NPC Issuance Wiki

NPC BN 18-037: In re: Acesite (Phils.) Hotel Corporation

Issued Resolution

Resolution Text

IN RE: ACESITE (PHILS.) HOTEL CORPORATION

x-----------------------------------------------x

NAGA, P.C.;

Before the Commission is the compliance of Acesite (Phils.) Hotel Corporation (Acesite) in relation to the Resolution dated 15 April 2021 of the Commission.

Facts

Acesite is the entity that operates the Waterfront Manila Pavilion Hotel and Casino.1 It reported that on 18 March 2018, a significant portion of its hotel was razed by fire.2 The fire “caused damage to properties of the Hotel, which includes several records containing several data pertaining to the Hotel operations [and] its employees, among others.”3 Acesite identified the following personal data possibly affected by the fire:

  1. Name of guest and employees
  2. Contact Numbers
  3. Email Addresses
  4. Copies of IDs and Passports
  5. Credit Card Details:
    • Name of Cardholder
    • Masked Card Numbers
    • Signature of the Guest
  6. Employee Payroll Details:
    • Employee ID Numbers
    • SSS Contributions HDMF Contributions
    • Philhealth Contributions
    • SSS ID Numbers
    • Tax Identification Numbers
    • Pag-ibig (HDMF) Numbers4

The Commission, through its Complaints and Investigation Division (CID), ordered Acesite to submit a Full Breach Report (Updated Report) pursuant to NPC Circular No. 16-03.5 Particularly, the Order dated 21 January 2021 required Acesite to provide more details on the breach:

Pursuant to the National Privacy Commission (NPC) Circular No. 16-03 on Personal Data Breach Management, you are hereby required to submit an Updated Report expounding the details of the incidents with emphasis supplied on the lacking information from the initial notification reports we received and attaching the specified documents to further help with the investigation of the data breach incident:

  1. Nature of the Breach

    a. Description or nature of the personal data breach; b. Description of how the breach occurred and the vulnerability of the data processing system that allowed the breach; c. A chronology of the events leading up to the loss of control over personal data; d. Approximate number of individuals and/or personal records affected; e. Description of the likely consequences of the personal data breach on the institution, data subjects and the public; f. Description of safeguard in place that would minimize harm or mitigate the impact of the personal data breach;

    • Attach and specify on a report the changes in the data privacy and security policy after the incident particularly on the storage and availability of personal data; g. Name and contact details of the data protection officer or any other accountable persons.

  2. Personal Data Possibly Involved

    a. List of the sensitive personal information involved; b. List of other information involved that may be used to identity fraud;

  3. Remedial Measures Taken Subsequent to Suspected Breach

    a. Description of the measures taken or proposed to be taken to address the breach; b. Actions being taken to secure or recover the personal data that were compromised; c. Actions performed or proposed to mitigate or limit the possible harm or negative consequences, damage or distress to those affected by the incident; d. Actions being taken to inform the data subjects affected by the incident or reasons for any delay in the notification in accordance with Section 21 of the said Circular; e. The measures being taken to prevent a recurrence of the incident.

    • Physical, organizational and technical measures undertaken after the incident, as well as proof thereof.
    • Where is your backup storage located prior to and after the incident?6

On 15 April 2021, this Commission issued a Resolution with the following dispositive portion:

WHEREFORE, premises considered, Acesite (Phils.) Hotel Corporation is hereby ORDERED to comply with the following within fifteen (15) days from receipt of this Resolution:

  1. SUBMIT its Updated Report with the contents required in the Order dated 21 January 2021; and
  2. SUBMIT proof and details of the measures taken to address the breach, such as but not limited to, details of implementation of isolated backup storage, information asset inventory, and Privacy Impact Assessment (PIA).

