NPC Issuance Wiki

NPC BN 20-049: In re: Health Delivery System, Inc.

Issued Resolution

Resolution Text

IN RE: HEALTH DELIVERY SYSTEM, INC.

NPC BN 20-049

x--------------------------------------x

LIBORO, P.C.:

For the Resolution of this Commission is the Compliance submitted by Health Delivery Systems Inc. (HDSI) to the Resolution dated 01 June 2021 issued by the Commission.

Facts

On 01 June 2021, this Commission issued a Resolution to HDSI containing the following dispositive portion, viz:

WHEREFORE, premises considered, the Commission resolves to GRANT a final and non-extendible extension of thirty (30) days from 19 May 2021 or until 18 June 2021 for Health Delivery System, Inc. to produce and submit the document specified in the Resolution dated 25 March 2021.

Failure to comply with the foregoing shall cause the Commission to adjudicate on the basis of the evidence on record.

On 18 June 2021, the Commission received the notarized Letter-Attestation dated 04 April 2020 of Mr. FN of CSB at PDM from HDSI.

According to Ms. SNR, HDSI’s Legal Officer/OIC-Data Privacy Officer, the Letter-Attestation was authenticated by a public notary in Milan, Italy. They were informed that apostillation of such document was not recognized by the public prosecutors who conduct such process in Milan, hence, they have advised that they are still looking into the possibility of performing such process. She assured that they shall inform the Commission should they receive any update regarding this and hoped that the Commission will consider favorably the submitted document.

On 30 June 2021, HDSI submitted the apostilled version of the Letter-Attestation dated 04 April 2020 of Mr. FN, which was allowed to be apostilled by the Italian Embassy in Milan on 22 June 2021.

Issue

Whether or not the request for exemption from the requirement of notification of affected data subjects filed by HDSI should be granted.

Discussion

The initial compliance submitted by HDSI on 18 June 2021 is not compliant with the Order of the Commission in its Resolution dated 25 March 2021. On 30 June 2021, HDSI belatedly submitted the apostilled Attestation Letter dated 04 April 2020 of Mr. FN of CSB at PDM.

The translation of the authenticated portion of the apostilled Attestation Letter states that the document presented to the notary public which is the Attestation Letter is a certified copy of the original exhibited to him. It does not even certify that the signature of Mr. FN in the document was authentic which is what the Commission needs in order to determine the authenticity and due execution of the Attestation Letter to help it decide whether or not to grant the request for exemption of notification to the affected data subjects filed by the PIC.

This Commission resolves to deny the request for exemption from the requirement of notification to the affected data subjects filed by HDSI.

Upon careful perusal of the apostilled Attestation Letter submitted by HDSI, this Commission finds that the notification to the affected data subjects is necessary.

In the Attestation Letter,1 Mr. FN confirmed that they were running a project which is gently scanning the publicly available and potentially misconfigured data sources. He stated that it is purely motivated by research purposes, amongst other publicly available sources of data, they accessed ETH Server on 21 March 2021.2 Furthermore, he alleged that they designed the experiment to download a minimal amount of information from the systems they contact, and they did not maintain any record nor gathered any information on any of the accessed systems.3 All information and data they acquired from the ETH server has been purged from their systems. What they retained were only a statistical analysis of the data, aggregated with the data of all other systems they analyzed in the course of their project.4

Mr. FN further attested that they will not use any of the data to harm the affected data subjects and that they have not or will not use this data for financial fraud, spam, identity theft, or any other purposes that may cause harm to the data subjects. He stated that they have purposefully designed the experiment to make this impossible, to the fullest extent of their ability.5

Moreover, their statistical analysis will be exclusively for academic and scientific purposes and will be published only in aggregated form to further academic research and to provide security considerations and suggestions. No personally identifying information will ever be released. The only form of release will be scientific and academic publication.6

With these statements in the Attestation Letter, HDSI is requesting for exemption from notification of affected data subjects.

Even assuming the authenticity and due execution of the Attestation Letter, based on its contents, this Commission finds that the justification for the request for exemption from the requirement of notification to the affected data subjects is insufficient to show that the notification would not be in the public interest or in the interest of the affected data subjects. Even if it is for research purposes, it is undisputed that a breach has occurred, and the data compromised contained personal and sensitive personal information. Therefore, a breach notification to the affected data subjects is necessary.

