Resolution Text
IN RE: PHILIPPINE SEVEN
CORPORAT ION (P SC )
x-----------------------------------------x
NAGA , D.P.C. :
On 21 May 2020 , the Commission issued a Resolution with a
dispositive portion as follows :
WHEREFORE , premises considered, PSC is ordered by
this Commission to SUBMIT a full breach report in
compliance with Section 9 of NPC Circular 1603,
including the updates on the proposed remediation
measures and postbreach review by the PSC, within
fifteen (15) days from the receipt of this or der.
On 07 August 2020, the PSC through its Data Protection
Officer (DPO) complied with the aforementioned order when it sent
its proposed remediation measures and postbreach review to the
Commission.
PSC’s postbreach review indicates the following act ions that
were already completed:
- BDD completed the revision of its franchise qualification processes and forms aligned with PSC’s data privacy manual;
- Retraining of PSC personnel on Data Privacy;
- BDD data controller issued a reminder of data privac y compliance immediately after the incident and completed training to BDD personnel on PSC’s data privacy policies and security measures;
- Information Technology Division (ITD) and BDD reviewed PSC’s email settings and strictly implemented the following:
In re: PSC
i. Standard notices in email requesting unintended recipient to alert
the sender and delete the message attachments
ii. 2factor authentication for emails
iii. Cascading information on use of the confidential and undo
function in Gmail as a security fea ture to Data Controllers
- Human Resources Administration Division (HRAD) posted a video
reminder in PSC’s Data Privacy portal to remind all personnel of PSC on
use of before sending emails to multiple recipients and included in the
module for orientation of new employees a topic on data privacy with
special reminder on proper use of email; and
- Implementation of above action plans were complied with.
The Enforcement Division issued its findings on the compliance of
PSC, viz:
Upon reviewing the report submitted by PSC, we
found t hat the corporation has complied with the order
and resolution of the Commission dated 21 May 2020
and NPC Circular No. 1603 on Personal Data Breach
Management.
xxx xxx xxx
WHEREFORE, premises considered, the Enforcement
Division respectfully recomm ends to CLOSE the
instant case, CID BN 18091 In The Matter Of The
Philippine Se ven Corporation Data Breach
Notification Report.
In addition, the Commission st ernly reminds PSC that
notifying data subject in cases of data breach should be swift and
immediate to reduce the risk to the data subject arising from the
personal data breach . There is no need for the personal information
controller ( PIC) or Personal Information Processor (PIP ) to await
any order or positive action from the Commission to make such
notification.
Section 20 (f) of the Republic Act No. 10173 or the Data
Privacy Act of 2012 provides: CID BN 18081
In re: PSC Page 3of 4
“The personal information controll er shall promptly notify
the Commission and affected data subjects when sensitive
personal information or other information that may, under
the circumstances, be used to enable identity fraud are
reasonably believed to have been acquired by an
unauthorized person, and the personal information
controll er or the Commission believes th at such
unauthorized acquisition is l ikely to give rise”
Further Section 11 of the NPC Circular 1603 provides:
“Notification shall be required upon knowledge of or when
there is reaso nable belief by the personal information
controller or personal information processor that a personal
data breach requiring notification has occurred, under the
following conditions: …“
The language of the abovementioned provision s are clear and
direct. T he PIC or PIP are required to promptly and immediately
notify the affected data subject in case of a data breach. The act of
notifying should be automatic . Hence, it is expected from PSC that
the incidents that transpired in this case in relation to the
notification of the affected data subject will no longer happen.
WHEREFORE , premises considered, it is resolved that the
matter of CID BN 18081 “In Re: Philippine Seven Corporation ” is
hereby considered CLOSED .
SO ORDERED.
Pasay City, Philippines ;
10 September 20 20 .
JOHN HENRY D. NAGA
Deputy Privacy Commissioner CID BN 18081
In re: PSC
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO
Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner
COPY FURNISHED:
ESE
Data Protection Officer
Philippine Seve n Corporation
COMPLAINTS AND INVESTIGATION DIVISION
ENFORCEMENT DIVISION
GENERAL RECORDS UNIT