NPC Issuance Wiki

NPC BN 18-198: In re: Cathay Pacific Airways Limited

Issued Resolution

Resolution Text

IN RE: CATHAY PACIFIC AIRWAYS LIMITED

x----------------------------------------------------x

AGUIRRE, D.P.C.;

This Commission resolves the sufficiency of notification of the data subjects and the evidence of such notification submitted by Cathay Pacific Airways Limited (Cathay Pacific) in line with NPC Circular No. 16-03 (Personal Data Breach Management).

Facts

On 18 March 2021, the Commission ordered Cathay Pacific to submit evidence of notification to the affected data subjects in or from the Philippines and explain any discrepancy between its analysis of the number of affected data subjects, exposed passport numbers, and accessed credit card numbers:

WHEREFORE, all premises considered and pursuant to the requirements of Section 18(A) and Section (D) of Circular No. 16-03, the Commission ORDERS Cathay Pacific Airways Limited to submit evidence of notification to the affected data subjects in or from the Philippines and explain any discrepancy from its abovementioned analysis of affected data subjects, exposed passport numbers, and accessed credit card numbers within fifteen (15) days from receipt of this Order.

SO ORDERED.1

On 28 April 2021, Cathay Pacific submitted its response to the Order dated 18 March 2021. It explained the following:

  1. There is no inconsistency between the number of reported notifications and the total number of its affected data subjects. The affected data subjects who were neither notified by email nor by post were notified on 24 October 2018 by general notice posted on the Cathay Pacific website.

  2. On 28 October 2018, it completed notification by email its affected data subjects for whom it had email addresses of.

  3. On 12 November 2018, it completed notification by post its affected data subjects for whom it had postal addresses of.

  4. It no longer retains details of the email notifications that were sent to its affected data subjects. It engaged Acoustics, an email service provider, to send email notifications in 2018. The records, however, have been purged and are therefore no longer available. It attached a screenshot of Acoustics’ setting page showing the retention period set for Cathay Pacific’s account and its Data Retention Policy, and a screenshot of Acoustics records page showing that the records have been deleted from the system.

  5. It committed to submit proof of postal notifications as soon as it receives such from Experian, the printing house it engaged to send out postal notifications.2

On 31 May 2021, the Commission, through its Enforcement Division (EnD), sent an Enforcement Letter to Cathay Pacific. It explained to Cathay Pacific that although Acoustics had already purged its records, it remains incumbent upon Cathay Pacific to prove that notification of its affected data subjects took place.3 It also informed Cathay Pacific that it required further proof that Cathay Pacific posted the general notice on its website.4 As a result, the Commission, through the EnD, ordered Cathay Pacific to submit the following documents:

Taking into consideration the foregoing remarks, you are ordered to submit the following within FIFTEEN (15) days from the receipt of this letter:

  1. Evidence of notification to the affected data subjects from Experian.

  2. Affidavit of the sender attesting to the truth that the notifications were sent through electronic mail to the 64,305 affected data subjects.

  3. Proof of publication of the general notification in Cathay’s Website.

  4. A corrected version of “Annex A” as there is a distorted page which renders it unreadable.5

On 22 June 2021, Cathay Pacific submitted the following compliance documents in response to the Enforcement Letter dated 31 May 2021:

  1. Evidence of notification by post to the affected data subjects, for whom it had postal addresses of, in the form of invoices issued by Experian.

  2. An affidavit executed by the Head of Customer Experience - Digital, LOA, affirming that Cathay Pacific notified by email its affected data subjects for whom it had email addresses of.

  3. Proof of publication of the general notification on its website.

  4. Contents of the general notification published on its website and the individual notification sent by email and by post to its affected data subjects.

  5. A corrected version of “Annex A”, which refers to its Data Retention Policy.6

Discussion

The Commission finds sufficient Cathay Pacific’s notification of its affected data subjects and the evidence of such notification that it submitted pursuant to the Order dated 18 March 2021. The Commission also finds Cathay Pacific’s explanation on the consistency between the number of reported notifications and the total number of its affected data subjects to be satisfactory.

Section 18(C) of NPC Circular No. 16-03 provides the necessary contents of the notification to the affected data subjects:

SECTION 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

x x x

C. Content of Notification.

The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.7

The contents of the general notice published on the Cathay Pacific website and the individual notifications by post and by email that Cathay Pacific issued satisfy these requirements. These notices contained sufficient information on the nature of the breach incident, the personal data involved, the measures Cathay Pacific took to address the breach and reduce harm or negative consequences of the breach, and the assistance it extended to its affected data subjects.8

In its efforts to mitigate the negative consequences of the breach incident, Cathay Pacific offered a twelve-month complimentary identity monitoring services to its affected data subjects to monitor if the affected data subject’s personal data are available on public websites, chat rooms, blogs, and non-public places on the internet.9 It also advised its affected data subjects to change their passwords regularly, check for any suspicious activities, and remain vigilant against phishing and other attempted scams.10

Section 18(D) of NPC Circular No. 16-03 requires a personal information controller (PIC) to establish all reasonable means to ensure that its affected data subjects are notified of the breach incident:

SECTION 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

x x x

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.11

The Commission recognizes that Cathay Pacific took considerable efforts to fulfill the mandatory notification requirement under NPC Circular No. 16-03. Cathay Pacific conducted the notification by email, by post, and by posting a general notice on its website.12 Despite the large number of individuals affected in the breach incident, Cathay Pacific employed a variety of means to ensure that all its affected data subjects were notified of the breach incident in compliance with Section 18(D) of NPC Circular No. 16-03.

Cathay Pacific likewise complied with the Commission’s Order dated 18 March 2021. It submitted sufficient evidence to prove that it notified its affected data subjects of the breach incident. The Commission deems sufficient the evidence that Cathay Pacific submitted in line with the Order dated 18 March 2021.

Considering the foregoing, the Commission finds that Cathay Pacific complied with the mandatory notification requirement of its affected data subjects pursuant to Section 18 of NPC Circular No. 16-03.

WHEREFORE, premises considered, the Commission hereby finds that Cathay Pacific Airways Limited has sufficiently notified its affected data subjects and complied with the Order dated 18 March 2021. This Commission hereby considers the matter CLOSED.

SO ORDERED.

City of Pasay, Philippines. 23 September 2021.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

JOHN HENRY D. NAGA Deputy Privacy Commissioner

Copy furnished:

Atty. PRC Betita, Cabilao, Casuela, Sarmiento Law Counsel of Cathay Pacific Airways Limited

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Order, 18 March 2021, at 18, in In re: Cathay Pacific Airways Limited, NPC BN 18-198. ↩

  2. Compliance Report from BCCS Law to National Privacy Commission (28 April 2021), at 1-2. ↩

  3. Enforcement Letter from Enforcement Division, National Privacy Commission to Cathay Pacific Airways Limited (31 May 2021), at 2. ↩

  4. Id. at 2. ↩

  5. Id. ↩

  6. Compliance Report from BCCS Law to National Privacy Commission (22 June 2021), at 2. ↩

  7. National Privacy Commission, NPC Circular No. 16-03, “Personal Data Breach Management” [NPC Circ. No. 16-03], § 18(C) (15 December 2016). Emphasis supplied. ↩

  8. Proof of Publication of General Notice from Cathay Pacific Airways Limited (24 October 2018), at 2; Final Individual Notice from Cathay Pacific Airways Limited, at 2. ↩

  9. Id. ↩

  10. Id. ↩

  11. NPC Circ. No. 16-03, § 18(D). Emphasis supplied. ↩

  12. BCCS Law, supra note 6. ↩

Backlinks

  • No backlinks found