Resolution Text
IN RE: BATANGAS BAY CARRIERS, INC.
x-------------------------------------------x
AGUIRRE, D.P.C.:
This Resolution refers to the Proof of Compliance1 submitted by Batangas Bay Carriers, Inc. (Batangas Bay), a subsidiary of Magsaysay Shipping & Logistics, to this Commission’s Order2 for it to notify the affected data subjects of the breach incident in accordance with the provisions of NPC Circular 16-03 and to submit proof of compliance thereto, involving a personal data breach caused by a ransomware attack.
Facts
On 21 September 2020, this Commission issued a Resolution3 with the following dispositive portion, to wit:
WHEREFORE, premises considered, the request for Postponement of Notification to Data Subjects filed by Batangas Bay Carriers, Inc. is hereby DENIED.
Batangas Bay Carriers, Inc. is ORDERED to notify the affected data subjects of the breach incident in accordance with the provisions of NPC Circular 16-03 and to SUBMIT proof of compliance thereto within fifteen (15) days from receipt of this Resolution.
On 09 December 2020, Batangas Bay submitted its proof of compliance4 to this Commission showing that it has sent the required notification to affected data subjects.
The notification contains the nature of the breach, personal data possibly involved, measures taken to address the breach and to reduce its harm or negative consequences, and the names of the Data Protection Officer (DPO) and Process Owner stating that if the affected data subjects should require further information, they can be contacted.5
Discussion
This Commission finds the proof of compliance submitted by Batangas Bay insufficient for this Commission’s Order to submit proof of compliance that it has notified the affected data subjects of the breach incident.
Section 18(A) of NPC Circular No. 16-03 provides that:
The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred. The notification may be made on the basis of available information within the 72-hour period if the personal data breach is likely to give rise to a real risk to the rights and freedoms of data subjects. It shall be undertaken in a manner that would allow data subjects to take the necessary precautions or other measures to protect themselves against the possible effects of the breach. It may be supplemented with additional information at a later stage on the basis of further investigation.6
Moreover, Section 18(D) of same Circular provides that:
Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.7
It is noteworthy that the avowed purpose of the required notification to data subjects of a breach incident is for them to take the necessary precautions or other measures to protect themselves against possible effects of the breach. Moreover, personal information controllers (PICs) are required to establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach. It therefore follows that PICs should guarantee that the notification they sent to data subjects has been received. Otherwise, it defeats the very purpose of notification of data subjects.
In this case, Batangas Bay merely submitted to this Commission its proof that it has sent the notification to its affected data subjects. There was, however, no showing that said notification has been received by the data subjects. Notably, the initial report also estimated more than one hundred (100) affected data subjects. However, in its instant submission, the e-mail addresses are far less than one hundred (100).
In view of the foregoing, Sections 18(A) and 18(D) of NPC Circular 16-03 have not been complied with by Batangas Bay. Hence, this Commission finds its proof of compliance to the notification of data subjects insufficient.
This Commission also brings to the attention of Batangas Bay that it has failed to submit its Full Breach Report. Section 17(C) of same Circular provides that:
There shall be no delay in the notification if the breach involves at least one hundred (100) data subjects, or the disclosure of sensitive personal information will harm or adversely affect the data subject. In both instances, the Commission shall be notified within the 72-hour period based on available information. The full report of the personal data breach must be submitted within five (5) days, unless the personal information controller is granted additional time by the Commission to comply.8
The submission of a Full Breach Report is a different requirement that Batangas Bay should have complied with accordingly. Notification of the Commission and Notification of Data Subjects are two (2) different and separate requirements under Sections 17(C) and 18(A) of NPC Circular No. 16-03, respectively, that the PICs should promptly comply with.
WHEREFORE, premises considered, Batangas Bay Carriers, Inc. is hereby ordered, within five (5) days from receipt of this Resolution, to:
(1) SUBMIT confirmation logs or other proof of receipt in compliance to the Notification of the Data Subjects;
(2) SHOW CAUSE in writing why it should not be held liable for failure to submit a Full Report within the required period and be subject to contempt proceedings, as permitted by law, before the appropriate court, and such other actions as may be available to the Commission, and
(3) SUBMIT its Full Breach Report.
SO ORDERED.
Pasay City, Philippines; 17 December 2020.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
CRD Data Protection Officer
COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT