NPC Issuance Wiki

NPC 21-214: In re: Teletech Customer Care Management Philippines, Inc.

Issued Resolution

Resolution Text

IN RE: TELETECH CUSTOMER CARE MANAGEMENT PHILIPPINES, INC.

x-----------------------------------------------x

NAGA, P.C.:

This Resolution refers to the Compliance dated 17 May 2022 of Teletech Customer Care Management Philippines, Inc. (TTEC) to the Order dated 17 March 2022.

Facts

On 17 March 2022, the Commission issued an Order to TTEC with the following dispositive portion:

WHEREFORE, premises considered, Teletech Customer Care Management Philippines, Inc. (TTEC) is ORDERED to comply with the following within a non-extendible period of fifteen (15) days upon receipt of the Order to:

(1) NOTIFY the affected data subjects. For the current employees, they shall be notified pursuant to Section 18(D) of the NPC Circular No. 16-03. The notification shall be done individually using secure means of communication, through email. TTEC shall submit proof of compliance, including the proof of receipt of the data subjects of such notification. For the former employees, they shall be notified through alternative means pursuant to Section 18(D) of the NPC Circular No. 16-03, through the publication of the notice on the following media: (a) TTEC’s website; and (b) advertisement spaces to be procured from newspapers of national circulation (i.e., Philippine Daily Inquirer or Manila Bulletin), and regional circulation in key cities or provinces wherein TTEC has an office or contact center. TTEC shall also provide to the Commission proof of compliance, including proof of notification/publication;

The proof of notification must be supported by appropriate affidavits, as applicable, including evidence that TTEC has procured advertisement spaces in newspapers of national circulation, and newspapers of regional circulation in all the cities or provinces wherein TTEC has an office or contact center;

(2) SUBMIT its Full Breach Report pursuant to Section 9 and Section 17(D) of NPC Circular No. 16-03; and

(3) ADDRESS the directive contained in the Order dated 13 January 2022 to show cause in writing on why it should not be subjected to contempt proceedings, as permitted by law, before the appropriate court, and other actions as may be available to the Commission, for its failure to submit its Full Breach Report within the prescribed period.

The Complaints and Investigation Division (CID) and the Compliance and Monitoring Division (CMD) of the National Privacy Commission are hereby ORDERED to conduct the appropriate investigation on TTEC’s possible violations of the DPA.

SO ORDERED.1

In compliance with the Order dated 17 March 2022, TTEC submitted a Manifestation and Motion dated 17 May 2022 attaching therein the Affidavit of Publication issued by Manila Bulletin2 and Panay News,3 an Authorization to Sunstar Publishing, Inc. issued by TTEC to complete the publication in Batangas, Laguna, Cebu, and Dumaguete,4 and its Full Breach Report.5

In its Compliance, TTEC stated that it should not be subjected to contempt proceedings since it was able to timely notify the Commission of the data breach and exerted its effort to comply with the directives of the Commission by supplementing its initial data breach report, which contains relevant information available to TTEC.6

Thus, TTEC prayed for the Commission to issue an order: (1) making of record TTEC’s partial compliance with the Order dated 17 March 2022; and (2) granting an additional reasonable period to file its full compliance with the Order dated 17 March 2022.7

On 23 May 2022, TTEC submitted a Supplement to the Manifestation and Motion dated 17 May 2022, attaching therein (1) affidavits of publication issued by Sunstar Bacolod8 and Cebu9 and (2) TTEC’s Service Agreement on its purchase with Epiq Corporate Services, Inc. for the sending of breach notice via email and setting up a call center to answer concerns from the affected data subjects.10

On 29 June 2022, TTEC submitted its Second Supplement to the Manifestation and Motion dated 17 May 2022 with the following attachments:

3.1. Proof of publication of the data breach notice in regional newspapers in Batangas and Laguna, Cebu City, and Dumaguete City as Annex “A-Series”;

3.2. Proof of posting of the data breach notice on TTEC’s website as Annex “B”; and

3.3 Proof of individual notification to TTEC employees through email made by TTEC’s service provider, Epiq Corporate Services, Inc., and of receipt of such email notification as Annex “C-Series”.11

