NPC Issuance Wiki

NPC BN 18-115: In re: I-Remit, Inc.

Issued Resolution

Resolution Text

IN RE: I-REMIT INC.

x----------------------------------------------------x

AGUIRRE, D.P.C.:

Before the Commission is the breach notification submitted by I-Remit, Inc. (I-Remit) involving the disclosure of personal information of its employees to the entire company.

Facts

On 21 June 2018, a member of I-Remit’s Human Resources (HR) department accidentally emailed an attachment containing I-Remit’s employees’ personal information to the whole organization.1 The HR staff intended to send the e-mail only to the members of the HR team.2

The personal information involved the employees’ Tax Identification Number (TIN), Social Security System (SSS), and Pag-IBIG number.3 It also included their emergency contact number, educational background, birthday, address, civil status, and work experience.4

Upon realizing the mistake, the HR member immediately clicked the “RECALL” button on Microsoft Outlook, which cancelled the sending of the email.5

On the same day, I-Remit’s Data Protection Officer (DPO) held an emergency meeting with the Information Technology (IT) Team.6 The IT Team reported that all computers have been cleared of any copies of the attachment.7

Two advisories relating to the incident were immediately sent to the employees of I-Remit.8 The first advisory was from their DPO with instructions to immediately delete the email should they receive a copy.9 The DPO emphasized that failure to comply with the advisory will result in severe disciplinary action and possible criminal liability.10 The HR Head sent the second advisory reminding the employees to acknowledge and comply with the DPO’s prior advisory or face disciplinary action.11

On 4 July 2018, I-Remit notified the Commission of the breach.12 I-Remit submitted an Incident Report stating that one hundred fifty-three (153) out of one hundred eighty-six (186) supposed recipients received the email.13

On 08 October 2020, the Complaints and Investigation Division (CID) issued an Order requiring I-Remit to submit a Full Breach Report detailing the incident.14

On 23 October 2020, I-Remit submitted its Full Breach Report in compliance with the CID’s Order.15

On 18 January 2022, the CID directed I-Remit to submit a Post-Breach Report detailing the incident that prompted the notification to the

Commission. I-Remit was required by the Commission to provide the following:

  1. An enumeration of the personal information involved in the attachments (e.g. name, address, cellphone no. etc.);
  2. Documentation and proof of the remedial and security measures taken in response to the privacy incident, including the recall and/or deletion of the said mail;
  3. Documentation and proof that no further processing was made by the actual recipients of the email;
  4. Outcome of the breach management, and the difficulties encountered, if any, as well as the compliance with the notification requirements as to the affected data subjects, and the assistance provided, if any;
  5. Documentation/Reports as to the security measures taken before, during, and after the security incident, and the remedial measures taken to prevent its recurrence.16

In Compliance with the 18 January 2022 Order, I-Remit sent an email to the CID on 31 January 2022 reiterating the contents of their Full Breach Report dated 23 October 2020.17

On 04 February 2022, I-Remit re-sent a copy of the Full Breach Report it submitted on 23 October 2020.18

Based on the CID’s assessment dated 12 October 2022, I-Remit implemented reasonable and appropriate measures to address the incident.19

Issue

Whether I-Remit conducted proper breach management, including the implementation of reasonable and appropriate security measures pursuant to NPC Circular 16-03 (Personal Data Breach Management).

Discussion

The Commission finds that I-Remit conducted proper breach management and implemented reasonable and appropriate security measures in addressing the breach. The Commission resolves to close the case.

I-Remit enumerated in its submissions the measures it took to address the breach following Section 17 (D) (3) of NPC Circular 16-03:

Section 17. Notification of the Commission. The personal information controller shall notify the Commission of a personal data breach subject to the following procedures:

D. Content of Notification. The notification shall include, but not be limited to:

  1. Measures Taken to Address the Breach a. description of the measures taken or proposed to be taken to address the breach; b. actions being taken to secure or recover the personal data that were compromised; c. actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident; d. action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification; e. the measures being taken to prevent a recurrence of the incident.20

I-Remit narrated that, as an immediate measure, its DPO held an emergency meeting with their IT team to immediately and manually inspect all computers to “ensure that no copies (of the e-mail) were made.”21 I-Remit also maintained that its IT Team checked all computers and deleted copies of the email, including those from

“Junk and Recycle Bin” to ensure that no copies of the email and its attachment were kept or downloaded by unintended recipients.22 I-Remit also emphasized that because of the urgent action of “hitting the recall button” by its HR employee, the IT Team reported that the email could not be opened anymore and that some of the employees could not open the e-mail to begin with.23 I-Remit also provided proof and documentation that no further processing was made by the actual recipients of the email by attaching a screenshot of the e-mail sent by its Information Security Officer.24 Employees were likewise required to acknowledge if they have complied with the instructions.25

Its HR department and DPO also immediately sent advisories to the employees to delete the email should they receive a copy. The advisory from HR emphasized that “failure to follow such directive will result in severe disciplinary action and possible criminal liability.”26

In its efforts to prevent a recurrence of the breach, I-Remit also implemented physical, organizational, and technical security measures.27

As a physical measure, I-Remit explained that in order to minimize possible harm or negative consequences and to limit damage or distress to those affected by the incident, it reinforced its “Data Privacy Manual” which it already had in place prior to the incident.28 A copy of the Data Privacy Manual was attached to I-Remit’s Post-Breach Report.29

As an organizational measure, I-Remit conducts regular training of its employees on personal data security and privacy awareness.30 Further, I-Remit reported that advisories and infographics on

22 Id. 23 Report ,23 Octo ber 2020, at 3,in In re: I-Remi t, Inc. ,NPC B N18 -11 5(NPC 20 18) . 24 Id .Annex B -1. 25 Id .Annex E . 26 Id.An nex B. 27 Id. at 4. 28 Id. at 2. 29 Report ,23October 202 0, inIn re: I-Remi t, Inc. ,NPC BN 18 -11 5(NPC 20 18) , Annex A. information security with topics such as “juice jacking” or “phishing e-mails” and data privacy awareness materials are regularly sent to its employees by email.31

I-Remit also emphasized that it implemented the following relevant policies in support of its objective to avoid personal breaches, namely: “(i) Email Policy, (ii) Systems Usage Policy & Information Security Guidelines, and (iii) the Employee Hand Book (with Confidentiality Provisions).”32 These policies are reviewed regularly and updated when necessary.33

I-Remit launched a data safety campaign entitled “Think Before You Click” to ensure that such technical accidents will not happen again.34

As a technical measure, I-Remit issued an advisory among its employees when sending emails and attachments.35 I-Remit introduced encryption and password protection and provided instructions when sending files among the organization through Microsoft Word, Excel, and PowerPoint.36 In the same instructional e-mail, I-Remit emphasized to “(a) use strong passwords, (b) always confirm the identity of the recipient before releasing the passwords, (c) never send out passwords in the same e-mail as the protected files/s, and (d) inform recipients of passwords either in a separate email, face to face or by telephone.”37 I-Remit also emphasized that after inserting the proper attachments, one must be extra careful that the messages should not go to the wrong recipients.38

Based on the foregoing, the measures that I-Remit took after the incident enabled it to strengthen its security measures in compliance with the DPA and the Commission’s issuances. Therefore, pursuant to NPC Circular 16-03, the actions taken by I-Remit are sufficient in closing the case.39

As a Personal Information Controller (PIC), I-Remit is reminded of its obligation to continuously update its security measures and ensure that it will be in a position to safeguard the personal and sensitive personal information of its data subjects.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-115 In re: I-Remit, Inc. is CLOSED.

SO ORDERED.

City of Pasay, Philippines. 26 January 2023.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

DLA Information Security Officer/Data Protection Officer I-Remit, Inc.

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Notification to the Commission, 04 July 2018, at 2, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Report, 23 October 2020, at 2, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  7. Notification to the Commission, 04 July 2018, at 2, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  8. Report, 23 October 2020, at 4, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  9. Id. Annex B. ↩

  10. Id. ↩

  11. Id. Annex B-1. ↩

  12. Notification to the Commission, 04 July 2018, at 2, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  13. Id. ↩

  14. Order, 08 October 2020, at 1, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  15. Report, 23 October 2020, at 2, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  16. Order To Submit Post-Breach Report, 18 January 2022, at 1, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  17. Report, 31 January 2022, at 1, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  18. Compliance, 04 February 2022 at 1, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  19. Final Breach Notification Evaluation Report, 12 October 2022, at 6, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  20. National Privacy Commission, Personal Data Breach Management, Circular No. 3, Series of 2016 [NPC Circ. No. 16-03], §17 (D)(3) (15 December 2016). ↩

  21. Report, 23 October 2020, at 3, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  22. Id. ↩

  23. Report, 23 October 2020, at 3, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  24. Id. Annex B-1. ↩

  25. Id. Annex E. ↩

  26. Id. Annex B. ↩

  27. Id. at 4. ↩

  28. Id. at 2. ↩

  29. Report, 23 October 2020, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018), Annex A. ↩

  30. Id. at 4. ↩

  31. Id. Annex F and H. ↩

  32. Report, 23 October 2020, at 4, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  33. Id. ↩

  34. Id. at 3. ↩

  35. Id. Annex C. ↩

  36. Id. ↩

  37. Id. ↩

  38. Report, 23 October 2020, at 4, in In re: I-Remit, Inc., NPC BN 18-115 (NPC 2018). ↩

  39. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule VI, § 25 (2016). ↩

Backlinks

  • No backlinks found