NPC Issuance Wiki

NPC 19-438: RPR v. Edukasyon.ph

Issued Resolution

Resolution Text

RPR,

Complainant,

-versus-

EDUKASYON.PH,

Respondent.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before the Commission is a complaint filed by RPR for a possible personal data breach committed by Edukasyon.ph (Edukasyon) when it emailed a “thank you letter” to all the participants of one of its events.

Facts

RPR participated in the Amazon Web Services Siklab Pilipinas Online Conference (Conference) co-organized by Edukasyon and held in 2019.1

On 06 June 2019, the National Privacy Commission (NPC) received RPR’s Complaint-Assisted Form.2 RPR alleged that after the Conference, Edukasyon sent a “thank you letter” through email in which all participants were entered and exposed in the email field “To:”.3 He further alleged that the email contained a Dropbox link that points to a zip file.4 When he opened the zip file, it had the names and corresponding certificates of one hundred and three (103) participants, including himself.5

RPR contended that Edukasyon violated Sections 25, 26, 29, 32, 33, and 35 of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA).6 RPR prayed for a fine to be imposed and a cease and desist order to be issued against Edukasyon.7

On 12 September 2019, the parties were ordered to appear before the Commission to confer for discovery on 02 October 2019.8

On 02 October 2019, an Order was issued directing Edukasyon to file its responsive comment to the complaint within ten (10) days from receipt of the Order, while RPR was ordered to file its reply within ten (10) days from receipt of Edukasyon’s comment.9

Edukasyon submitted its Response to the Complaint dated 10 October 2019.10 Edukasyon stated that the personal data involved is limited to the names and email addresses of the participants, which in its view “are not of a particularly sensitive nature.”11 Edukasyon argued that “[t]he file of all certificates with full names served the same purpose as university entrance exam passer websites, or board exam passer announcements, where all full names of participants in the classroom setting are published online to the public.”12

On 03 February 2022, the Commission issued an Order directing Edukasyon to individually notify the participants affected by the personal data breach and to submit its Security Incident Management Policy.13 The dispositive portion of the Order provides:

**WHEREFORE, premises considered, the Commission ORDERS Edukasyon.ph to submit its Security Incident Management Policy and to notify its affected data subjects of the breach and

submit proof of notification thereof to the Commission within a non-extendible period of thirty (30) days from its receipt of the Order.

SO ORDERED.14

Thus, the Commission shall determine Edukasyon’s Compliance with the Order dated 03 February 2022.

Issue

Whether Edukasyon sufficiently complied with the Order dated 03 February 2022.

Discussion

Section 18 (D) of NPC Circular 16-03 (Personal Data Breach Management) provides:

Section 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

…

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data.

The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.15

Whenever a personal data breach occurs, the personal information controller (PIC) shall identify the data subjects who are affected by the breach and shall notify all of them individually using secure means of communication. In this case, Edukasyon, as the PIC, should individually notify all affected data subjects through secure means of communication, whether written or electronically.

On 17 July 2022, Edukasyon submitted its Entry of Appearance with Compliance to the Order dated 03 February 2022.16 Edukasyon stated that in compliance with the Order, “individual emails were sent to each of the respective participants of the Online Conference on 13 July 2022.”17

RPR alleged that the names of one hundred and three (103) participants with corresponding certificates were exposed to third parties.18 The NPC’s Enforcement Division (EnD) assessed Edukasyon’s Entry of Appearance with Compliance (Initial Compliance) as incomplete.19 The EnD reported that Edukasyon sent its individual notification of the breach through email wherein Edukasyon attached its proof of individual notification that contained merely ninety-one (91) email addresses in its list of recipients of the notification breach.20 Thus, the EnD issued a Compliance Letter dated 25 July 2022 directing Edukasyon to:

A. Complete participants and their email addresses who attended the [Conference], to check if all participants were actually included in the email notifications made by respondent; and

B. Provide the status of the remaining notifications needed to the participants who are not included in Annex G of said Compliance.21

On 08 August 2022, the NPC, through the EnD, received Edukasyon’s Supplemental Compliance.22 Edukasyon explained that only seventy-eight (78) participants, instead of ninety-one (91) participants, were actually notified of the personal data breach.23 From the seventy-eight (78) participants notified as reported in Edukasyon’s Initial Compliance, some of the participants had inputted multiple email addresses.24 As such, the multiple email addresses caused the discrepancy in the number of actual participants notified.25 In Edukasyon’s Initial Compliance, there were thirteen (13) surplus breach notification emails sent to the same set of participants.26

Since only seventy-eight (78) participants were notified by the initial breach notification emails, Edukasyon still had to notify the remaining twenty-five (25) participants to complete the one hundred and three (103) participants who were affected by the personal data breach. Edukasyon attached its proof of notification sent to the remaining twenty-five (25) participants via “BCC” on 04 August 2022, thus completing the list of sending individual breach notification to the affected data subject.27

Edukasyon was also ordered to submit its Security Incident Management Policy. Section 4 of NPC Circular 16-03 (Personal Data Breach Management) provides:

