NPC Issuance Wiki

NPC BN 18-085: In re: La Salle Green Hills School

Issued Resolution

Resolution Text

IN RE: LA SALLE GREEN HILLS SCHOOL

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is the compliance of La Salle Green Hills School (LSGH) dated 29 July 2022 (Compliance) in relation to the 21 May 2020 Resolution of the Commission (Resolution).

Facts

On 01 June 2018, LSGH sent a data breach report to notify the Commission about a data breach caused by one of its employees.1 LSGH stated that an employee brought home some work documents that were left in a tricycle.2 LSGH alleged that the lost documents include forms of seven (7) school employees which contained the Social Security System (SSS) Salary Loan Application Form, SSS Sickness Benefit, and Pag-IBIG Multi-Purpose Loan Form.3 The forms contained the following personal and sensitive personal information of the employees:

a) Name; b) Date of Birth; c) Tax Identification Number (TIN); d) SSS Number; e) Pag-IBIG Number; f) Contact Number (mobile or landline); and g) Electronic mail address.4

In line with the incident, LSGH stated that it immediately notified the affected employees through its Human Resource Department (HRD).5 LSGH also released a memorandum which prohibits the school personnel to bring home documents containing personal data.6 The school administration likewise scheduled a re-orientation of all personnel regarding the matter.7

Moreover, LSGH stated that the concerned employee exerted possible efforts to locate the documents but failed to do so.8

On 21 May 2020, the Commission issued a Resolution with a dispositive portion stating:

WHEREFORE, premises considered, this Commission orders La Salle Green Hills School to submit the result of its PIA, together with the revised Privacy Policy and Security Incident Management Policy one (1) week from the receipt of this Resolution.

SO ORDERED.9

Records show that LSGH only received a copy of the Resolution on 06 January 2021.10 Consequently, the Enforcement Division (EnD) of the National Privacy Commission sent a compliance letter requiring LSGH to submit the required documents within ten (10) days from receipt of the letter.11

On 27 April 2021, LSGH requested for an extension of thirty (30) days to submit the required documents due to the appointment of its new Data Protection Officer (DPO) who was not given the pertinent documents for the proceedings by its previous DPO.12 LSGH also stated that due to the implementation of a skeletal workforce caused by the pandemic, all other employees were in a work from home set-up.13

Pending the resolution of its Motion for Extension, LSGH submitted the following documents as part of its compliance:

  1. LSGH Revised Data Privacy Policy
  2. LSGH Revised Privacy Security Incident Policy
  3. LSGH Offices Personal Data Inventory and Privacy Impact Assessment
  4. LSGH Data Privacy Security Incident Reporting Form
  5. LSGH Privacy Management Plan
  6. LSGH Social Media Policy for Students
  7. LSGH Social Media Policy for Personnel and Partners14

Subsequently, the Commission issued a Resolution dated 06 May 2021:

WHEREFORE, premises considered, this Commission hereby GRANTS La Salle Green Hills School an extension of ten (10) days to comply with the 21 May 2020 Resolution of the Commission reckoned from the date of the Motion for Extension. The Commission also NOTES the submission of compliance dated 05 May 2021 pending the Final Enforcement Assessment Report from the Enforcement Division.

The La Salle Green Hills School is STERNLY WARNED that their similar conduct shall be dealt with accordingly.

SO ORDERED.15

Subsequently, the EnD sent a letter dated 28 July 2021 ordering LSGH to submit the following:

A. Excel files stating the PIA results for:

  1. Associate Principal for Academic Affairs
  2. Associate Principal for Student Affairs

B. Files with complete entries in the PIA results of:

  1. Finance Resource Department
  2. Guidance Education and Intervention Services
  3. Health and Services Unit
  4. Lasallian Mission Office
  5. Learning Resource Center
  6. Sports Program and Development Office
  7. Quality Assurance and Research Office
  8. Human Resource and Development Office
  9. Safety and Security Office
  10. Admissions Office
  11. Registrar’s Office16

