NPC Issuance Wiki

NPC BN 17-002: In re: Data Breach Involving the COMELEC Data Processing System in Wao, Lanao Del Sur

Issued Resolution

Resolution Text

IN RE: DATA BREACH INVOLVING THE COMELEC DATA PROCESSING SYSTEM IN WAO, LANAO DEL SUR

x----------------------------------------------------x

NAGA, D.P.C.:

Before this Commission is the Compliance1 submitted by the Commission on Elections – Wao, Lanao del Sur (COMELEC), in compliance with the orders of the Commission indicated in its Decision dated 15 August 2019.

Facts

On 28 January 2017, COMELEC submitted a Data Breach Notification Report to the Commission which narrated a potential data breach that occurred in its regional field office located in the Municipality of Wao, Province of Lanao del Sur.

According to the report, unidentified men broke into the office and took one of the desktop computer units containing programs used for registration and storage of both sensitive and personal information of registered voters.2

In another letter dated 3 February 2017, COMELEC EDT sent to the Commission a formal data breach report. According to the report, the incident was discovered by MA, who noticed that the door was opened leading to the office of CTL, the EO of Wao, Lanao del Sur and the computer unit installed was missing. Unidentified persons were suspected of gaining entry to the office. The incident was immediately reported to CTL and to the police authorities on the same day.3

The stolen computer contained the following systems and programs:

  1. Voter Registration System (VRS) - the application used by EO to encode the demographic data, and to capture the biometrics data, of applicants for registration. The output of VRS is the list of registered voters for the Municipality of Wao. The VRS contains a total of fifty-eight thousand three hundred and sixty-four (58,364) registration records for the Municipality of Wao.

  2. Voter Search (VS) – the application uses the National List of Registered Voters to determine if an applicant is already registered in the same, or another, city/municipality to enable the EO to advise the applicant which of the following application should be filed such as registration, reactivation, transfer/transfer with reactivation, change/correction of entries, and inclusion/reinstatement of records in the list of voters.

  3. National List of Registered Voters (NLRV) - the database containing the demographics data, with no biometrics data, of all registered voters in the country (both active and deactivated). The NLRV contained approximately seventy-five million eight hundred ninety-eight thousand three hundred and thirty-six (75,898,336) records as of 17 October 2016.4

Both the VRS and NLRV contains personal and sensitive personal information, specifically as follows: Name; Sex; Civil Status; Name of spouse, if married; Precinct and Precinct Code; Address (Street, Barangay, City/Municipality, and Province); and Birthday.

On 07 February 2017, the Commission issued an Order5 for on-site Examination of Systems and Procedures to obtain more information in connection with the robbery incident in the Municipality of Wao. The Commission ordered the OEO (OEO) of the COMELEC in Taguig and Muntinlupa City to cooperate with the investigation and allow the on-site examination of its systems and procedures by officials and representatives of the Commission.

On 08 February 2017, the Commission conducted the on-site examination in the COMELEC office in Taguig City. A preliminary report on the on-site inspection was submitted by the Commission on 09 February 2017.

On 10 February 2017, the Commission En Banc issued a Compliance Order6, ordering COMELEC to erase all NLRV RV in the computer systems in different municipalities and cities and to notify the affected data subjects, among others. COMELEC was also ordered to submit its proposed revised measures in the voters’ registration process in keeping with the Data Privacy Act (DPA) and other issuances of the Commission.

On 28 February 2017, EDT submitted to the Commission a Compliance Report in response to the Compliance Order dated 10 February 2017. The report stated the modifications implemented in the VRS, VS, and NLRV systems of the COMELEC in terms of registration of voters and access to the system. COMELEC also stated that it has notified the affected data subjects through publication of the notice through newspapers of general circulation in the Philippines. For those with records in the VRS in the Municipality of Wao, notification was done individually.7

On 09 February 2018, CTL received from the Commission a fact-finding report recommending him to be held liable for negligence in relation to the robbery incident and the purported concealment of the data breach incident to the Commission and the data subjects.

On 12 March 2018, CTL executed an affidavit contending that he was not negligent from the moment he assumed the duties as an EO of Wao, Lanao del Sur. According to CTL, he implemented necessary precautions to ensure security of the office such as installing padlocks, assigned a casual officer to ensure security of the office, and installed strong passwords on the computer. CTL also stated that he immediately informed the PES ANY, of the incident the day after. He also went to the police station of the Municipality of Wao on the same day the robbery occurred to report the incident.

On 15 August 2019, the Commission En Banc promulgated its Decision ruling that there was no negligence on the part of CTL as he was able to implement reasonable and appropriate security measures to prevent the taking of the desktop computer containing personal data. The Commission held that, with COMELEC’s continued efforts to strengthen security measures, there was insufficient evidence to warrant a criminal prosecution for providing access due to negligence.8

The Commission also ruled that there was no concealment of the personal data breach. Based on the case records, the incident was reported to the superiors of the office on the same day it was discovered by its employees. The policemen in the locality were also apprised of the incident and immediately conducted an investigation.

Further, the Commission ordered COMELEC to comply with the following orders within thirty (30) days from receipt of the decision:

  1. The designation of Data Protection Officers/Compliance Officers for Privacy for every Regional Unit and the names and contact information thereof;

  2. A copy of its Security Incident Management Policy, pursuant to Sections 4 and 5 of NPC Circular 16-04, including documents demonstrating:

a. Creation of its Breach Response Team, and the composition of thereof;

b. Dissemination of this Security Policy to all election field offices;

  1. Complete Post-Breach Report on its management of this Personal Data Breach in compliance with Section 9 of NPC Circular 16-03.9

In a letter dated 07 December 2019, COMELEC submitted its compliance along with the pertinent attachments as proof of compliance with the orders of the Commission.

Discussion

The Compliance submitted by COMELEC conforms with the orders of the Commission.

In its Compliance Letter dated 07 December 2019, COMELEC attached the List of Data Protection Officers/Compliance Officers for Privacy of every Regional Unit with their contact information. COMELEC also attached their Security Management Policy and Post-Breach Report.

The List of Data Protection Officers/Compliance Officers for Privacy of every Regional Unit with their contact information and their functions was embodied in COMELEC’s Memorandum addressed to all REDs with the subject Security Measures and Controls on Data Privacy dated 01 February 2017.

In terms of their Security Management Policy, the said Memorandum also contains the interim security measures and controls to be implemented by all field offices which states that the access to personal data be restricted to the heads of filed office concerned and their duly representatives. It also included protocols on access of personal data such as logging of date, time, purpose of such access, and nature of data accessed, among others.

Further, the Memorandum ordered for the accountable officers to protect personal data from loss; and unauthorized access, disclosure, alteration or misuse.9 COMELEC also provided proof that the Security Measures and Controls on Data Privacy is disseminated to all election field offices.10 A copy of the Memorandum dated 30 June 2017 was also attached addressed to all RED’s, PES’s, and EO’s ordering the immediate compliance to their Security Incident Management Policy.

Additionally, COMELEC also provided the copy of the Memorandum11 stating that in the Minute Resolution 17-0110, COMELEC’s Commission En Banc approved the recommendations of their Data Protection Officer (DPO), EDT. Part of the DPO’s recommendation stated that the ARMM Compliance Officer (ARMM-CO) shall issue the notices to the registered voters whose personal information were affected by the incident. The ARMM-CO shall also coordinate with the Administrative Services Department and the Finance Service Department on the logistical requirements for purposes of complying to the sending of notices to the data subjects.12

Moreover, the Memorandum also stated that the appointed the Response Team consists of the Executive Director, Finance Services Department, Administrative Service Department, and Information Technology Department.

COMELEC has also distributed to the field offices COMELEC ICT Policy No. ICT-2017-001 which is the Field Office Systems and Data Policy. This is the new system adopted by COMELEC for VR. According to a Technical Report issued by the Commission’s Enforcement Division (EnD), the technical measures employed by COMELEC are sufficient to prevent future data exploits.13

In its Post-Breach Report, COMELEC documented the actions it implemented since the occurrence of the breach incident.14 COMELEC included a copy of the Memorandum dated 23 January 2017 with the subject Report on NPC Workshop-Conference. The Report includes the finalization of their Privacy Impact Assessment (PIA) submitted to the Commission on 27 February 2017.

Further, among the actions taken was the installation of CCTV cameras in all field offices as an added security measure. According to COMELEC, there will be series of seminars in relation to security measures and data protection in connection with the DPA. There will also be an introduction of a new program for the COMELEC VR system which will improve the current VRS and VS systems.15

Through careful review and evaluation of the contents of the Compliance submitted, this Commission finds that the submissions and actions implemented by COMELEC are adequate, sufficient, and compliant to its order indicated in its Decision dated 15 August 2019.

Moreover, this Commission would like to take this opportunity to remind Personal Information Controllers (PICs), specially government agencies whose processing of personal and sensitive personal information, that establishing a resilient organizational, physical, and technical security measures and data privacy policies intended to prevent or minimize the occurrence of a data breach is important aspect of abiding by our mandates.16 This Commission reiterates that such measures are not only designed for legal compliance but more importantly it aims to protect both the PICs and data subjects from the possibility and/or effects of a data breach.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 17-002 “In re: COMELEC Data Processing System In Wao, Lanao Del Sur” is hereby considered CLOSED.

SO ORDERED.

Pasay City, Philippines; 08 July 2021.

JOHN HENRY D. NAGA Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

JMTJR Data Protection Officer and Executive Director COMELEC

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Compliance letter dated 07 December 2019. ↩

  2. Letter by COMELEC Executive Director dated 28 January 2017. ↩

  3. Data Breach Notification Report submitted by COMELEC Office of the Executive Director dated 3 February 2017. ↩

  4. Id. at p. 3. ↩

  5. Order for On-site Examination of Systems and Procedures dated 7 February 2017. ↩

  6. Compliance Order dated 10 February 2017. ↩

  7. Compliance Order submitted by COMELEC dated 28 February 2017. At p. 2 and 4. ↩

  8. Decision dated 15 August 2019. At pp. 6 to 7. ↩

  9. COMELEC Memorandum: Security Measures and Controls on Data Privacy dated 01 February 2017. ↩ ↩2

  10. Proof of sending Security Measures and Controls on Data Privacy through e-mail, Compliance Report. ↩

  11. COMELEC Memorandum: Data Breach in Wao, Lanao del Sur dated 05 December 2019. ↩

  12. Id. at p. 1. ↩

  13. Technical Report on BN 17-002 In re: Data Breach Notification dated 28 January 2017 of the COMELEC. ↩

  14. Memorandum issued by COMELEC Main Office regarding the breach incident in Wao, Lanao Del Sur dated 20 February 2017, Compliance Report. ↩

  15. Id. ↩

  16. Section 20 of R. A. 10173 or the Data Privacy Act of 2012 ↩

Backlinks

  • No backlinks found