Resolution Text
IN RE: COMMISSION ON ELECTIONS (COMELEC)
x-----------------------------------------x
AGUIRRE, D.P.C.:
This Resolution refers to the Letter1 of the Commission on Elections (COMELEC) providing notice to this Commission of a possible personal data breach concerning the registered voters of Talavera, Nueva Ecija, and its request for extension of time to notify the data subjects.
Facts
On 10 November 2020, COMELEC received an unsigned memorandum dated 04 November 2020 from JBR, Election Officer (EO), Office of the Election Officer (OEO) of Talavera, Nueva Ecija, reporting that on 30 October 2020, a burglary incident happened at the OEO of Talavera, Nueva Ecija.2
After the inventory was conducted, the following items were found missing:
(1) One portable hard drive which contains the voter registration records and VRS backups (COMELEC property); (2) One Lenovo Think Pad Laptop with SN XXXXXXX8 (COMELEC property) which contains the voter registration system program, other VRS reports and data backup; (3) One Acer laptop (LGU property); (4) One Samsung Notebook (LGU property); (5) Php 350.00 hidden inside an employee’s drawer; and (6) Two hundred pieces of face shields.3
JBR also reported the following:
(1) The lock of the office vault was smashed and destroyed; (2) The incident was immediately reported to the local police and investigation is on-going; (3) The concerned officers of COMELEC were informed; and (4) Inventory of all office documents is on-going.4
Furthermore, COMELEC requested that since such notice has been submitted beyond the seventy-two (72) hour period, within which the Commission should be notified, the same be considered justified and reasonable considering the consecutive work suspensions that followed after the receipt of JBR’s report, thus:
Please note that while this Office received the report of JBR on 10 November 2020, work in government offices in the National Capital Region as well as in Region III, among other regions, was suspended effective 3:00 o’clock in the afternoon of 11 November 2020 (Thursday) until 13 November 2020 (Friday).5
COMELEC informed this Commission of their security measures, thus:
Relatedly, undersigned respectfully informs the NPC that, as a security feature, all the data encoded in the computers of all OEOs involved the voters of their respective cities and municipalities only, and are already encrypted in AES 256. The portable hard disks containing said data are likewise encrypted.6
According to the letter, the COMELEC Executive Director and Data Protection Officer issued a memorandum dated 10 November 2020 for the Director IV of COMELEC’s Information Technology Department, as well as Director III of the Finance Services Department and Data Compliance Officer, informing them about the report of JBR with a directive to investigate the incident.7
Lastly, COMELEC claims that since the investigation is on-going and the challenges posed by the threat of COVID-19, it is not reasonably possible to notify the data subjects within the prescribed period. For these reasons, COMELEC requests for an extension of time to comply with the notification of data subjects8 without stating a specific timeline for such.
Discussion
This Commission denies the request for an indefinite extension of COMELEC to notify the affected data subjects.
Section 18(B) of NPC Circular 16-03 provides that:
If it is not reasonably possible to notify the data subjects within the prescribed period, the personal information controller shall request the Commission for an exemption from the notification requirement, or the postponement of the notification. A personal information controller may be exempted from the notification requirement where the Commission determines that such notification would not be in the public interest or in the interest of the affected data subjects. The Commission may authorize the postponement of notification where it may hinder the progress of a criminal investigation related to a serious breach, taking into account circumstances provided in Section 13 of this Circular, and other risks posed by the personal data breach.9
In this case, COMELEC requests for an extension to comply with the notification of data subjects on two (2) grounds, namely, (1) that an investigation is on-going, and (2) the challenges posed by the threat of COVID-19.10
A careful scrutiny of the records reveals that there are two (2) investigations referred to in this case. First, the on-going investigation conducted by the local police. Second, the investigation under the directive of COMELEC through its Information Technology Department and Finance Services Department.
As to the on-going investigation by the local police, there is no showing how the notification to data subjects will hinder the investigation on robbery or other relevant crime thereto. Not all criminal investigations, even those conducted as a result of the breach as in this case, can be considered as a ground for postponement of notification of data subjects. Simply mentioning that a criminal investigation is being undertaken is not sufficient. The burden is on the party requesting for postponement to show that the notification will indeed affect the outcome of the investigation.
As to the investigation within the COMELEC, this is not the investigation contemplated by Section 18 of NPC Circular 16-03, which specifically refers to criminal investigations.
Furthermore, while the challenges posed by the threat of COVID-19 pandemic was raised by the COMELEC as a reason for its postponement to notify the data subjects, it was not explained how it is not reasonably possible to notify the data subjects within the prescribed period. More importantly, it did not state what period of additional time is requested for. The request for an indefinite extension of notification of the affected data subjects is hereby denied.
The Commission, however, notes that no mention was made about the COMELEC’s concrete steps for the retrieval of the affected data subjects’ information which may have been stored in the stolen equipment. In order to effect the notification of the data subjects which will enable them to take the necessary precautions, the Commission directs the COMELEC to conduct notification through alternative means under Section 18(D) of NPC Circular 16-0311, thus:
Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.12
This Commission likewise brings to the attention of COMELEC the required submission of its Full Breach Report. Section 17(C) of NPC Circular 16-03 provides that:
There shall be no delay in the notification if the breach involves at least one hundred (100) data subjects, or the disclosure of sensitive personal information will harm or adversely affect the data subject. In both instances, the Commission shall be notified within the 72-hour period based on available information. The full report of the personal data breach must be submitted within five (5) days, unless the personal information controller is granted additional time by the Commission to comply.13
While COMELEC has requested for additional time to notify the data subjects herein, no request for additional time to submit the full report has been made. The COMELEC is reminded that the notification of data subjects and notification of the Commission are two (2) different requirements to be complied with by personal information controllers (PICs).
WHEREFORE, premises considered, the Commission on Elections is ORDERED, within ten (10) days from receipt of this Resolution, to: (1) Submit its Full Breach Report, and (2) Notify the data subjects through alternative means and submit proof of compliance thereto.
SO ORDERED.
Pasay City, Philippines 26 November 2020.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
BJS Executive Director and Data Protection Officer Commission on Elections
THRU: MRA Representative Commission on Elections
COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT