NPC Issuance Wiki

NPC BN 18-135: In re: KGJS Fleet Management Manila Inc.

Issued Resolution

Resolution Text

IN RE: KGJS FLEET MANAGEMENT MANILA, INC.

x----------------------------------------------------x

AGUIRRE, D.P.C.:

Before the Commission is KGJS Fleet Management Manila, Inc.’s (KGJS) breach notification involving the reposting of the contents of its website to another website resulting in the disclosure of personal information of its employees.

Facts

On 20 July 2018, a KGJS employee reported that it received a text message on his company-issued mobile phone about an inquiry for a job opening.1 According to the job applicant, he/she obtained the information on the job opening, which includes the employees’ personal information, from www.Indeed.com (Indeed), a website for job listings.2

KGJS narrated that the personal information of its employees can be accessed on Indeed using the keyword “kgjs” on the website’s search feature.3 KGJS deduced that the personal information came from its own website and other possible website sources such as Philippine Overseas Employment’s (POEA) website.4

KGJS clarified that there was no agreement between KGJS and Indeed about the re-posting of its website content.5 Further, its employees have no knowledge of authorizing Indeed to post information related to job openings.6

On 23 July 2018, the employee received another call from the same mobile number inquiring about a sea-based job opening posted on Indeed.7 The employee reported this matter to his manager and to KGJS’ Data Protection Officer (DPO).8 The DPO then conveyed the same information to the Data Breach Response Team.9

On 24 July 2018, KGJS notified the National Privacy Commission (NPC) of the incident involving the personal information of its employees.10

KGJS explained that a total of four (4) of its employees were affected by the re-posting on Indeed’s website.11 Two (2) of the employees’ information such as their full name, designation, company direct line, and company mobile number were listed directly on its company website.12 Two (2) other employees’ information such as company mobile numbers, a “wrong” email address of an employee, and their full names as official representatives of KGJS, according to KGJS, were possibly obtained from the POEA website.13

KGJS indicated that this information was publicly posted on its website to serve as contact persons for inquiries on crew requirements or sea-based job openings.14

KGJS averred that the posting of its employees’ personal information on Indeed may “result to identity theft and unauthorized transfer and re-posting of web content/article.”15 KGJS also stated that there might be “possible misinterpretation” of the its job posting or “possible misinformation” between the employee and the applicants.16 Lastly, KGJS reasoned that “applicants who are web visitors and users of Indeed may presume that the job posting is legitimate and may result to unauthorized collection of personal information and resume.”17

On 27 July 2018, KGJS updated the NPC on its breach notification.18 KGJS explained that it removed the affected employees’ personal information from its company website on 24 July 2018.19 It also sent an email notification to the affected employees about the incident.20 Indeed also removed the job posting as confirmed through an email sent on 26 July 2018.21

On 30 July 2018, KGJS submitted a Full Report22 where it claimed that there was “no database breach”23 and no sensitive personal information was involved.24

KGJS reported that its employees’ personal data posted in the POEA website has already been corrected and updated.25 KGJS also reported that it also submitted a letter of information to POEA regarding the incident.26

KGJS also “de-indexed” and removed the personal data on its website to reduce the risk of “indexed searching” and to prevent the recurrence of the incident,27 It also conducted a Privacy Impact Assessment (PIA) of its website.28

Issue

Whether KGJS sufficiently addressed the incident and implemented security measures to prevent its recurrence.

Discussion

The Commission resolves to close the matter. KGJS implemented reasonable and appropriate security measures to address the incident. Nonetheless, the incident does not amount to a personal data breach.

Section 3 (F) of NPC Circular 16-03 (Personal Data Breach Management) defines a personal data breach:

Section 3. Definition of Terms. For the purpose of this Circular, the following terms are defined, as follows:

…

F. “Personal Data Breach” refers to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to, personal data transmitted, stored, or otherwise processed. It may be in the nature of:

  1. An availability breach resulting from loss, accidental, or unlawful destruction of personal data;
  2. Integrity breach resulting from alteration of personal data; and/or
  3. A confidentiality breach resulting from the unauthorized disclose of or access to personal data.29

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access to personal data transmitted, stored, or otherwise processed.30

In this case, the website Indeed is a metasearch engine that consolidates job listings from websites and recruiting companies.31

Indeed provides job seekers access to job listings and allows them to post resumes and research companies.32

When a user searches for job listings on Indeed, one can see job listings that Indeed scans from the internet and collates into a user’s search results.33

When a user clicks the “Apply on company site” button, Indeed will send the user’s job application to the employer’s applicant tracking system (ATS).34 The ATS is a software that employers use during the recruitment and hiring process to streamline the hiring process.35

Indeed explained that if a user applies directly on the company’s website, the user will not receive any communication from Indeed about his or her application status.36 The employer may communicate with the applicant through its own hiring platform, or through email.37

Considering that the purpose of posting job openings on Indeed is to maximize visibility and attract as many potential candidates as possible, the information of the KGJS employees or recruiters that were posted on Indeed would have been used in a way that was still consistent with the original purpose for posting it on KGJS’s website.

KGJS’ reasoning that the posting on Indeed may result to “identity theft and unauthorized transfer” and “unauthorized collection of personal information and resume”38 is speculative. Through the ATS, it is the recruiting company itself that handles the collection of any applicant information and not Indeed.

