Resolution Text
IN RE: DE LA SALLE HEALTH SCIENCES INSTITUTE
x----------------------------------------------x
LIBORO, P.C.:
Before this Commission is a request for an exemption from the requirement of notifying the affected data subjects filed by De La Salle Health Sciences Institute (DLSHSI).
Facts
On 10 June 2020, this Commission received a breach notification from the DLSHSI on an incident involving the vulnerability of the search link in its Employee and Student System called School Automate (SA). According to the initial breach report submitted by the DLSHSI, visitors of the SA can look for the ID number of students or employees. The SA contains records of around eleven thousand (11,000) employees and students (collectively referred to as data subjects).1
In its report,2 DLSHSI requested for exemption from notification of the data subject on the following grounds:
Notification to the data subject would further expose the data subjects’ vulnerability as against the remote possibility of any harm that can befall them. All other computer applications are reviewed for similar weakness and this weakness will be included among the criteria in all future software acquisitions.
Discussion
Section 3 of the National Privacy Commission Circular 16-03 (Circular) defines security incident and data breach in this wise:
“Personal data breach” refers to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed. A personal data breach may be in the nature of:
- An availability breach resulting from loss, accidental or unlawful destruction of personal data;
- Integrity breach resulting from alteration of personal data; and/or
- A confidentiality breach resulting from the unauthorized disclosure of or access to personal data.
“Security incident” is an event or occurrence that affects or tends to affect data protection, or may compromise the availability, integrity, and confidentiality of personal data. It shall include incidents that would result to a personal data breach, if not for safeguards that have been put in place;
Personal data breach occurs when one of the circumstances provided by Section 3 (F) of NPC Circular 16-03 are present. It comes in three forms: (1) when personal data is accessed by or disclosed to third persons without authority (confidentiality breach)3; or due to the accidental destruction or loss of personal data (availability breach)4; or when there is alteration of personal data (integrity breach).5
Outside of the foregoing definition, any event or occurrent that tends to affect data protection, or may compromise the availability, integrity, and confidentiality of personal data fall within the broader category of security incident.6
In the case at hand, the system vulnerability in the SA that was discovered by DLSHSI in its routine inspection is not a data breach, but rather a security incident. There was no evidence on record that the SA was accessed by third persons unlawfully, or that the contents of the SA was disclosed to unauthorized individuals.
Moreover, DLSHSI was able to take preventive actions before the security incident ripened into a full data breach. DLSHSI was able to remove the search link few hours after discovery, and it also advised its HR and Registrar to thoroughly validate the identity of any person that would request for any information or documents from the institution.
Considering that the system vulnerability of the SA is a mere security incident which did not give rise to a real risk of serious harm to any affected data subjects, and that DLSHSI was able to take subsequent measures that ensure that the negative consequences to the data subjects will not materialize, the Commission resolves to grant the request for exemption from the notification of the affected data subjects. Nevertheless, DLSHSI is directed to continue its monitoring activities to allow timely notification in case any evidence of unauthorized use of the information arises.
WHEREFORE, all premises considered, the request for exemption is hereby GRANTED. The matter of BN 20-101: In Re De La Salle Health Sciences Institute is hereby considered CLOSED.
SO ORDERED.
Pasay City, Philippines;
23 July 2020.
RAYMUND ENRIQUEZ LIBORO
Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner
JOHN HENRY D. NAGA
Deputy Privacy Commissioner
Copy furnished:
A.B.R.
Data Protection Officer
COMPLIANCE AND MONITORING DIVISION
ENFORCEMENT DIVISION
GENERAL RECORDS UNIT