Resolution Text
JCR
Complainant,
-versus-
GLOBE TELECOM, INC.
Respondent.
x----------------------------------------x
AGUIRRE, D.P.C. :
This Resolution refers to the Compliance Report dated 03 February 20201 submitted by Respondent Globe Telecom, Inc. involving a complaint filed by Complainant JCR for alleged violations of Republic Act 10173 (“Data Privacy Act”).
Facts
On 05 December 2019, this Commission issued a Decision2 with the following disposition:
WHEREFORE, all the premises considered, the Commission finds no violation of the Data Privacy Act on the part of Respondent Globe Telecom, Inc. that is sufficient to warrant a recommendation for criminal prosecution. This Commission finds, however, that Respondent failed to adopt and implement the necessary policies and procedure relating to the prevention, correction, and mitigation against security incidents that can lead to a personal data breach.
The Commission hereby ORDERS Respondent Globe Telecom to submit a complete report on the measures it has undertaken or will undertake to address the issue of delayed SIM deactivation such as in this case, including the timeline for the implementation of such measures, within thirty (30) days from receipt of this Decision. Reference may be made to the requirements provided in the Implementing Rules and Regulations of the Data Privacy Act, particularly Section 28, paragraphs (c), (d), (e), and (f).
On 05 February 2020, this Commission received the Compliance Report of Respondent which included its Policy and Procedure Manual (PPM)3 concerning the Postpaid Change SIM Process in its Globe stores. Respondent claims that the PPM, which has been effective since 2018, outlines the procedure for processing requests to replace lost and defective SIM cards as well as to upgrade the same. Stringent subscriber verification protocols are in place to ensure that lost SIM cards are deactivated, and that replacement SIM cards are issued to the account owner on record within the same day of request. As a safeguard against privacy and security risks, a replacement SIM card will not be issued in case of incomplete submission of requirements, mismatched proof between identification details and customer details in the Globe My Business Support System, and failure to provide correct answers to any of the six (6) account verification questions.4
On 03 August 2020, the Enforcement Division of this Commission issued an Enforcement Letter5 ordering the Respondent to submit a more comprehensive report on the measures it has undertaken to avoid the issue of delayed SIM deactivation in the future, within ten (10) days from their receipt of the letter. Respondent received the letter on 10 August 2020. The letter stems from the Enforcement Division’s finding that while the PPM contains safeguards to prevent unauthorized persons to claim another’s SIM card replacement, it did not identify possible controls to avoid delayed SIM card replacement due to human error or other technicalities.6
On 20 August 2020, Respondent submitted a Comprehensive Report7 where it outlined the steps it has taken in order to address the issue at hand, particularly the changes it has made in its PPM for both postpaid and prepaid subscribers which were cascaded to all its employees. Respondent introduced enhancements in its procedure to
ensure the restoration of the availability and access to personal data in a timely manner in the event of physical or technical incident. To make sure that only the account holder or his or her authorized representative can access the account, mandatory verification questions specific to the lost phone or SIM card will be asked before the temporary deactivation of the line.8
Nonetheless, Respondent also stated that pursuant to the Service Level Agreement (SLA), SIM deactivation should take effect within one (1) day. The Respondent admitted that the delayed deactivation of herein Complainant’s SIM went beyond the period stated in the SLA and that it is conducting an investigation on the matter in order to issue appropriate sanctions against the erring officers and employees.9
Discussion
This Commission hereby considers the instant case as closed. Section 28 of the Implementing Rules and Regulations of the Data Privacy Act of 2012 provides for the guidelines for technical security measures:
Where appropriate, personal information controllers and personal information processors shall adopt and establish the following technical security measures:
a. A security policy with respect to the processing of personal data;
b. Safeguards to protect their computer network against accidental, unlawful or unauthorized usage, any interference which will affect data integrity or hinder the functioning or availability of the system, and unauthorized access through an electronic network;
c. The ability to ensure and maintain the confidentiality, integrity, availability, and resilience of their processing systems and services;
d. Regular monitoring for security breaches, and a process both for identifying and accessing reasonably foreseeable vulnerabilities in their computer networks, and for taking preventive, corrective, and mitigating action against security incidents that can lead to a personal data breach;
e. The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
f. A process for regularly testing, assessing, and evaluating the effectiveness of security measures;
g. Encryption of personal data during storage and while in transit, authentication process, and other technical security measures that control and limit access.10
In this case, it is noteworthy that Respondent has a PPM, which has already been effective since 2018. The PPM provides for the procedure of processing requests for replacement and upgrading of SIM cards. As a privacy and security measure, Respondent implements stringent subscriber verification protocols to guarantee the timely deactivation and proper replacement of lost SIM cards. Now, it has already introduced improvements in its procedure to ensure the restoration of the availability and access to personal data in a timely manner in the event of physical or technical incidents. Moreover, it has also implemented certain mechanisms to ensure that only the account holder or his or her authorized representative can access the account through the conduct of mandatory verification process.
The foregoing technical security measures employed by Respondent are deemed sufficient to prevent, correct, and mitigate security incidents that can lead to a personal data breach in view of the previous Decision11 of this Commission. However, it should be noted that Respondent should hold its personnel accountable when there is delay in the deactivation and replacement of SIM cards to ensure strict compliance with its privacy policies and procedures and prevent similar incidents in the future.
WHEREFORE, premises considered, the case of JCR v. Globe Telecom, Inc. is hereby considered CLOSED. Furthermore, Globe Telecom, Inc.’s representations to comply with its Service Level Agreements (SLAs), and Policy and Procedure Manual (PPM) are hereby NOTED for future reference and assessment.
SO ORDERED.
Pasay City, Philippines; 10 September 2020.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY DU NAGA Deputy Privacy Commissioner
Copy furnished:
JCR Complainant
CASTELO UNGOS CASIÑO & TUBAYAN Counsel for Respondent Globe Telecom, Inc. 28/F, The Globe Tower, 32nd St. corner, 7th Avenue Bonifacio Global City, Taguig 1634
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
Compliance Report dated 3 February 2020. ↩
-
Decision dated 5 December 2019. ↩
-
Ibid. ↩
-
Letter to the National Privacy Commission dated 3 February 2020. ↩
-
Enforcement Letter dated 3 August 2020. ↩
-
Ibid. ↩
-
Globe’s Comprehensive Report dated 20 August 2020. ↩
-
Ibid. ↩
-
Ibid. ↩
-
Emphasis supplied. ↩
-
Supra note 1. ↩