As stated by KGJS, Indeed possibly obtained the information of the employees from the KGJS and POEA website.39 These websites are accessible to the public particularly for the purpose of recruitment and placement through a manning agency.40

Given these reasons, the incident cannot be considered a confidentiality breach resulting from the unauthorized disclosure of or access to personal data. There is no unauthorized access to the systems maintained and managed by KGJS nor was there any breach of security protecting the personal data processing system of KGJS.

Additionally, the details of the personal data of the recruitment officers of KGJS, such as names and designation, are publicly and readily available.41 In addition, the contact numbers for inquiries on job openings are their company contact numbers and not their personal phone numbers.42

NPC Circular 16-03 only pertains to personal data of an individual or natural person.43 Since the contact number involved is the contact number of KGJS, a juridical person, this incident does not amount to a personal data breach as contemplated by NPC Circular 16-03.

Even though the matter is not considered a reportable breach, KGJS implemented reasonable and appropriate security measures to address the incident. KGJS implemented measures to minimize any potential risks associated with the incident, therefore minimizing any adverse effects on the individuals whose data were impacted.

KGJS immediately requested the removal of its employees’ information on Indeed.44 Indeed confirmed the removal through email.45 KGJS also conducted the removal of its employees’ personal information from its own website.46

KGJS also notified the four (4) employees through email whose data may have been acquired from the security incident.47 KGJS provided them with an update on the initiatives undertaken to address the matter.48

Lastly, KGJS modified its website to ensure that it does not appear in search results on any third-party websites.49

Based on the foregoing, the actions taken by KGJS following the incident allowed it to enhance its security measures and are sufficient to close the case in accordance with Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA) and NPC Circular 16-03.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-135 In re: KGJS Fleet Management Manila, Inc. is considered CLOSED.

SO ORDERED.

City of Pasay, Philippines.

13 November 2023.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

CG Data Protection Officer KGJS Fleet Management Manila, Inc.

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Security Incident dated 20 July 2018 of Article/Web Content in Company Website, 24 July 2018, at 2, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Security Incident dated 20 July 2018 of Article/Web Content in Company Website, 24 July 2018, at 3, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. at 1. ↩

  11. Id. at 2. ↩

  12. Id. ↩

  13. Security Incident dated 20 July 2018 of Article/Web Content in Company Website, 24 July 2018, at 3, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  14. Id. ↩

  15. Id. ↩

  16. Id. ↩

  17. Id. ↩

  18. Update as of 27 Jul 18 – Security Incident dated 20 Jul 18 of Article/Web Content in Company Website, 27 July 2018, at 1, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  19. Id. ↩

  20. Id. ↩

  21. Id. ↩

  22. Full Report as of 30 Jul 18: Security Incident dated 20 Jul 18 of Article/Web Content in Company Website, 30 July 2018, at 1, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  23. Security Incident dated 20 July 2018 of Article/Web Content in Company Website, 24 July 2018, at 2, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  24. Id. at 5. ↩

  25. Id. at 3. ↩

  26. Update as of 27 Jul 18 – Security Incident dated 20 Jul 18 of Article/Web Content in Company Website, 27 July 2018, at 1, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  27. Security Incident dated 20 July 2018 of Article/Web Content in Company Website, 24 July 2018, at 5, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  28. Id. at 6. ↩

  29. National Privacy Commission, Personal Data Breach Management, Circular No. 3, Series of 2016 [NPC Circ. No. 16-03], § 3 (F) (15 December 2016). ↩

  30. Id. ↩

  31. See Adam Hayes, Indeed v. Linked-in: What is the Difference, available at https://www.investopedia.com/articles/personal-finance/020215/indeed-vs-linkedin.asp (last accessed November 2023). ↩

  32. See About Indeed, available at https://ph.indeed.com/about (last accessed January 2023). ↩

  33. See About Jobs on Indeed: What You Need to Know, available at https://support.indeed.com/hc/en-us/articles/115002786323-About-Jobs-on-Indeed-What-You-Need-to-Know (last accessed 31 January 2024). ↩

  34. Id. ↩

  35. See What are Applicant Tracking Systems, available at https://www.indeed.com/career-advice/career-development/what-are-applicant-tracking-systems (last accessed 31 January 2024). ↩

  36. Id. ↩

  37. See About Jobs on Indeed: What You Need to Know, available at https://support.indeed.com/hc/en-us/articles/115002786323-About-Jobs-on-Indeed-What-You-Need-to-Know (last accessed 31 January 2024). ↩

  38. Security Incident dated 20 July 2018 of Article/Web Content in Company Website, 24 July 2018, at 3, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  39. Id. at 2. ↩

  40. Final Breach Notification Evaluation Report, 21 March 2023, at 5, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2023). ↩

  41. Security Incident dated 20 July 2018 of Article/Web Content in Company Website, 24 July 2018, at 2, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  42. Id. ↩

  43. See NPC Circ. No. 16-03. ↩

  44. Security Incident dated 20 July 2018 of Article/Web Content in Company Website, 24 July 2018, at 5, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  45. Full Report as of 30 Jul 18: Security Incident dated 20 Jul 18 of Article/Web Content in Company Website, 30 July 2018, at 1, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  46. Security Incident dated 20 July 2018 of Article/Web Content in Company Website, 24 July 2018, at 5, in In re: KGJS Fleet Management Manila, Inc., NPC BN 18-135 (NPC 2018). ↩

  47. Id. ↩

  48. Id. ↩

  49. Id. ↩

Backlinks