This Commission notes that the purpose of the required notification to the affected data subjects of a breach incident is for them to protect themselves against possible negative consequences or effects of the data breach. That is why if the PIC cannot prove that it will not be in the public interest or in the interest of the affected data subjects, a breach notification is required.

The Commission reiterates that notification of the data subjects is the general rule. Section 18(B) of NPC Circular No. 16-03 provides that, “a personal information controller may be exempted from notification requirement where the Commission determines that such notification would not be in the public interest or in the interest of affected data subjects.”

As to the manner of notification to the affected data subjects, Section 18(A) of NPC Circular No. 16-03 provides that:

The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred. The notification may be made on the basis of available information within the 72-hour period if the personal data breach is likely to give rise to a real risk to the rights and freedoms of data subjects. It shall be undertaken in a manner that would allow data subjects to take the necessary precautions or other measures to protect themselves against the possible effects of the breach. It may be supplemented with additional information at a later stage on the basis of further investigation.7

Moreover, Section 18(D) of the same Circular provides that:

Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.8

The Commission, in its Resolution for NPC BN 20-161, emphasized the importance of ensuring that affected data subjects receive timely notification, viz:

It is noteworthy that the avowed purpose of the required notification to data subjects of a breach incident is for them to take the necessary precautions or other measures to protect themselves against possible effects of the breach. Moreover, personal information controllers (PICs) are required to establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach. It therefore follows that PICs should guarantee that the notification they sent to data subjects has been received. Otherwise, it defeats the very purpose of notification of data subjects.9

Notification of the affected data subjects in cases of personal data breach is an essential obligation in data privacy protection. Section 20(f) of the DPA of 201210 states that:

SEC. 20. Security of Personal Information. –

xxx

(f) The personal information controller shall promptly notify the Commission and affected data subjects when sensitive personal information or other information that may, under the circumstances, be used to enable identity fraud are reasonably believed to have been acquired by an unauthorized person, and the personal information controller or the Commission believes that such unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.

The notification shall at least describe the nature of the breach, the sensitive personal information possibly involved, and the measures taken by the entity to address the breach.

Notification may be delayed only to the extent necessary to determine the scope of the breach, to prevent further disclosures, or to restore reasonable integrity to the information and communications system.

This Commission finds no merit in granting the request for exemption from the notification of the affected data subjects by HDSI.

HDSI failed to adduce sufficient evidence for this Commission to conclude that granting the request for exemption from the notification of the affected data subject would not cause harm or negative consequences to the affected data subjects. HDSI also failed to prove that granting the request for exemption from the notification of the affected data subject would not be in the public interest or in the interest of the affected data subjects.

WHEREFORE, premises considered, the instant request for exemption from the requirement of notification of affected data subjects dated 13 April 2020 filed by Health Delivery Systems Inc. is hereby DENIED.

Health Delivery Systems Inc. is hereby ORDERED to comply with the following within fifteen (15) days from receipt of this Resolution:

  1. NOTIFY the affected data subjects; and

  2. SUBMIT proof of notification to the data subjects who were affected by the breach, including proof of receipt of the data subjects of the notification.

SO ORDERED.

Pasay City, Philippines. 01 July 2021.

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

JOHN HENRY D. NAGA Deputy Privacy Commissioner

Copy furnished:

SNR Legal Officer / OIC-Data Privacy Health Delivery System, Inc.

RJR Data Protection Officer Health Delivery System, Inc.

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Attestation Letter dated 04 April 2020 submitted by Mr. FN, PH ↩

  2. Id at pp. 1-2. ↩

  3. Id at pp. 2 ↩

  4. Ibid. ↩

  5. Ibid. ↩

  6. Ibid. ↩

  7. National Privacy Commission, Personal Data Breach Management, Circular No. 16-03 (December 15, 2016). Emphasis supplied. ↩

  8. Id. Emphasis supplied. ↩

  9. NPC BN 20-161, 17 December 2021. ↩

  10. An Act Protecting Individual Personal Information In Information And Communications Systems In The Government And The Private Sector, Creating For This Purpose A National Privacy Commission, And For Other Purposes [Data Privacy Act], Republic Act No. 10173 (2012). ↩

Backlinks