NPC Issuance Wiki

NPC BN 18-220 and NPC BN 18-231: In re: Department of Trade and Industry and Department of Trade and Industry – Rizal Provincial Office

Issued Resolution

Resolution Text

IN RE: DEPARTMENT OF TRADE AND INDUSTRY

NPC BN 18-220

x----------------------------------------------------x

IN RE: DEPARTMENT OF TRADE AND INDUSTRY – RIZAL PROVINCIAL OFFICE

NPC BN 18-231

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before the Commission are the breach notifications submitted by the Department of Trade and Industry (DTI) and the Department of Trade and Industry – Rizal Provincial Office (DTI-Rizal) involving the forcible entry of unauthorized persons resulting in the loss of office equipment such as laptops and storage devices.

Facts

On 11 November 2018, DVG, a member of DTI-Rizal’s utility staff called ROP, an administrative staff officer, to inform the latter that the DTI-Rizal office was robbed.1

According to DVG, he discovered the gate of the office was unlocked and the windows and drawers were opened.2 He narrated that “papers were scattered on the floor and it suggested that someone entered the office and searched for something.”3

When ROP arrived at the office, the Philippine National Police (PNP) of Rizal was already conducting the investigation.4 The Scene of the Crime Operatives (SOCO) also assisted in the investigation and identified that the following items were taken from the DTI-Rizal Office: two (2) laptops, two (2) external hard drives, one (1) power bank, one (1) camera, one (1) cap, and Three Thousand Pesos (Php 3,000.00) in cash.5

With the help of the PNP, DTI-Rizal recovered one (1) hard drive.6 The two (2) laptops and the other hard drive, however, remain unrecovered.7

According to DTI-Rizal, the laptops were used for the One Town One Product Staff (OTOP) program of DTI-Rizal and contained the following files: (1) OTOP videos, (2) photos involving OTOP owners, (3) photos of seminar speakers, and (4) photos of DTI-Rizal staff.8 The OTOP Program is a “DTI-wide stimulus program locally implemented by DTI-Rizal to assist Micro, Small, and Medium-scale enterprises (MSMEs).”9

Meanwhile, the hard drives were mainly used by DTI-Rizal’s Negosyo Center Business Counselor.10 It contains the following files: (1) an OTOP Directory including the name of business, name of business owner, contact numbers, and e-mail address, (2) OTOP seminar files including proposals, post-activity reports, client satisfaction feedback, and post training evaluation reports, (3) accomplishment reports including full name and designation of the account officers, (4) action photos of seminars and activities from January to November 2018, (5) collaterals, (6) blank International Organization for Standardization (ISO) forms, and (7) forty (40) MSME Business Permit files which include scanned copies of valid business name certificates and 2018 Mayor’s Permits.11 These permits include business name, business territorial scope, full name of business owner, business certificate number, and expiration date.12 The hard drives were reported to be unencrypted.13

DTI-Rizal stated that the incident involved three (3) alleged suspects, two (2) of which are minors.14 The two (2) minor suspects sold the unrecovered items and were eventually apprehended by the law enforcement officers.15

On 12 November 2018, DTI-Rizal notified the forty (40) affected data subjects who are MSME business permit owners through Short Message Service (SMS).16

DTI-Rizal attached an affidavit of KPL, an employee of DTI-Rizal, evidencing that she has personally informed all the data subjects about the incident.17

On 27 November 2018, DTI and DTI-Rizal notified the National Privacy Commission (NPC) of the security incident.18

On 08 October 2020, the NPC, through the Complaints and Investigative Division (CID), issued an Order requiring DTI-Rizal to submit a Full Report detailing the incident with emphasis on the lacking information from its initial notification.19

On 22 October 2020, DTI-Rizal submitted its Compliance with the Order dated 08 October 2020.20

On 29 April 2021, the CID sent a letter addressed to DTI-Rizal clarifying whether: (1) there were actual sensitive and other personal information stored in the laptop, (2) the unauthorized acquisition may lead to serious risks such as enabling identity fraud, (3) the stolen laptops were password protected to avoid unauthorized access to the files.21 The CID also requested an update on the progress of the final investigation of the security incident and as well as the status of equipment retrieval and file recovery.22

With respect to NPC BN 18-220 In re: DTI, a breach notification involving the same incident, the CID issued an Order on 07 December 2021 requiring DTI to submit a Full Report expounding on the details stated in the initial notification report to further help with the investigation of the breach incident.23

On 23 December 2021, DTI requested for an additional fifteen (15) calendar days to comply with the Order dated 07 December 2021.24

On 24 December 2021, the CID granted DTI’s request for extension.25

On 27 December 2021, DTI-Rizal conducted a Privacy Impact Assessment (PIA) on DTI-Rizal’s OTOP Program.26

On 03 January 2022, DTI submitted its Full Report detailing the security incident.27

On 10 May 2022, the CID ordered DTI to submit a Post-Breach Report containing the proper documentation on the actions taken within fifteen (15) days from receipt of said Order.28 On 30 September 2022, the CID issued a similar Order to DTI-Rizal.29

On 26 May 2022, DTI submitted its Post-Breach Report with proper documentation on the actions taken.30

On 11 July 2022, the CID ordered DTI to submit a Supplemental Post-Breach Report documenting the actions taken with regard to DTI-Rizal’s organizational and physical measures.31

On 29 July 2022, DTI submitted a Supplemental Post-Breach Report containing proper documentation on the actions taken.32 It submitted proof that only certain persons are authorized to access the office, storage area, vault, and steel cabinets.33

With regard to DTI-Rizal’s PIA, it reported that “the information collected from data subjects are likely to raise privacy concerns or expectations as they can be used for identity/business fraud for loan applications/business scams during the validity of the documents.”34 DTI-Rizal, however, submitted that “none of the affected data subjects reported negative consequences as a result of the said breach.”35 DTI-Rizal added that it observes a one (1) year retention period on company profiles in the OTOP Directory.36 DTI-Rizal explained that the OTOP Support Staff is designated to update information and to

determine whether the information is necessary for retention or disposal.37

On 17 October 2022, DTI submitted a Post-Breach Report containing proper documentation on the actions taken.38 DTI-Rizal clarified that it previously submitted the required information.39

DTI emphasized that the types of personal information involved in the breach includes the scanned 2017-2018 business permit files of MSME programs totaling forty (40) MSME business permit files.40 These involve scanned copies of business name certificates containing the full name of the business owner and a copy of the 2018 Mayor’s Permits containing the business address of the owner.41

The breach also includes the Directory of 2018-2019 “Otopreneurs” containing the name of contact person, name of company, nature of business, address, contact numbers, email addresses, and the Individual Accomplishment Reports of the OTOP Account Officer for 2018 containing the full name and designation of the account officer.42

On 28 October 2022, NPC BN 18-220 In re: DTI and NPC BN 18-231 In re: DTI-Rizal were consolidated since they pertain to the same breach notification report.43

Issue

Whether DTI-Rizal conducted proper breach management, including the implementation of reasonable and appropriate security measures.

Discussion

The Commission finds that DTI-Rizal conducted proper breach management and implemented reasonable and appropriate security measures in addressing the breach. The Commission resolves to close the matter.

Section 20 (a) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA) provides that a Personal Information Controller (PIC) should implement reasonable and appropriate measures to protect personal information:

Section 20. Security of Personal Information.

a. The personal information controller must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.44

Similarly, Section 17 (D) (3) of NPC Circular 16-03 (Personal Data Breach Management) provides the obligation of a PIC to notify the NPC of a personal data breach.45 The provision also outlines the content of notification specifically the measures that a PIC took to address the breach:

Section 17. Notification of the Commission. The personal information controller shall notify the Commission of a personal data breach subject to the following procedures:

…

D. Content of Notification. The notification shall include, but not be limited to:

…

3. Measures Taken to Address the Breach

a. description of the measures taken or proposed to be taken to address the breach;

b. actions being taken to secure or recover the personal data that were compromised;

c. actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident;

d. action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification;

e. the measures being taken to prevent a recurrence of the incident.46

Based on its submissions, DTI-Rizal narrated the measures it took to address the breach following Section 20 (a) and Section 17 (D) (3) of NPC Circular 16-03.

DTI-Rizal posted an advisory on the bulletin board outside the office informing the public that a robbery incident took place in the office.47 The advisory warned all concerned that the “incident may have resulted [in] an accidental loss of personal data” and that DTI-Rizal has “taken measures to secure the office to prevent similar incidents in the future.”48 DTI-Rizal also added the contact number of its Data Protection Officer (DPO) in case concerned data subjects have privacy-related queries.49 DTI-Rizal attached pictures to support its implementation to its Compliance.50

DTI-Rizal also notified the forty (40) affected data subjects who are MSME business permit owners the day immediately after the incident through SMS.51

As part of DTI-Rizal’s remedial measures, a security guard regularly reports to the office on a twelve (12) hour duty.52 DTI-Rizal also

reported that it negotiated with the building owner for increased security in the establishment.53

As a physical measure, DTI-Rizal installed iron grills and shutters for the windows and it replaced the padlocks for the staircase gates.54 It also added steel filing cabinets with locks for equipment storage.55

Additionally, seven (7) closed-circuit television (CCTV) cameras were installed on December 2018.56 According to DTI-Rizal, the Provincial Director is authorized to monitor all CCTV footages, while DTI-Rizal’s Finance and Administrative Unit (FAU) and Information Technology (IT) Officers are in-charge of overseeing and coordinating the use of the CCTV.57 DTI-Rizal attached pictures evidencing the implementation.58

As an organizational measure, DTI-Rizal designated DPOs and a data security officer.59 According to DTI-Rizal, only authorized persons have access to the office, storage, vault, and steel cabinets.60 DTI-Rizal also provided data privacy trainings to its staff from 2018-2020.61 A copy of the certificate of attendance was attached to DTI-Rizal’s Compliance.62 It also posted data privacy notices in both their client and employee work spaces.63

As a technical measure, DTI-Rizal partnered with DTI-Rizal’s IT Team to come up with additional security measures to protect the records and data of the office.64

DTI-Rizal reported that all employees are required to use passwords on laptops issued by the office.65 DTI-Rizal utilizes BitLocker as an encryption tool for added protection to the records in the computer units.66 DTI-Rizal advised employees to safeguard their external hard drives such as Universal Serial Bus (USB) Storages and Secure Digital (SD) Cards in safe and secured locations.67 According to DTI-Rizal, it also implements cloud-based storage through Office 365.68

Based on the foregoing, the measures that DTI-Rizal took after the incident have shown its commitment in complying with the Data Privacy Act of 2012 and the Commission’s issuances.