SO ORDERED.7

Acesite thereafter submitted a Compliance dated 19 May 2021.8 The Compliance attached the following documents: 1) an “Updated Report as of [19 May] 2021”,9 2) proof and details of measures taken to address the personal data breach,10 3) “Personal Data Inventory/Information Asset Inventory”,11 4) Systems Inventory,12 and 5) a Privacy Impact Assessment (PIA) which was “initial and unofficial”.13

The Enforcement Division (EnD) of the Commission wrote a letter dated 17 March 2022 to Acesite informing it about the need to submit a PIA, which stated in part:

[A]fter due assessment, it was found that Acesite failed to submit the requested final and official PIA. While Acesite claimed that it is still in the process of rebuilding and its business has not officially opened as of the submission of its report, we note that an organization does not necessarily need to resume normal operations before the conduct of a PIA.14

Thus, Acesite was directed to submit its “final and official [PIA] within a non-extendible period of [fifteen] (15) days” from receipt of the letter.15

On 01 April 2022, Acesite submitted through email, a PIA Report.16 On 06 June 2022, EnD issued a letter directing Acesite to furnish a copy of the process flowchart within ten (10) calendar days from receipt of the letter.17

On 21 June 2022, Acesite submitted its process flow chart and description of processing activities.18

Issue

Whether Acesite has sufficiently complied with the 15 April 2021 Resolution of the Commission.

Discussion

In the Resolution dated 15 April 2021 (Resolution), Acesite was required to submit the following documents: 1) Updated Report with the contents required by the Commission, through the CID, in the Order dated 21 January 2021; and 2) “proof and details of the measures taken to address the breach”, including a PIA.19

The Commission finds Acesite’s submissions to be sufficiently compliant with the Resolution.

I. Acesite sufficiently provided details required by the Commission in its Updated Report.

In its Resolution, the Commission required Acesite to submit the lacking information “to identify whether adequate actions were implemented” by Acesite to avoid further damage and recurrence of similar incidents, and for the protection of the rights of the data subjects.20 The Commission also stated that the information will help in the improvement of Acesite’s personal data breach management policies and procedures.21

In compliance with the CID’s Order and this Commission’s Resolution, Acesite submitted its Updated Report on 19 May 2021 containing details on the nature of the breach,22 personal data possibly involved,23 and the measures taken to address the breach.24

In its Updated Report, Acesite stated that when a significant portion of the Hotel was razed by fire, several physical copies of records and data of the Hotel operations, its guests, suppliers, employees, and other stakeholders were damaged.25 Acesite also reported that since the Hotel was very old and lacked proper data storage, its data processing system was vulnerable to a breach.26

Further, Acesite stated that there was an estimated number of more than two hundred thousand (200,000+) affected individuals, which was based on the number of personal records damaged by the fire.27 Moreover, as to the consequences of the breach, Acesite identified that there would be permanent destruction of its records for its relevant stakeholders.28 Particularly for data subjects, Acesite reported the unavailability and permanent loss of their documents.29

To mitigate the impact of the breach, Acesite stated that it will use “cloud-based data storage and off-site data back-up system” and limit the collection of sensitive information.30

Additionally, Acesite claimed that the sensitive personal information involved may no longer be used for identity fraud since all files pertaining to those information were permanently destroyed by fire.31

Acesite further stated that it had notified affected data subjects about the incident and measures taken, including assurances that there was no data leak due to the incident.32 The notification was through “publications in newspapers, social media, public appearances, and televised conferences.”33

Lastly, to prevent the recurrence of the incident, Acesite reported the following measures:

i. Physical measures. The physical measures that Acesite is currently exploring is the use of online forms and documentation and fireproof data storage for documents which are required to be in printed form.

ii. Organizational Measures. The organizational measures include, but not limited to, the appointment of a Compliance Officer for Privacy who will supervise and monitor the assessment, drafting of policy, formulating data processing systems, and implementation of data privacy measures in the organization.

iii. Technical Measures. The technical measures include, but not limited to, the use of off-site and cloud-based data storage and support system. Other technical measures shall be finalized once the official Privacy Impact Assessment is completed.

iv. Back-up storage location before and after incident: The back-up storage location before the incident was in the Hotel. After the incident, the back-up storage will be off-site (Cebu) and cloud based.34

Upon review of the Updated Report, Acesite was able to include the details which were lacking from its initial submission and was able to fully report the incident. Thus, the Commission finds that Acesite sufficiently complied with the CID’s Order dated 21 January 2021 and Resolution by the Commission dated 15 April 2021.

