Resolution Text
IN RE: SOCIAL SECURITY SYSTEM
x-----------------------------------------------x
NAGA, D.P.C.:
This Resolution refers to the data breach notification report that the Commission received from the Social Security System (SSS)1 dated 04 November 2017 involving the unauthorized disclosure of personal information of an SSS member.
Facts
On 16 November 2017, this Commission received a breach notification report from SSS dated 04 November 2017 involving the unauthorized disclosure of personal information of MSA, a member of SSS. The Senior Representative of SSS Malolos Branch, FCPJ, posted the Member Data Form (E-1) of MSA on the Facebook Page “Malayang Kawani ng SSS” on 29 March 2017. The aforementioned posting was reported to the SSS by a concerned employee on 28 October 2017.
The E-1 Form contained the following personal information of MSA: (1) Name of SSS Member; (2) Address; (3) Social Security Number; (4) Birth date; (5) Parents’ Name; (6) Beneficiaries; and (7) Specimen Signature.
To address the data breach that had occurred, FL, SSS Malolos Branch Head, called the attention of FCPJ and required him to delete the post. On 03 November 2017, FL and FCPJ went to the residence of MSA to explain the incident and apologize.
To prevent further occurrence of the breach, GS, the Data Protection Officer (DPO) of SSS and members of the Data Breach Response Team requested the assistance of the Facebook Page administrators to confirm the deletion of the post. Also, the administrators were requested to become advocates of data privacy and exercise vigilance in ensuring that their page is in compliance with the Data Privacy Act of 2012 (DPA).
The affected data subject did not file any complaint in relation to the said breach.
On 15 August 2019, this Commission issued a Resolution2 disposing, thus:
“WHEREFORE, premises considered, this Commission finds that no further action is necessary in this case, without prejudice to such other relief in case of new information. The SSS is ORDERED to submit a complete report on its management of this Personal Data Breach in compliance with Section 9 of Circular 16-03, within thirty (30) days from receipt of this Order.”
On 11 October 2019, SSS submitted a Compliance Report3 dated 09 October 2019 before this Commission.
Discussion
The Compliance Report submitted by SSS is deemed sufficient.
The SSS Compliance Report contained the following attachments:
- Incident Report submitted by the Head of SSS Malolos Branch;
- Photos of the SSS Malolos Branch Head, together with the Senior Member Service Representative (MSR) and OIC Section Head, who personally informed and apologized to the data subject about the incident on 03 November 2017;
- Hand-written letter of the affected data subject dated 03 November expressing his intention not to file complaint against Senior MSR now or in the future;
- Proof of confirmation by the administrators of the Malayang Kawani ng SSS Facebook page on 03 November 2017 of the deletion of the post from page on 30 March 2017;
- Data Breach Notification Report submitted to NPC on 04 November 2017, thru email; and
- Office Memorandum confirming the conduct of series of seminars to SSS Personnel on Data Privacy Act of 2012 from 26 October 2017 to 17 January 2018.
As provided in Section 9 of the NPC Circular 16-03, all actions that are implemented by a Personal Information Controller (PIC) shall be properly documented, which shall include the following:
A. Description of the personal data breach, its root cause and circumstances regarding its discovery; B. Actions and decisions of the incident response team; C. Outcome of the breach management, and difficulties encountered; and D. Compliance with notification requirements and assistance provided to affected data subjects.
A procedure for post-breach review must be established for the purpose of improving the personal data breach management policies and procedures of the personal information controller or personal information processor.4
In the attached Incident Report and Data Breach Notification Report, SSS has identified description of the personal data breach, its root cause and discovery. SSS stated in the Reports that the posting was done in a Facebook Closed Group and was made by FCPJ with no malicious intent as he only seeks clarification and advice from the SSS employee using the E-1 Form of MSA. Upon discovery, the PIC immediately reached out to FCPJ and requested him to delete the post.
Furthermore, this Commission finds that the SSS through their Malolos Branch Head with their Senior MSR and OIC Section Head, have effectively informed the affected data subject of the incident by personally appearing to explain and apologize to him. With this, the Commission notes the attached hand-written letter of the affected data subject expressing his intention not to file complaint in relation to the breach.
In terms of the remediation measures, SSS has implemented sufficient measures, such as providing proof of confirmation by the administrators of the Malayang Kawani ng SSS Facebook page of the deletion of the post, as well as their compliance to the Notification Requirement through the timely submission of the Data Breach Notification Report before this Commission.5
In addition, to improve their data breach management and to prevent similar incidents in the future, SSS conducted a series of seminars to acquaint their personnel with the DPA, its IRR, and other related issuances of this Commission.
Through careful review and evaluation of the contents of the report submitted, this Commission finds that the abovementioned submission and actions implemented by SSS are adequate, sufficient, and compliant to its order indicated in its Resolution dated 15 August 2019.
Moreover, this Commission takes this opportunity to stress to PICs, specifically to government agencies whose processing of personal and sensitive personal information are vital in fulfilling their mandate, the significance of implementing robust organizational, physical, and technical security measures and data privacy policies intended to prevent or minimize the occurrence of a data breach.6 Such measures are not only designed for legal compliance but more importantly it aims to protect both the PICs and data subjects from the possibility of a data breach.
WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 17-032 “In re: SSS” is hereby considered CLOSED.
SO ORDERED.
Pasay City, Philippines; 21 January 2021.
JOHN HENRY D. NAGA Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
Copy furnished:
JAV Data Protection Officer SSS
GMJDS Data Protection Officer, VP – Program Services Division SSS
RCG Data Protection Officer SSS
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission
Footnotes
-
SSS Breach Notification Report dated 04 November 2017 ↩
-
Resolution dated 15 August 2019 ↩
-
SSS Compliance with NPC Resolution dated 15 August 2019 “Re: Data Breach Notification of SSS” NPC BN 17-032, dated 09 October 2019 ↩
-
Section 9 of NPC Circular 16-03 ↩
-
Section 17 of the NPC Circular 16-03 ↩
-
Section 20 of R. A. 10173 or the Data Privacy Act of 2012 ↩