On 06 August 2021, LSGH submitted its Compliance by attaching the documents required by the EnD in its 28 July 2021 Letter.17

On 05 April 2022, the EnD sent a letter to LSGH in relation to its submissions. The EnD stated:

While the PIA was found compliant with the requirements in identifying attendant risks in the processing of personal data, it was also found that its implementation is yet to be fully made in other offices such as the Finance Resource Department, Office of the Associate Principal for Academic Affairs, Office of the Associate Principal for Student Affairs, Quality Assurance and Research Office and Sports Program Development Office.18

The EnD also made the following evaluation:

As to the other documents submitted by LSGH, the Commission observed that the: 1) Revised Data Policy; 2) Revised Privacy Security Incident Policy; 3) Offices Personal Data Inventory and Privacy Impact Assessment; 4) Data Privacy Security Incident Reporting Form; 5) Privacy Management Plan; 6) Social Media Policy for Students; and 7) Social Media Policy for Personnel and Partners, are too general and do not contain the necessary specificity to be considered compliant with the requirements of the Data Privacy Act of 2012 (DPA).19

Thus, the EnD ordered LSGH to submit “(1) Report on the full implementation of the PIA, specifically on the aforementioned offices, and (2) Revised policies in compliance with the requirements of DPA.”20

On 19 April 2022, LSGH submitted the required documents in compliance with the EnD’s 05 April 2022 letter.21

In another letter dated 08 June 2022, the EnD stated that LSGH “failed to submit the requested revised policies,” thus, it ordered the school to furnish a copy of the revised policies.22 LSGH thereafter submitted “[t]he digital copies of the Revised Data Privacy Policy, Revised Data Privacy Security Incident Policy and Revised Security Incident Report Form.”23

On 19 July 2022, EnD sent a compliance letter to LSGH which serves as a “final demand to comply with NPC’s Order dated 21 May 2020.”24 EnD stated that:

Upon assessment, LSGH still failed to submit the following revised policies: (1) Offices Personal Data Inventory and Privacy Impact Assessment; (2) Data Privacy Security Incident Reporting Form; (3) Privacy Management Plan; (4) Social Media Policy for Students; and (5) Social Media Policy for Personnel and Partners.25

In compliance thereto, LSGH provided the documents that the EnD ordered the school to submit.26

Issue

Whether La Salle Green Hills School complied with the Resolution dated 21 May 2020.

Discussion

LSGH was ordered by this Commission to submit the result of its PIA and its Revised Privacy Policy and Security Incident Management Policy.27

Based on records and EnD’s evaluation, this Commission finds that LSGH has sufficiently complied with the Resolution dated 21 May 2020.

LSGH sufficiently complied with the requirements under NPC Advisory No. 17-03 in the conduct of its PIA

NPC Advisory No. 17-03 (Guidelines on Privacy Impact Assessment) defines a PIA as:

[A] process undertaken and used to evaluate and manage impacts on privacy of a particular program, project, process, measure, system or technology product of a PIC [Personal Information Controller] or PIP [Personal Information Processor] program, project, process, measure, system or technology product of a PIC or PIP. It takes into account the nature of the personal data to be protected, the personal data flow, the risks to privacy and security posed by the processing, current data privacy best practices, the cost of security implementation, and, where applicable, the size of the organization, its resources, and the complexity of its operations.28

Moreover, NPC Advisory No. 17-03 also states that:

In general, a PIA should be undertaken for every processing system of a PIC or PIP that involves personal data. It may also be carried out vis-à-vis the entire organization of the PIC or PIP with the involvement or participation of the different process owners and stakeholders.29 (Emphasis supplied)

Based on the review and evaluation of the EnD, LSGH has submitted the PIA results of the school’s various offices and departments.30 In its Compliance dated 06 August 2021 and 19 April 2022, LSGH sufficiently submitted the reports on the full implementation of the PIA results derived from the school’s offices and departments.31