II. Acesite sufficiently provided information on measures taken to address the personal data breach, including a PIA.

In its Resolution dated 15 April 2021, the Commission required Acesite to “[submit] proof and details of the measures taken to address the breach, such as but not limited to, details of implementation of isolated backup storage, information asset inventory, and [PIA].”35

As for the proof and details of the measures taken to address the breach, Acesite stated that it destroyed hard copies of the files which were retrieved after the fire, through methods such as “shredding of guest registration forms, and tinting of other wet files.”36

Acesite further provided files and information pertaining to its personnel data inventory,37 systems inventory,38 and proof that it has an isolated backup storage.39 Particularly, Acesite stated that “as [a] preventive measure against future similar breach/incident, the backup storage of data will now be isolated in a different location and Acesite will use Cloud-based data storage and use of fireproof storage is being considered.”40

Acesite also submitted its PIA in compliance with the Commission’s directives.

NPC Advisory No. 2017-03 defines a PIA as a:

[P]rocess undertaken and used to evaluate and manage impacts on privacy of a particular program, project, process, measure, system or technology product of a PIC or PIP program, project, process, measure, system or technology product of a PIC or PIP. It takes into account the nature of the personal data to be protected, the personal data flow, the risks to privacy and security posed by the processing, current data privacy best practices, the cost of security implementation, and, where applicable, the size of the organization, its resources, and the complexity of its operations.41

To accomplish a PIA, Acesite met with its business unit heads, conducted fieldwork, document reviews, and reported the corresponding findings.42 It included a processing flowchart for various offices that process personal data.43

It had twenty (20) observations with regard to its processing of personal data, with thirteen (13) observations categorized as “severe”, five (5) “major”, one (1) “moderate”, and one (1) “minor”.44

The PIA provided and tabulated the observations, recommendations, and a corresponding management action plan related to the general data privacy principles of transparency, legitimate purpose, and proportionality;45 organizational, physical, and technical security measures;46 and data sharing.47

Through the PIA, Acesite identified various privacy risks that it needed to address, and corresponding measures in order to sufficiently comply with the DPA.

With regard to adherence to the proportionality principle, Acesite indicated the excessive information it collected in various official Acesite forms, particularly in its Employee ID Card when it displays the employee’s Tax Identification Number (TIN) and Social Security Service (SSS) Number.48 Thus, its action plan is to remove these sensitive personal information and revise the template for the Employee ID Card.49

Acesite also identified the need to amend existing contracts and conduct review with its third-party providers to include data sharing and data privacy provisions,50 including service level agreements with third parties.51

The PIA also revealed the need to improve physical security measures to protect personal data, such as the exercise of a “clean desk policy”,52 practicing of data classification and labelling scheme,53 enforce authentication mechanisms to access critical or sensitive personal information,54 and ensuring the proper disposal of personal data including applicable retention policies.55

Technical security measures included the creation of data recovery procedures/business continuity plans,56 periodic review of event logs,57 and implementing an encryption standard of AES-256 when storing or transmitting personal data, and stronger password policies,58 among others.

Thus, based on the records and EnD’s evaluation, Acesite has been able to conduct an adequate PIA in line with NPC Advisory No. 17-03.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-037 “In re Acesite (Phils.) Hotel Corporation” is hereby considered CLOSED.

SO ORDERED.

City of Pasay, Philippines. 22 September 2022.

JOHN HENRY D. NAGA Privacy Commissioner

I CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

JTL Data Protection Officer

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Full Report on the Breach Notification dated 21 March 2018 of Acesite (Phils.) Hotel Corporation, at p. 1. ↩

