NPC Issuance Wiki

NPC BN 18-054: In re: Department of Education – Calamba

Issued Resolution

Resolution Text

IN RE: DEPARTMENT OF EDUCATION – CALAMBA

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is the compliance dated 28 July 2022 of the Department of Education–Calamba (DepEd Calamba) with the Order of the National Privacy Commission (NPC) through its Complaints and Investigation Division (CID) dated 15 July 2022.

Facts

On 02 April 2018, the CID detected a breach that leaked DepEd Calamba’s database that potentially involved personal data.1

On 18 April 2018, the CID issued an order requiring DepEd Calamba to submit, within seventy-two (72) hours, a report detailing all available information regarding the data breach.2

On 23 April 2018, DepEd Calamba submitted its Incident Report to the Commission.3

In the Report, DepEd Calamba explained that The Blackhat hacker group known by the name “Pinoy LulzSec” conducted a concerted attack on several websites of both government and private entities.4 The aim of its attack was to deface, breach, and/or leak data from these websites.5 Among the entities affected by this attack was DepEd Calamba.6 The information of eighty-six (86) DepEd Calamba personnel were affected.7

From 01 to 04 April 2018, information involving personnel names, Employee ID, and user account information were progressively posted in Pinoy LulzSec’s Facebook and Twitter accounts.8 From 05 April 2018 onwards, “titles of Memorandums and other data that are readily available in the website for public viewing” were posted.9

The leak was allegedly potentially caused by (i) a vulnerability in “Zoom.ph,” DepEd Calamba’s webhosting provider, which caused the resetting of DepEd Calamba’s Cpanel account, and/or (ii) an unsecured Wordpress/Division Systems script.10 According to DepEd Calamba, Cpanel is “an application that manages all the files and database in a shared web hosting.”11

To remedy the situation, DepEd Calamba alleges that it performed the following:

  • The Division ITO in close coordination with the Zoom.ph technical team has temporarily shut down all its online systems.
  • He requested the Zoom.ph to improve the security, both on the website they hosted and their server.
  • Security holes in the systems are being checked by the ITO as this might also be possible for an entry point of hacking.
  • A Division Memorandum was issued to inform all division personnel that a possible data breach may have occurred that may be used in identity fraud. They were also advised to be vigilant and keep record of all their monetary transactions.
  • He reported the incident to the Regional ITO and requested for an emergency meeting regarding the hacking event to formulate defensive measures in case another hacking occurs within the region.
  • He also submitted an Incident report to the Regional ITO of the Regional Office and to the Department of Information and Communications Technology (as per request by the DICT).12

DepEd Calamba also explained the reason for its failure to notify the NPC:

  • The Division Office is still monitoring and assessing the hacking incident due to the fact that the hackers are still active in hacking other websites.
  • Based upon the orientation of the recently held Data Privacy Awareness Seminar attended by the Regional ITOs of DepEd, it was part of the protocol that the incident will be reported to the Regional Office. The Regional Office will then escalate the concern to the Central Office and/or to the National Agency concerned.13

On 07 December 2021, the CID issued an Order requiring DepEd Calamba to submit a Post Breach Report detailing the incident that prompted the notification to the Commission within fifteen (15) days from receipt.14 Specifically, the Commission required DepEd Calamba to:

  1. provide description of the personal data breach,
  2. its root cause and circumstances regarding its discovery,
  3. actions and decisions of the incident response team,
  4. outcome of the breach management and difficulties encountered and compliance with notification requirements and assistance provided to affected data subjects,
  5. documentation/reports as to the security measures conducted before, during and after the security incident and remedial measures taken to prevent its recurrence.15

On 15 December 2021, DepEd Calamba submitted its compliance dated 14 December 2021 with the abovementioned Order.16 Aside from reiterating matters which were mentioned in the initial incident report, DepEd Calamba provided a timeline of the relevant actions it took to address the incident:

April 2018 – December 2018

  1. Reported the incident to the Regional ICT of the Region.
  2. Reported the incident to the National Privacy Commission.
  3. Informed all affected personnel regarding the incident. They were given notification letters regarding the breach. A separate meeting was also conducted to inform all affected personnel regarding the possible effects of the breach.
  4. Coordinated with the web-hosting company to immediately improve the securities of the website.
  5. Checked possible entries of hacking in the Wordpress and system site.
  6. All databases with sensitive information were permanently removed in the server.
  7. Formed the Division Data Privacy Compliance Team and Data Protection Officers.
  8. Cooperated with the National Privacy Commission from June–September 2018 by attending all investigation meetings held at the NPC Office and submitting all requested documents.

2019

  1. The Division Office, together with the Regional Office of DepEd Calabarzon and National Privacy Commission, developed the data privacy manual for DepEd Calabarzon implemented by all Divisions in the Region.
  2. Migrated to a more secure web-hosting site.
  3. Ensured that no sensitive information was accessible online.
  4. Upgraded the security of locally hosted system by implementing network firewalls and security configurations.
  5. Strict verification of personnel in the Department was implemented which may include physical appearance in the Division Office.

2020 – Present

  1. Maintain all security measures implemented by the Division Office based on the developed data privacy manual.
  2. Update and adapt all security configurations to ensure the security and privacy of information.
  3. Conduct Cybersecurity webinars to equip Division Personnel with knowledge regarding security of their digital information.17

DepEd Calamba also stated that together with DepEd CALABARZON and the NPC, they developed the Regional Data Privacy Manual.18 The manual contains all the security standards to be implemented by all the Division Offices in the region.19 These standards include:

  • Processing of Personal Information
  • Transfer and Retention of Personal Information
  • Disposition of Personal Information
  • Guidelines on Electronic Personal Data Records
  • Disclosure and Sharing of Data
  • Designation of Data Privacy Compliance Team from Region to School Level
  • Web Application Security Testing
  • Inventory and Control of Storage Devices
  • Division Maintenance Plan for ICT20

On 15 July 2022, the CID issued an Order requiring DepEd Calamba to submit a Supplemental Post Breach Report containing the lacking documentation on the actions it had taken within ten (10) days from receipt of the Order.21 Specifically, it required DepEd Calamba:

  1. TO SUBMIT PROOF of the following actions as stated in the Updated Report dated 30 July 2018: a. Updates on the implementation of the Data Breach Action Plan; b. Proof of trainings, seminars, orientation conducted pertaining to Data Privacy Awareness and the attendance of the relevant employees; c. Other measures implemented after the security incident to prevent recurrence of similar incidents. d. Proof of sending to and/or receipt by the affected data subject of the data breach notification.22

On 02 August 2022, DepEd Calamba submitted its compliance dated 28 July 2022 with the Order dated 15 July 2022.23 Its compliance included (i) a Supplemental Post Breach Report,24 (ii) Minutes of an Orientation and Risk Assessment Meeting which took place on 26 April 2018,25 (iii) a Division Advisory on Data Breach dated 10 April 2018,26 (iv) Copies of the Individual Breach Notification sent to the personnel affected,27 (v) a copy of the Regional Data Privacy Manual authored by DepEd Calamba, DepEd CALABARZON, and the NPC,28 and (vi) a Division Memorandum on Data Privacy Orientation/Training dated 25 January 2019.29

Issue

Whether DepEd Calamba has sufficiently complied with the Order dated 15 July 2022, including the implementation of reasonable and appropriate security measures.

Discussion

The Commission finds that DepEd Calamba has sufficiently complied with the Order dated 15 July 2022 since the affected data subjects were sufficiently notified in accordance with NPC Circular 16-03, and that DepEd Calamba has implemented reasonable and appropriate security measures to address the breach and prevent a recurrence of the incident. As such, the Commission resolves to consider the matter closed.

I. DepEd Calamba sufficiently notified the data subjects who were affected by the breach.

DepEd Calamba notified the affected data subjects following Rule V, Sections 18 (C) and (D) of NPC Circular 16-03:

SECTION 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

x x x

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.30

Whenever a personal data breach occurs which, under Rule V, Section 11 of NPC Circular 16-03,31 falls under mandatory breach notification, the personal information controller (PIC), shall identify the data subjects who are affected by the breach and shall notify all of them individually using secure means of communication.32

In its submission of a Supplemental Post Breach Report on 15 July 2022, DepEd Calamba stated that they sent individual breach notification letters dated 24 April 2018 to the affected data subjects.33 The letters to the affected data subjects read:34

Notification on DepEd Data Breach

TO: [Data Subject]

On April 1, 2018, a mass hacking of government websites and information systems which includes the Division of Calamba City was conducted by a Filipino hacking group called “Pinoy Lulzsec”. This incident led to the leakage of some database which contain personal information such as employee number, email address and contact number that may be used in identity theft. Upon the assessment of the ICT Unit, it was confirmed that your employee number was included in the leaked data. The Division Office thru the ICT Unit would like to advise you to be cautious, vigilant and to keep record of all your monetary transactions.

To prevent further data breach, the ICT Unit has already taken down the online system containing these data. Furthermore, the newly implemented DepEd Order No. 18 series of 2018 also known as the Revised Guidelines on Accreditation Re-Accreditation of Private Entities under the Automatic Payroll Deduction System (APDS) Program will require the use of official DepEd email to process salary deduction loan applications that require the use of Employee Number. Also, under this order, a verifier will also be assigned in the division office to verify all loan applications. This will definitely lessen or remove the probability of using the employee number in loan applications by any unauthorized individual.

In addition, you are hereby required to attend an orientation and risk assessment meeting on April 26, 2018, 1:30 pm at the Conference room to discuss additional measures to prevent any harm that this incident may cause.

Your compliance for this advisory is earnestly desired.

RDT

Schools Division Superintendent35

As may be observed in the letter, DepEd Calamba notified the individual data subjects of the fact and nature of the breach, the personal data involved, the possible negative effects it may have, and measures taken to address the breach.36 The letter was signed by RDT, the Schools Division Superintendent.37

Aside from notifying the affected data subjects through such letter, DepEd Calamba also set a meeting regarding the breach.38 The meeting was held on 26 April 2018, and the affected data subjects were mandated to attend.39 The minutes of the aforementioned meeting indicated that the affected data subjects were informed, among others, of the nature of the breach, the threat of identity theft, and new precautionary measures and policies to mitigate its impact.40

II. DepEd Calamba implemented sufficient security measures to address the breach and prevent its recurrence.

Relative to a PIC’s duty to implement measures to protect personal information, Section 20 (a) of the Data Privacy Act of 2012 (DPA) provides:41

Sec. 20. Security of Personal Information.

a. The personal information controller must implement reasonable and appropriate organizational, physical, and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.

In this regard, to further strengthen the security of both its website and information systems, DepEd Calamba stated that it implemented the following security measures and protocols:

Website:

  • Installed firewall plugins such as Succuri and Wordfence
  • Implemented country-blocking in accessing the website
  • Constant scanning and monitoring of the website
  • Regular version upgrade of the website and its plugins
  • Regular password reset

Information Systems

  • All information systems were migrated from online to local network implementation
  • Secured Local network servers
  • Implemented Firewall to secure both the network and server
  • Limit the input of unnecessary sensitive information
  • All sensitive information is encrypted42

DepEd Calamba also sought to train its personnel to identify and avoid possible hacking attacks. Thus, it held a series of webinars entitled “Akin ang Huling Halak-Hack” on 28 April 2021 and 31 January 2022.43 A webinar on Videoconferencing and Internet Security Tools was also scheduled on 29 October 2021.44 As part of the training material, all Division Office personnel were given a license for Antivirus software with internet security features.45

Further, DepEd Calamba also addressed the threat of usage of the compromised information of the affected personnel to enable unauthorized loan applications.46 It highlighted the fact that DepEd emails will be necessary to process loan applications, and that a verifier will be assigned to verify applications.47 As stated by DepEd Calamba in its Supplemental Post Breach Report:

Some concern by the affected personnel revolve around unauthorized loan applications which were rampant in the Department. Employee number is not enough for loan applications in DepEd as it requires documents for verification. To further prevent any unauthorized use of the data, the Department of Education implemented the DepEd Order No. 18, s2018 also known as the Revised Guidelines on Accreditation Re-Accreditation of Private Entities under the Automatic Payroll Deduction System Program which will require the use of DepEd email to process loan applications. DepEd emails are managed by the Division ICT Unit. If an email was compromised, the ICT Unit can immediately reset the account to deny unauthorized access. Also, under this order, a verifier will also be assigned in the Division Office to verify all loan applications. This will require physical presence and manual verification of loan applications. This will lessen or completely remove the possibility of using the Employee Number in loan applications by any unauthorized application. This DepEd Order are strictly implemented in the Division of DepEd Calamba City.48