On 14 July 2022, the Commission issued a Resolution denying the Manifestation and Motion dated 17 May 2022 filed by TTEC.12 In denying TTEC’s request for an additional period to comply with the 17 March 2022 Order, the Commission stated that “the request has become moot since TTEC claims that its latest submission [Second Supplement to the Manifestation and Motion] [completes] its compliance” with the Commission’s Order.13 Further, the Commission denied the request for an extension since TTEC has not provided sufficient ground for its request for extension to be granted by the Commission.14

The Commission also stated that “even though TTEC claims that it has already fully complied with the Commission’s Directives”, the submissions are fragmentary and delayed.15 Finally, “the Commission has accommodated TTEC’s numerous requests for extension to comply with its obligations as a personal information controller (PIC), particularly with regard to data breach notification proceedings.”16

On 12 October 2022, the Commission, through its Enforcement Division (EnD), issued a Compliance Letter requiring TTEC to submit a viewable excel file of its email report with regard to the proof of notification.17 Subsequently, TTEC submitted its compliance on 19 October 2022, attaching therein a portable data format (pdf) file that contains proof of email notification to its current employees.18

Issue

Whether TTEC is compliant with the Order of the Commission dated 17 March 2022.

Discussion

The Commission finds that TTEC has sufficiently complied with the Order dated 17 March 2022.

I. TTEC sufficiently notified the data subjects affected by the breach

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.19 (Emphasis supplied)

In an Order dated 17 March 2022, the Commission ordered TTEC to notify the affected data subjects composing of its (1) current employees, using secure means of communication, through email; and (2) former employees through alternative means of communication.20

In complying with the said Order, TTEC sufficiently showed that it complied with the notification requirement through alternative means of communication.21 In the said compliance, TTEC attached notices to the affected data subjects through publications from Panay News,22 SunStar Bacolod,23 SunStar Pampanga,24 SunStar Business Section,25 Manila Bulletin,26 and on TTEC’s website.27

On the other hand, TTEC provided an excel file to the Commission containing proof of e-mail notifications sent to its twelve thousand eight hundred sixty-six (12,866) current employees sent via email on 19 October 2022.28

Further, Section 18(C) of NPC Circular No. 16-03 provides for the content of notification to be sent to the affected data subjects:

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.29

TTEC’s notices to its current and former employees contained the aforementioned contents of notification. Such notifications also stated that TTEC encourages the data subjects affected by the breach to “actively monitor and review [their] credit report and credit card, bank, and other financial statements for any unauthorized activity.”30 Further, affidavits of the publishers were submitted by TTEC to show proof of publication in various newspapers.31

Based on the foregoing, the Commission finds that TTEC has sufficiently complied with the Order dated 17 March 2022 by submitting its proof of notification to the affected data subjects. Thus, the notices sent to the current and former employees of TTEC satisfactorily complied with Section 18(C) and (D) of NPC Circular No. 16-03.

II. The Data Breach Report submitted by TTEC sufficiently complied with Section 17 (D) in relation to Section 9 of NPC Circular No. 16-03

In the Orders dated 13 January 202232 and 17 March 2022,33 TTEC was ordered by the Commission to submit its Full Breach Report pursuant to Section 17 (D) in relation to Section 9 of NPC Circular No. 16-03, thus:

SECTION 9. Documentation. All actions taken by a personal information controller or personal information processor shall be properly documented. Reports should include:

A. Description of the personal data breach, its root cause and circumstances regarding its discovery; B. Actions and decisions of the incident response team; C. Outcome of the breach management, and difficulties encountered; and D. Compliance with notification requirements and assistance provided to affected data subjects.

30 Compliance and Manifestation dated 28 February 2022 of Teletech Customer Care Management Philippines, Inc., Annex “A” 31 Manifestion and Motion dated 17 May 2022 of Teletech Customer Care Management Philippines, Inc. 32 In re: Teletech Customer Care Management Philippines, Inc., NPC BN 21 -214, Order dated 13 January 2022, at p. 10. 33 In re: Teletech Customer Care Management Philippines, Inc., NPC BN 21 -214, Order dated 17 March 2022, at p. 16.