  2. Id. ↩

  3. Id. ↩

  4. Id., at p. 3. ↩

  5. In Re: Acesite (Phils.) Hotel Corporation, NPC BN 18-037, Order dated 21 January 2021, at p. 1. ↩

  6. Id., at pp. 1-2. ↩

  7. In Re: Acesite (Phils.) Hotel Corporation, NPC BN 18-037, Resolution dated 15 April 2021, at pp. 7-8. ↩

  8. Compliance dated 19 May 2021 of Acesite (Phils.) Hotel Corporation. ↩

  9. Id., referred to as Annex “A”. ↩

  10. Id., referred to as Annex “B”. ↩

  11. Id., referred to as Annex “C”. ↩

  12. Compliance dated 19 May 2021 of Acesite (Phils.) Hotel Corporation, referred to as Annex “D”. ↩

  13. Id., referred to as Annex “E”. ↩

  14. Compliance Letter dated 17 March 2022 of the Enforcement Division, at p. 2. ↩

  15. In Re: Acesite (Phils.) Hotel Corporation, NPC BN 18-037, Compliance Letter dated 17 March 2022, at p. 2. ↩

  16. Privacy Impact Assessment Report of Acesite (Phils.) Corporation submitted on 01 April 2022. ↩

  17. Compliance Letter dated 06 June 2022 of the Enforcement Division, at p. 2. ↩

  18. Letter dated 17 June 2022 of Acesite (Phils.) Hotel Corporation with attached Process Flowchart and Narratives. ↩

  19. In Re: Acesite (Phils.) Hotel Corporation, NPC BN 18-037, Resolution dated 15 April 2021, at pp. 7-8. ↩

  20. Id., at p. 7. ↩

  21. Id. ↩

  22. Compliance dated 19 May 2021 of Acesite (Phils.) Hotel Corporation referred to as Annex “A”, at pp. 1-2. ↩

  23. Id., at pp. 2-3. ↩

  24. Id., at pp. 3-4. ↩

  25. Id., at p. 1. ↩

  26. Compliance dated 19 May 2021 of Acesite (Phils.) Hotel Corporation referred to as Annex “A”, at p. 1. ↩

  27. Id., at p. 2. ↩

  28. Id. ↩

  29. Id. ↩

  30. Compliance dated 19 May 2021 of Acesite (Phils.) Hotel Corporation referred to as Annex “A”, at p. 2. ↩

  31. Id., at p. 3. ↩

  32. Id. ↩

  33. Id.; See Annex “B”, at p. 2. ↩

  34. Compliance dated 19 May 2021 of Acesite (Phils.) Hotel Corporation referred to as Annex “A”, at pp. 3-4. ↩

  35. In Re: Acesite (Phils.) Hotel Corporation, NPC BN 18-037, Resolution dated 15 April 2021 at p. 7. ↩

  36. Compliance dated 19 May 2021 of Acesite (Phils.) Hotel Corporation referred to as Annex “B”, at p. 1. ↩

  37. Id., referred to as Annex “C”. ↩

  38. Id., referred to as Annex “D”. ↩

  39. Id., referred to as Annex “B”. ↩

  40. Compliance dated 19 May 2021 of Acesite (Phils.) Hotel Corporation referred to as Annex “A”, at p. 3. ↩

  41. National Privacy Commission, Guidelines on Privacy Impact Assessments, NPC Advisory 2017-03, in Definition of Terms (31 July 2017) (NPC Advisory 2017-03). ↩

  42. Privacy Impact Assessment Report dated 01 April 2022 of Acesite (Phils.) Hotel Corporation, at p. 2 and p. 27. ↩

  43. Process Flowcharts and Narratives dated 17 June 2022 of Acesite (Phils.) Hotel Corporation. ↩

  44. Privacy Impact Assessment Report dated 01 April 2022 of Acesite (Phils.) Hotel Corporation, at p. 3. ↩

  45. Id., at pp. 29-34; at pp. 42-45. ↩

  46. Id., at pp. 51-76. ↩

  47. Id., at pp. 48-50. ↩

  48. Privacy Impact Assessment Report dated 01 April 2022 of Acesite (Phils.) Hotel Corporation, at p. 45. ↩

  49. Id. ↩

  50. Id., at p. 50. ↩

  51. Id., at p. 52. ↩

  52. Privacy Impact Assessment Report dated 01 April 2022 of Acesite (Phils.) Hotel Corporation, pp. 53-54. ↩

  53. Id., at p. 55. ↩

  54. Id., at p. 56. ↩

  55. Id., at p. 60. ↩

  56. Privacy Impact Assessment Report dated 01 April 2022 of Acesite (Phils.) Hotel Corporation, at p. 68. ↩

  57. Id., at p. 70. ↩

  58. Id., at p. 76. ↩

Backlinks

  • No backlinks found