Finally, DepEd Calamba also stated that it will implement security standards provided under the Regional Data Privacy Manual.49

All told, the implementation of the abovementioned measures after the data breach, as well as the notification made by DepEd Calamba on its own initiative, demonstrated its diligence and commitment to protect the rights of its data subjects and abide by the DPA and the other issuances of the NPC. DepEd Calamba was able to mitigate the risks caused by the incident through its existing security measures and the notification it sent to the affected data subjects.

In view of the foregoing, the Commission holds that DepEd Calamba has sufficiently notified the affected data subjects, and it has implemented reasonable and appropriate security measures to address the breach and prevent a recurrence of the incident.

WHEREFORE, premises considered, the Commission resolves that the matter of NPC BN 18-054 “In re: Department of Education–Calamba” is hereby CLOSED.

SO ORDERED.

City of Pasay, Philippines. 17 September 2024.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

JMM Data Protection Officer Department of Education - Calamba

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. In re: Department of Education-Calamba, NPC BN 18-054, Order dated 18 April 2018. ↩

  2. Id. ↩

  3. Incident Report dated 23 April 2018 of Department of Education-Calamba. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Incident Report dated 23 April 2018 of Department of Education-Calamba. ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. ↩

  11. Incident Report dated 23 April 2018 of Department of Education-Calamba. ↩

  12. Id. ↩

  13. Id. ↩

  14. In re: Department of Education-Calamba, NPC BN 18-054, Order dated 07 December 2021. ↩

  15. Id. ↩

  16. Post Breach Report dated 14 December 2021 of Department of Education-Calamba. ↩

  17. Id. ↩

  18. Id. ↩

  19. Id. ↩

  20. Post Breach Report dated 14 December 2021 of Department of Education-Calamba. ↩

  21. In re: Department of Education-Calamba, NPC BN 18-054, Order 15 July 2022. ↩

  22. Id. ↩

  23. Supplemental Post Breach Report dated 28 July 2022 of Department of Education-Calamba. ↩

  24. Id. ↩

  25. Minutes of the Meeting, Orientation and Risk Assessment on Data Breach dated 30 April 2018 of Department of Education-Calamba. ↩

  26. Advisory on DepEd Data Breach dated 10 April 2018 of Department of Education-Calamba. ↩

  27. Notification on DepEd Data Breach dated 24 April 2018 of Department of Education-Calamba. ↩

  28. Department of Education Region IV-A CALABARZON Data Privacy Manual of Department of Education-Calamba. ↩

  29. Division Memorandum, Division Data Privacy Orientation dated 25 January 2019 of Department of Education-Calamba. ↩

  30. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, §18 (15 December 2016) (NPC Circular 16-03). ↩

  31. Id. ↩

  32. RPR vs. Edukasyon.ph, NPC 19-438, Resolution dated 22 September 2022, at p. 4. ↩

  33. Supplemental Post Breach Report dated 28 July 2022 of Department of Education-Calamba. ↩

  34. Notification on DepEd Data Breach dated 24 April 2018 of Department of Education-Calamba. ↩

  35. Id. ↩

  36. Id. ↩

  37. Id. ↩

  38. Minutes of the Meeting, Orientation and Risk Assessment on Data Breach dated 30 April 2018 of Department of Education-Calamba. ↩

  39. Notification on DepEd Data Breach dated 24 April 2018 of Department of Education-Calamba. ↩

  40. Minutes of the Meeting, Orientation and Risk Assessment on Data Breach dated 30 April 2018 of Department of Education-Calamba. ↩

  41. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter V, § 20 (2012). ↩

  42. Supplemental Post Breach Report dated 28 July 2022 of Department of Education-Calamba. ↩

  43. Id. ↩

  44. Id. ↩

  45. Id. ↩

  46. Supplemental Post Breach Report dated 28 July 2022 of Department of Education-Calamba. ↩

  47. Id. ↩

  48. Id. ↩

  49. Id. ↩

Backlinks

  • No backlinks found