Resolution Text
IN RE: E-SCIENCE CORPORATION
x-----------------------------------------x
AGUIRRE, D.P.C.
This Resolution refers to the notification logs submitted by E-Science Corporation (E-Science)1 in response to the Order of this Commission for it to submit the confirmation logs or other proof that the affected data subjects received the required notification under NPC Circular 16-03.2
Facts
On 22 October 2020, this Commission issued a Resolution3 with the following disposition, to wit:
WHEREFORE, premises considered, E-Science Corporation is ORDERED to submit the confirmation logs or other proof of receipt in compliance to the Notification of the Data Subjects within five (5) days from receipt of this Resolution.
Furthermore, having found the Explanation of E-Science Corporation sufficient, the Show Cause Order is hereby considered as a CLOSED matter.
In response to the said Resolution, E-Science submitted a letter with the subject “Notification Logs as Compliance for NPC BN No. 20-124.”4 In its submission, it indicated the notification message and read status of the data subjects as of 14 December 2020. As to those data subjects who were not able to read the notification message, E-Science enumerated the following possible reasons thereof:
(a) Resigned employee; (b) The user is no longer active; and (c) No internet connectivity to access or receive the notification.5
E-Science expressed its hope that such submission satisfies the Commission’s Order6 for it to submit the confirmation logs or other proof of receipt in compliance with the requirements for notification of the data subjects under NPC Circular 16-03.
Discussion
Section 18 (C) of NPC Circular 16-03 provides that:
The notification shall include, but not be limited to:
- nature of the breach;
- personal data possibly involved;
- measures taken to address the breach;
- measures taken to reduce the harm or negative consequences of the breach;
- representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
- any assistance to be provided to the affected data subjects.
Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.7
Moreover, Section 18 (D) of same Circular provides that:
Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.8
The submission made by E-Science to this Commission indicated the automated message it sent to the affected data subjects, thus:
Hi Team,
We have recently found out from one of our service providers that some names and email addresses of our employees may have been included in a computer that was hacked, which happened early July of this year. While the information hacked does not include sensitive personal information and/or that said information may not be useful or updated, the hacker may use the data to send you spam and other malicious content. As such, please be extra careful in opening emails and links that are not familiar to you. Also, we encourage you to change your passwords regularly for additional security. If you have questions, you may direct your queries to ABG, for clarification.9
The submission also attached an enumeration of the names of the affected data subjects, their respective user codes, the status on whether they have read the notification message, and the date when the message was sent.
In consideration of the above information and the large number of data subjects involved, the Commission finds that the notification sent by E-Science and proof of its receipt by the affected data subjects complies with R.A. 10173 or the Data Privacy Act, its Implementing Rules and Regulations, and NPC Circular 16-03.
WHEREFORE, premises considered, this Commission hereby finds E-Science Corporation’s submission of confirmation logs SUFFICIENT for compliance with its Order stated in the Resolution dated 22 October 2020. This Commission hereby considers the matter CLOSED.
SO ORDERED.
Pasay City, Philippines 17 December 2020.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
JYP Data Protection Officer
COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission
Footnotes
-
Letter with the subject “Notification Logs as compliance for NPC BN 20-124 submitted by E-Science Corporation.” Dated 14 December 2020. ↩
-
NPC Circular 16-03. Personal Data Breach Management. Dated 15 December 2016. ↩
-
Resolution dated 22 October 2020, In re: E-Science Corporation, NPC BN 20-124. ↩
-
Supra note 1. ↩
-
Ibid. ↩
-
Supra note 3. ↩
-
Emphasis supplied. ↩
-
Emphasis supplied. ↩
-
Supra, at note 1. ↩