Resolution Text
IN RE: PROFESSIONAL REGULATION COMMISSION
x---------------------------------------------------------x
NAGA, D.P.C.:
This Resolution refers to the data breach notification that the Commission received dated 25 May 2018 from the Professional Regulation Commission (PRC) in relation to a social media post of a citizen questioning the data privacy compliance and practice of said agency.
Facts
On 07 May 2018, a certain citizen posted on his social media account a redacted photo questioning the data privacy compliance of PRC and other government agencies. According to the post, the PRC’s logbook has fields that require the name and PRC license number of its guest.
On 09 May 2018, PRC’s Data Protection Officer (DPO) reported the incident to the Complaints and Investigation Division (CID). The CID then requested PRC to submit a full breach report.
After a considerable delay and upon CID’s follow-up, on 19 May 2020, PRC’s new DPO submitted a letter stating that there was no data breach since no personal data was divulged in the post of the citizen and that no evidence was presented or submitted to prove that any unauthorized disclosure has occurred. Further, PRC also stated that upon the inquiry of their DPO with its different offices, the logbook described in the social media post is not in the possession of any of the offices nor such logbook can be found within the premises of the PRC.
On 08 July 2020, the CID submitted the case to the Commission for its resolution.
Discussion
Personal data refers to all types of personal information. Under the Data Privacy Act (DPA), it is divided into two major categories, namely: Personal Information1 and Sensitive Personal Information2.
On the other hand, Personal data breach is defined in the DPA Implementing Rules and Regulations (IRR) as, “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.”3
Given the above definitions, it can be deduced that no personal information was accidentally and unlawfully disclosed in the social media post of the citizen. The post contains a redacted photo of an alleged PRC logbook that has data fields on Registration No., Profession, and Name.4 No other personal information was disclosed other than the name of the citizen that posted said redacted photo.
On the concern regarding PRC and other government agencies logbook policies, while it is true that the logbook policy of every agency of the government should abide by the general data privacy principles of transparency, legitimate purpose, and proportionality5; the concerned citizen failed to substantiate his general claim that the PRC violated the DPA.
Section 22 of NPC Circular 16-04 or The Rules of Procedure of the National Privacy Commission provides that the Commission shall adjudicate the issues raised in the complaint on the basis of all the evidence presented and its own consideration of the law. Hence, this Commission gives greater weight to PRC’s statement that the logbook described in the social media post has not been in the possession or custody of any of its office over the bare allegations of the citizen in his social media post.
WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN No. 18-069 “In re: Professional Regulation Commission” is considered CLOSED.
SO ORDERED.
Pasay City, Philippines 23 July 2020.
JOHN HENRY D. NAGA Deputy Privacy Commission
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commission
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
Copy furnished:
HCS Data Protection Officer
ENFORCEMENT DIVISION COMPLAINTS AND INVESTIGATION DIVISION GENERAL RECORDS UNIT
Footnotes
-
Section 2 (g) Personal information refers to any information whether recorded in a material form or not, from which the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual. ↩
-
Section 2 (l) Sensitive personal information refers to personal information: (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations; (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings; (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and (4) Specifically established by an executive order or an act of Congress to be kept classified. ↩
-
Attachment in the 08 May 2020 letter of the PRC to the CID ↩
-
Section 18 of the DPA IRR in relation to Section 11 of the DPA. ↩