach.6 Smart stated that it reached out to the affected data subject and to the persons who received copies of the SAF.7 Smart further stated that MCM started receiving confirmation from the email recipients on her request to delete the email and to refrain from making any further copies, saving, archiving, sharing, or disclosing the email.8 Smart added that it obtained confirmation from all recipients of the SAF by 02 May 2018.9

Smart, through its Data Privacy Office, reached out to the affected data subject so that it could address her concerns on the matter.10

To prevent recurrence of the incident, Smart stated that it would remind its Relationship Managers of its data privacy policies and that it would initiate information dissemination and training for all Smart and PLDT Relationship Managers.11 Smart also started investigating MCM to determine the extent of her liability, if any, under Smart’s Code of Discipline.12

On 04 May 2018, the NPC, through its Complaints and Investigation Division (CID), confirmed its receipt of the Data Breach Notification dated 30 April 2018.13

On 11 March 2022, the CID issued an Order dated 10 March 2022 requiring Smart to submit a full report on the incident and to attach documents for the investigation of the breach.14

On 25 March 2022, Smart submitted its compliance to the Order dated 10 March 2022.15 Smart attached its report,16 a sample of the SAF,17 a copy of the notification sent to the affected data subject18 and documentation of the remediation measures it took to address the breach.19 Smart added that there were no additional updates on the results of the investigation of the incident involving the SAF as the information gathered during the initial investigation was already complete.20

In its full report, Smart clarified that the incident occurred when its Relationship Manager sent the data subject’s accomplished SAF to six (6) employees of Puregold and Office Warehouse to encourage them to avail of the Smart Postpaid subscription.21 Smart further stated that on 27 April 2018, its Relationship Manager informed it of a possible breach.22 Smart added that on 02 May 2018, it submitted its breach notification to the NPC and notified the affected data subject.23

According to Smart, only one (1) data subject was affected and the personal data involved includes the affected data subject’s complete name, home address and phone number, business address and phone number, email address, mobile number, job title, age and date of birth.24 Smart also reiterated the measures it employed to address the breach.25

On 24 May 2023, the CID issued an Order requiring Smart to submit additional information and documentation, specifically:

  1. Proof of email receipt confirmation from all six (6) persons belonging to different departments or divisions of Puregold or Office Warehouse;
  2. Confirmation of the deletion and no-sharing or nondisclosure of the email containing personal data;
  3. The result of investigation on the offense or misconduct of its Relationship Manager, as well as proof of any sanction or disciplinary action taken against the latter.26

On 29 March 2023, Smart submitted its compliance to the Order dated 24 May 2023.27 Here, it attached the initial report that it received from the Head of Corporate Bid and Offer Management of PLDT Enterprise regarding the breach,28 screenshots of the SMS confirmation received from the recipients of the SAF,29 a copy of the referral sent by the DPO to MCM’s superiors30 and the email sent by MCM’s immediate superior where he discussed the disciplinary action taken against MCM.31

Issue

Whether Smart sufficiently addressed the breach and implemented security measures to prevent its recurrence.

Discussion

The Commission resolves to close the matter. Smart’s submissions show that it sufficiently addressed the breach and implemented security measures to prevent its recurrence.

Section 20 (a) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA) provides:

Section 20. Security of Personal Information. (a) The personal information controller must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.32

Section 17 (D) of NPC Circular 16-03 (Personal Data Breach Management) provides that a PIC has the obligation to notify the NPC of a personal data breach.33 Additionally, it outlines the contents of the notification, which includes the measures taken by the PIC to address the breach:

Section 17. Notification of the Commission. The personal information controller shall notify the Commission of a personal data breach subject to the following procedures:

…

D. Content of Notification. The notification shall include, but not be limited to:

…

  1. Measures Taken to Address the Breach a. description of the measures taken or proposed to be taken to address the breach; b. actions being taken to secure or recover the personal data that were compromised; c. actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident; d. action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification; e. the measures being taken to prevent a recurrence of the incident.34

Here, Smart notified the NPC of the breach through email and described the measures that it took to address the breach.35 In its subsequent submissions to the NPC, Smart substantiated the circumstances surrounding the breach, particularly its nature and the information possibly involved, and the measures it took to address the breach.36

