Resolution Text
IN RE: MANILA SHARED SERVICES EMPLOYEES CREDIT AND SAVINGS COOPERATIVE
x----------------------------------------------------x
LIBORO, P.C.:
This case before the Commission is a breach notification report from Manila Shared Services Employees Credit and Savings Cooperative (MSSECSC) concerning the unauthorized disclosure of data subjects’ information caused by a misdirected email.
Facts
On 27 July 2018, the Cooperative’s associates accidentally transmitted the Statement of Accounts (SOA) containing the full name, share capital and savings deposit, and existing loan balances of its three (3) members to another recipient who is not entitled to receive the same when the aforenamed associates transmitted the SOA of the latter using mail merge.1
On 02 August 2018, MSSECSC conducted a breach investigation and undertook the following measures to address the incident: i) It ordered the discontinuance of its original practice of sending SOA to all its members using email. As an alternative, it instead manually distributes the SOA to its members in order to prevent further disclosure or exposure; ii) It also sent notification to the affected data subjects; and iii) Asked the recipient who mistakenly received the email for its immediate deletion.2
On 28 October 2020, the Commission, through the Complaints and Investigation Division (CID), issued an Order requiring MSSECSC to submit a Post Breach Report detailing the incident, pursuant to NPC Circular No. 16-03 on Personal Data Breach Management.3
On 12 November 2020, the MSSECSC sent via email, a response to the aforementioned Order of the Commission.
Issue
Whether or not MSSECSC has implemented reasonable and appropriate measures to address the incident.
Discussion
MSSECSC had implemented reasonable and appropriate measures in addressing the unauthorized disclosure of the data subjects’ information caused by a misdirected email.
Section 11 of NPC Circular No. 16-03 provides the criteria when notification is required:
-
The personal data involves sensitive personal information or any other information that may be used to enable identity fraud. For this purpose, “other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.
-
There is reason to believe that the information may have been acquired by an unauthorized person; and
-
The personal information controller or the Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.
Further, Section 20(b) of the Republic Act No. 10173 known as the Data Privacy Act of 2012 (DPA) requires the personal information controller to implement reasonable and appropriate measures to protect personal information against natural dangers such as accidental loss or destruction, and human dangers such as unlawful access, fraudulent misuse, unlawful destruction, alteration, and contamination.
In this breach notification before the Commission, the information in the said accidental disclosure contains the full name, share capital, savings deposit, and existing loan of the data subjects that can be used to directly and certainly identify them. Hence, in light of the above-cited provisions, it is evident that there was a necessity for MSSECSC to notify both this Commission and the affected data subjects due to the significant risk associated with it, and the likelihood that the information contained therein may be used to vitiate the privacy of the data subject.
MSSECSC, taking the mandates of the DPA in mind, undertook swift remediation measures to protect the personal information contained on the said e-mail against human dangers. It immediately stopped sending the SOA via email and made efforts to notify the Commission4 and the affected data subjects through a letter to the recipient who was not entitled to receive the same, asking for its immediate deletion5.
Accordingly, the Commission resolved that the prompt notifications to the Commission and to the affected data subjects and the remediation measures implemented by MSSECSC are considered reasonable and appropriate remediation measures to address, correct, and mitigate the incident that can lead to issues arising from data breach.
WHEREFORE, premises considered, this Commission hereby resolves that NPC BN 18-186 – In re: Manila Shared Services Employees Credit and Savings Cooperative is now considered CLOSED.
SO ORDERED.
City of Pasay, Philippines. 29 April 2021.
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
WE CONCUR:
LEANDRO ANGELAO Y. AGUIRRE Deputy Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
H.A. Authorized Representative of Manila Shared Services Employees Credit And Savings Cooperative
COMPLAINTS AND INVESTIGATION DIVISION
ENFORCEMENT DIVISION
GENERAL RECORDS UNIT