A procedure for post-breach review must be established for the purpose of improving the personal data breach management policies and procedures of the personal information controller or personal information processor.34

Rule V Section 17(D) of NPC Circular No. 16-03 states:

D. Content of Notification. The notification shall include, but not be limited to:

  1. Nature of the Breach a. description of how the breach occurred and the vulnerability of the data processing system that allowed the breach; b. a chronology of the events leading up to the loss of control over the personal data; c. approximate number of data subjects or records involved; d. description or nature of the personal data breach; e. description of the likely consequences of the personal data breach; and f. name and contact details of the data protection officer or any other accountable persons.
  2. Personal Data Possibly Involved a. description of sensitive personal information involved; and b. description of other information involved that may be used to enable identity fraud.
  3. Measures Taken to Address the Breach a. description of the measures taken or proposed to be taken to address the breach; b. actions being taken to secure or recover the personal data that were compromised; c. actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident; d. action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification; e. the measures being taken to prevent a recurrence of the incident.

The Commission reserves the right to require additional information, if necessary.35 In the 17 March 2022 Order, the Commission stated that “TTEC’s three-page Report lacks clear and full details on the personal data breach.”36 The Commission also stated that the breach report of TTEC has “no actual description or narrative that refers or discusses the personal data breach itself.”37

In its submissions, TTEC was able to provide the description of the personal data involved wherein “the unauthorized actor was able to exfiltrate several spreadsheets containing personal data of current and former employees.”38 TTEC has also identified the root cause of the breach in which “the unauthorized entry was the result of a phishing attack on an enterprise domain administrator who has access across various domains within TTEC environment.”39

With regard to the actions and decisions of the incident teams, TTEC engaged with Arete Incident Response “to conduct a forensic investigation in connection with incident, identify incidents of compromise and assist with their eradication from the TTEC environment.”40 After the investigation, there is no evidence that unauthorized parties remained in TTEC’s environment after the initial attack.41

Further, with the outcome of the breach management, TTEC was able to determine the total number of affected current and former employees.42

In sum, the submitted report of TTEC containing the description of the personal data involved, identifying the root cause of the breach, and the actions and decisions of the incident teams are compliant with the directives of the Commission pursuant to NPC Circular 16-03 Section 17 (D) in relation to Section 9.

III. TTEC has sufficiently shown proof of security measures it implemented to mitigate the breach

The Commission ordered TTEC to submit proof of security measures it implemented to address the breach.43

In compliance with the said Order, TTEC submitted its Manifestation and Compliance dated 25 January 2022 attaching therein proof of security measures to address the breach.44

In the said submission, TTEC stated that:

“(a) Threat hunted incidents of compromise (IOCs) to contain and block potential malicious activity;

(b) Added the TTEC incident specific IOCs, captured through the investigation, and other IOCs indicative of known cyber security ransomware threat actors to EDRs’ and firewalls’ blacklist; audited whitelists to make sure that known IOCs are not included there to supersede the blacklists;

(c) Conducted an audit of all firewall domains;

(d) Conducted an audit of Active Directory; and

(f) [sic] Geo-blocked for connectivity in all countries where TTEC does not have business activity.”45

TTEC also attached an ADAssessor Executive Summary showing data on the vulnerability status of TTEC’s system.46

Thus, the Commission finds that TTEC’s submitted Full Breach Report and proof of security measures are sufficient and compliant with the Orders of the Commission. Finally, the Commission finds that TTEC has sufficiently notified the affected data subjects in accordance with NPC Circular No. 16-03.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 21-214 “In re: Teletech Customer Care Management” is hereby considered CLOSED.

SO ORDERED.