Smart also notified the affected data subject.37 Smart formally notified the affected data subject of the breach on 02 May 2018.38 As proof of this, Smart submitted a copy of the letter notifying the affected data subject of the breach.39

To mitigate the possible harms or consequences arising from the breach, Smart contacted the persons who received the copies of the SAF from MCM and requested that they delete the copies of the SAF.40 Smart provided as proof screenshots of the SMS confirmation from the recipients of the email stating that they have deleted the SAF.41 As to the other recipients, Smart stated that they confirmed the deletion in a call with MCM.42

Additionally, Smart pointed out that it investigated the breach through its Data Privacy Office in order to confirm the facts reported to it by MCM.43 Smart also informed MCM’s immediate supervisor of the incident for proper action.44 Following the investigation, Smart took disciplinary action against MCM for her involvement in the breach.45 As stated in the email, MCM’s immediate supervisor reprimanded her in connection with the incident.46 He also discussed with her the consequences of her actions and reviewed the company’s policies on data privacy.47

As part of the measures taken to prevent a recurrence of the breach, Smart prepared and disseminated infographics to its employees to remind them of its privacy and data protection policies.48 It created and sent out to its employees several data privacy learning materials in the form of a web series to provide a reminder of the company’s privacy and data protection policies.49 Smart provided documentation of the PLDT Group e-learning program.50 The documentation submitted by Smart included screenshots of the e-learning initiative for its employees, which focused on data privacy and information security.51

Considering the foregoing, Smart sufficiently addressed the breach and implemented security measures to prevent its recurrence.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-063 In re: Smart Communications, Inc. is CLOSED.

SO ORDERED.

City of Pasay, Philippines.

17 October 2024.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

LBJ Data Protection Officer Smart Communications, Inc.

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Data Breach Notification, 30 April 2018, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2018). ↩

  2. Id. at 1. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. at 2. ↩

  6. Id. ↩

  7. Data Breach Notification, 30 April 2018, at 2, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2018). ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Email, 04 May 2018, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2018). ↩

  14. Order, 10 March 2022, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2022). ↩

  15. Letter, 24 March 2022, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2022). ↩

  16. Id. Annex A. ↩

  17. Id. Annex B. ↩

  18. Id. Annex C. ↩

  19. Id. Annex D. ↩

  20. Id. at 1. ↩

  21. Letter, 24 March 2022, Annex A, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2022). ↩

  22. Id. ↩

  23. Id. ↩

  24. Id. ↩

  25. Id. ↩

  26. Order, 24 May 2023, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2023). ↩

  27. Letter, 29 May 2023, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2023). ↩

  28. Id. Annex A. ↩

  29. Id. Annex B. ↩

  30. Id. Annex C. ↩

  31. Id. Annex D. ↩

  32. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 20 (a) (2012). ↩

  33. National Privacy Commission, Personal Data Breach Management, Circular No. 03, Series of 2016 (NPC Circ. No. 16-03), § 17 (D) (15 December 2016). ↩

  34. Id. § 11. ↩

  35. Email, 2 May 2018, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2018). ↩

  36. Letter, 24 March 2022, Annex A, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2022). ↩

  37. Data Breach Notification, 30 April 2018, at 2, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2018). ↩

  38. Letter, 24 March 2022, Annex A, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2022). ↩

  39. Id. Annex C. ↩

  40. Data Breach Notification, 30 April 2018, at 2, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2018). ↩

  41. Letter, 29 May 2023, Annex B, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2023). ↩

  42. Id. at 1. ↩

  43. Letter, 24 March 2022, Annex A, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2022). ↩

  44. Id. ↩

  45. Id. ↩

  46. Letter, 29 May 2023, Annex D, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2023). ↩

  47. Id. ↩

  48. Letter, 24 March 2022, Annex A, in In re: Smart Communications, Inc., NPC BN 18-063 (NPC 2022). ↩

  49. Id. ↩

  50. Id. Annex D. ↩

  51. Id. ↩

Backlinks

  • No backlinks found