Section 4. Security Incident Management Policy. A personal information controller or personal information processor shall implement policies and procedures for the purpose of managing security incidents, including personal data breach. These policies and procedures must ensure:

A. Creation of a data breach response team, with members that have clearly defined responsibilities, to ensure timely action in the event of a security incident or personal data breach;

B. Implementation of organizational, physical and technical security measures and personal data privacy policies intended to prevent or minimize the occurrence of a personal data breach and assure the timely discovery of a security incident;

C. Implementation of an incident response procedure intended to contain a security incident or personal data breach and restore integrity to the information and communications system;

D. Mitigation of possible harm and negative consequences to a data subject in the event of a personal data breach; and

E. Compliance with the Act, its IRR, and all related issuances by the Commission pertaining to personal data breach notification.28

In its compliance with the directive to submit its Security Incident Management Policy, Edukasyon attached its Incident Response Program that it implemented in October 2018.29 The EnD assessed the submission of Edukasyon:

Here, the respondent’s Security Incident Management Policy developed a process and/or procedure that ensures the proper management of breach incidents. In the program indicated in said policy, the latter is responsible for training and awareness needed for the employees’ enrichment in the field of Cyber Security. Further, the respondent explained their flowchart when it comes to handling their breach incidents. Furthermore, the latter likewise indicated therein the mitigation or vulnerability eradication in breach incidents. Lastly, the respondent similarly assured that their system is in accordance with the DPA of 2012 and its IRR and related issuances.30

Based on the EnD’s assessment, Edukasyon’s Incident Response Program is adequate to comply with the requirements found in Section 4 of NPC Circular 16-03 (Personal Data Breach Management).

As such, the Commission finds that Edukasyon’s submission of its Security Incident Management Program adheres to the DPA, its IRR and related issuances.

The Commission finds that Edukasyon has properly notified all affected data subjects in the personal data breach of the “thank you letter” sent by email to the participants of the Conference. The Commission also finds Edukasyon’s submission of its Incident Response Program as a form of Security Incident Management Policy adequate. As such, Edukasyon’s compliance with the Order dated 03 February 2022 is deemed sufficient.

WHEREFORE, premises considered, this Commission finds the compliance of Edukasyon.ph with the Order dated 03 February 2022 SUFFICIENT. This Commission considers the matter CLOSED.

SO ORDERED.

City of Pasay, Philippines. 22 September 2022.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

Copy furnished:

RPR Complainant

EDUKASYON.PH Respondent

VASIG ABARQUEZ LUMAUIG ABARQUEZ PUNO LAW OFFICE Counsel for Respondent

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Final Enforcement Assessment Report, Enforcement Division, 17 August 2022, in RPR v. Edukasyon.ph NPC 19-438 (NPC 2022). ↩

  2. Complaints Assisted Form, 06 June 2019, in RPR v. Edukasyon.ph NPC 19-438 (NPC 2019). ↩

  3. Id. at 3. ↩

  4. Id. at 5. ↩

  5. Id. at 5. ↩

  6. Id. at 3-4. ↩

  7. Id. at 6-8. ↩

  8. Order to Confer for Discovery, 12 September 2019, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2019). ↩

  9. Order, 02 October 2019, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2019). ↩

  10. Respondent’s Response to the Complaint, 10 October 2019, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2019). ↩

  11. Id. ↩

  12. Id. ↩

  13. Order, 03 February 2022, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2022). ↩

  14. Id. ↩

  15. National Privacy Commission, Personal Data Breach Management, Circular No. 03, Series of 2016 [NPC Circ. No. 16-03], § 18 (D) (15 December 2016). ↩

  16. Respondent’s Entry of Appearance with Compliance to the Order dated 03 February 2022, 07 July 2022, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2022). ↩

  17. Id. at 3. ↩

  18. Complaints Assisted Form, 06 June 2019, at 5, in RPR v. Edukasyon.ph NPC 19-438 (NPC 2019). ↩

  19. Final Enforcement Assessment Report, Enforcement Division, 17 August 2022, in RPR v. Edukasyon.ph NPC 19-438 (NPC 2022). ↩

  20. Id. at 4. ↩

  21. Enforcement Division Compliance Letter, 25 July 2022, in RPR v. Edukasyon.ph NPC 19-438 (NPC 2022). ↩

  22. Respondent’s Supplemental Compliance to the Compliance Letter dated 25 July 2022, 08 August 2022, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2022). ↩

  23. Id. at 3-4. ↩

  24. Id. at 3-4. ↩

  25. Id. at 3-4. ↩

  26. Id. at 3-4. ↩

  27. Id. at 4 & Annex D. ↩

  28. NPC Circ. No. 16-03, § 4. ↩

  29. Respondent’s Entry of Appearance with Compliance to the Order dated 03 February 2022, 07 July 2022, at 4, in RPR v. Edukasyon.ph, NPC 19-438 (NPC 2022); Id. Annex H. ↩

  30. Final Enforcement Assessment Report, Enforcement Division, 17 August 2022, at 3, in RPR v. Edukasyon.ph NPC 19-438 (NPC 2022). ↩

Backlinks