The Commission takes this opportunity to remind PICs, such as DTI-Rizal, of their responsibility to observe constant vigilance against theft or robbery in their premises. This is an essential practice to strengthen its mandate to protect the personal data of its data subjects.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-220 Department of Trade and Industry and NPC BN 18-231 In re: Department of Trade and Industry – Rizal Provincial Office (DTI-Rizal) is CLOSED.

SO ORDERED.

City of Pasay, Philippines.

30 June 2023.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

(on official leave)

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

AMV

Officer-in-Charge, Knowledge Management and Information Service and Acting DTI Data Protection Officer

Department of Trade and Industry

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Incident Report, 27 November 2018, Annex A, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2018). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Breach Notification, 27 November 2018, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2018). ↩

  6. Id. ↩

  7. Full Breach Report, 03 January 2022, at 5, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  8. Id. at 3. ↩

  9. Compliance, 29 July 2022, Annex D, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  10. Full Breach Report, 03 January 2022, at 4, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  11. Id. ↩

  12. Id. ↩

  13. Id. at 2. ↩

  14. Breach Notification, 27 November 2018, Annex A, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2018). ↩

  15. Full Breach Report, 03 January 2022, at 5, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  16. Id. at 4. ↩

  17. Compliance, 26 May 2022, Annex D, in In Re: Department of Trade and Industry, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  18. Breach Notification, 27 November 2018, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2018). ↩

  19. Order, 08 October 2020, at 1, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2020). ↩

  20. Compliance, 22 October 2020, at 1, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2020). ↩

  21. Letter of the CID to DTI, 29 April 2021 at 1, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2021). ↩

  22. Id. ↩

  23. Order (To Submit Full Breach Report), 07 December 2021, at 1, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2021). ↩

  24. Letter of DTI to CID, 23 December 2021, at 1, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2021). ↩

  25. Resolution of the Motion for Extension of Time dated 23 December 2021, 23 December 2021, at 1, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2021). ↩

  26. Letter of DTI to CID, 29 July 2022, Annex D, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  27. Compliance, 03 January 2022, at 1, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  28. Order (To Submit Post-Breach Report), 10 May 2022, at 1, in In Re: Department of Trade and Industry – Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2018). ↩

  29. Id. ↩

  30. Compliance, 26 May 2022, at 1, in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  31. Order (To Submit Post-Breach Report), 11 July 2022, at 1, in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  32. Compliance, 29 July 2022, at 1, in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  33. Id. Annex B. ↩

  34. Id. Annex D. ↩

  35. Id. at 3. ↩

  36. Id. Annex D. ↩

  37. Id. ↩

  38. Post-Breach Report, 17 October 2022, at 1, in In Re: Department of Trade and Industry -Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  39. Id. ↩

  40. Id. ↩

  41. Id. ↩

  42. Id. ↩

  43. Memorandum, Complaints and Investigation Division, at 1, in In Re: Department of Trade and Industry -Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  44. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 20 (a) (2012). ↩

  45. National Privacy Commission, Personal Data Breach Management, Circular No. 3, Series of 2016 [NPC Circ. No. 16-03], § 17 (D) (3) (15 December 2016). ↩

  46. Id. § 17 (D) (3). ↩

  47. Breach Notification, 27 November 2018, Annex D, in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2018). ↩

  48. Id. ↩

  49. Full Breach Report, 03 January 2022, Annex B, in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  50. Id. ↩

  51. Compliance, 26 May 2022, Annex D, in In Re: Department of Trade and Industry, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  52. Full Breach Report, 03 January 2022, Annex B, in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  53. Compliance, 17 October 2022, at 4, in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  54. Id. ↩

  55. Full Breach Report, 03 January 2022, Annex B., in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  56. Id. ↩

  57. Breach Notification, 27 November 2018, Annex C, in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2018). ↩

  58. Full Breach Report, 03 January 2022, Annex B, in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  59. Compliance, 29 July 2022, Annex A, in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  60. Id. Annex B. ↩

  61. Full Breach Report, 03 January 2022, at 6, in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  62. Id. Annex E. ↩

  63. Full Breach Report, 03 January 2022, Annex D, in In Re: Department of Trade and Industry - Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  64. Id. Annex G. ↩

  65. Id. at 2. ↩

  66. Id. Annex G. ↩

  67. Full Breach Report, 03 January 2022, Annex G, in In Re: Department of Trade and Industry -Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

  68. Compliance, 17 October 2022, at 3, in In Re: Department of Trade and Industry -Rizal Provincial Office, NPC BN 18-220 and NPC BN 18-180 (NPC 2022). ↩

Backlinks

  • No backlinks found