Pasay City, Philippines. 26 January 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy Furnished:

SB Data Protection Officer

DP Counsel

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. In re: Teletech Customer Care Management Philippines, Inc., NPC BN 18-205, Order dated 17 March 2022 ↩

  2. Manifestation and Motion dated 17 May 2022 of Teletech Customer Care Management Philippines, Inc., in Annex “A” ↩

  3. Id., in Annex “B” ↩

  4. Id., Annex “C” ↩

  5. Id., Annex “D” ↩

  6. Manifestation and Motion dated 17 May 2022 of Teletech Customer Care Management Philippines, Inc., at p. 3. ↩

  7. Id. at p. 3. ↩

  8. Supplement to the Manifestation and Motion dated 23 May 2022 from TTEC, in Annex “A” ↩

  9. Id., in Annex “B” ↩

  10. Id., in Annex “C” ↩

  11. Second Supplement to the Manifestation and Motion dated 17 May 2022 (Re: Order dated 17 March 2022) dated 29 June 2022 of Teletech Customer Care Management Philippines, Inc. ↩

  12. In re: Teletech Customer Care Management Philippines, Inc., NPC BN 21-214, Resolution dated 14 July 2022, at p. 10. ↩

  13. Id., at p. 5. ↩

  14. Id., at p. 5. ↩

  15. Id., at p. 10. ↩

  16. In re: Teletech Customer Care Management Philippines, Inc., NPC BN 21-214, Resolution dated 14 July 2022, at p. 5. ↩

  17. In re: Teletech Customer Care Management Philippines, Inc., NPC BN 18-205, Order dated 12 October 2022 ↩

  18. Electronic mail dated 19 October 2022 from Teletech Customer Care Management Philippines, Inc. ↩

  19. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18(D) (15 December 2016) (NPC Circular 16-03). ↩

  20. In re: Teletech Customer Care Management Philippines, Inc., NPC BN 21-214, Order dated 17 March 2022, at p. 16. ↩

  21. Compliance and Manifestation dated 28 February 2022 of Teletech Customer Care Management Philippines, Inc. ↩

  22. Id. Annex “A” ↩

  23. Id. ↩

  24. Id. ↩

  25. Compliance and Manifestation dated 28 February 2022 of Teletech Customer Care Management Philippines, Inc., Annex “A” ↩

  26. Id. ↩

  27. Id. ↩

  28. Electronic mail dated 19 October 2022 from Teletech Customer Care Management Philippines, Inc. ↩

  29. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18 (C) (15 December 2016) (NPC Circular 16-03). ↩

  30. Compliance and Manifestation dated 28 February 2022 of Teletech Customer Care Management Philippines, Inc., Annex “A” ↩

  31. Manifestation and Motion dated 17 May 2022 of Teletech Customer Care Management Philippines, Inc. ↩

  32. In re: Teletech Customer Care Management Philippines, Inc., NPC BN 21-214, Order dated 13 January 2022, at p. 10. ↩

  33. In re: Teletech Customer Care Management Philippines, Inc., NPC BN 21-214, Order dated 17 March 2022, at p. 16. ↩

  34. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule IV, § 9 (15 December 2016) (NPC Circular 16-03). ↩

  35. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule IV, § 17(D) (15 December 2016) (NPC Circular 16-03). ↩

  36. In re: Teletech Customer Care Management Philippines, Inc., NPC BN 21-214, Order dated 17 March 2022, at p. 14. ↩

  37. Id. ↩

  38. Manifestation and Motion dated 17 May 2022 of Teletech Customer Care Management Philippines, Inc., in Annex “D” ↩

  39. Id. ↩

  40. Id. ↩

  41. Id. ↩

  42. Manifestation and Motion dated 17 May 2022 of Teletech Customer Care Management Philippines, Inc., in Annex “D” ↩

  43. In re: Teletech Customer Care Management Philippines, Inc., NPC BN 21-214, Order dated 13 January 2022, at p. 10. ↩

  44. Manifestation and Compliance dated 25 January 2022 of Teletech Customer Care Management Philippines, Inc., in Annex “C” ↩

  45. Id. ↩

  46. Id. ↩

Backlinks

  • No backlinks found