In its PIA, LSGH identified the following common privacy risks: the occurrence of unauthorized disclosure, unavailability of data (loss of data), unauthorized alteration of data, and unauthorized access of personal data in the school’s programs, projects, processes, measures, systems, or technologies.32

Thus, LSGH reported in its PIA the significance of the school’s Data Privacy Notice, Data Privacy Consent, Disciplinary Interventions for Data Privacy Breaches, Policy on Confidentiality, and the “No Taking Home of Work Documents” policy.33

According to EnD’s Report, the PIA of LSGH includes a data inventory tracker for each processing system including the determination of purpose of each and every processing of personal data, its legal basis, type of personal data collected and other systematic description of the personal data flow and processing activities of LSGH.34

Moreover, the PIA reports have identified the risks for each processing activity and the likelihood of impact on the rights of data subjects, the existing controls, the risk rating, the remedial measures, risk owner and review date.35

In mitigating the further occurrence of risks, LSGH reported that the following actions have been or are being implemented:

(1) Reinforcement of duties and responsibilities of personnel through regular alignment meetings; (2) Strict implementation of the Institutional Office Manual provision on privacy matters and the Code of Ethics and Data Privacy Policy; (3) Retention of efficient storage and monitoring of documentation.36

For other offices and departments of LSGH, the following mitigation actions are being implemented:

(1) Regular change of password, control in the access of data, secure disposal of data of unsuccessful applications;37 (2) Two-way authentication;38 (3) Verification and proper information dissemination;39 and, (4) Incident Report with investigation along with CCTV Report.40

After LSGH evaluated the processing activities conducted by its offices and departments, security and privacy measures were implemented in order to mitigate the occurrence of the identified risks and to better protect the personal data of data subjects. After scrutinizing the various PIA Reports submitted, the Commission finds that LSGH has sufficiently demonstrated its compliance with NPC Advisory No. 17-03.

LSGH’s Revised Privacy Policy and Security Incident Management Policy are compliant with the DPA

Advisory Opinion No. 2018-013 states:

At the outset, it must be clarified that the submitted “privacy policy” should be referred to as the company’s privacy notice. A privacy notice is a statement made to a data subject that describes how the organization collects, uses, retains and discloses personal information. A privacy notice is sometimes referred to as a privacy statement, a fair processing statement or sometimes a privacy policy.41

On 05 May 2021, LSGH submitted its Revised Privacy Policy in compliance with the Resolution dated 21 May 2020.42 On 05 April 2022, the EnD required LSGH to submit its Revised Data Policy and Revised Privacy Security Incident Policy stating that these submissions were “too general and do not contain the necessary specificity to be considered compliant with the requirements of the [DPA].”43

Upon review of the Revised Privacy Policy submitted on 18 June 2022, the Commission notes that it already includes the purpose of the implementation of the Privacy Policy of LSGH, which was not indicated in the previous submission.44 The revised Privacy Policy also applies to all departments and units, its employees, personnel, students, and personal information processors.45 Moreover, the scope and coverage of the Revised Privacy Policy specifically provides for the categories of personal and sensitive personal information of data subjects (the students or applicants for admission, parents, guardians and/or alumni/alumnae, employees/personnel and applicants for employment) which are needed to be processed.46

Further, the Revised Privacy Policy includes the Guidelines for Students, Parents, Guardians, Alumni/Alumnae, Employees and Personnel on how their personal and sensitive personal information are being processed.47 Particularly for the employees and personnel, LSGH’s processing of their personal data shall be for purposes of employment application, maintaining personnel records, payroll, benefits, grants, and HMO management, among others.48 Meanwhile, for students, LSGH’s processing of their personal data is for purposes of application and enrollment, maintaining student records, marketing and publicity of the school, among others.49

Moreover, the Privacy Policy of LSGH contains the following fields:

(1) Security Measures for Protection of Personal Information;50 (2) Data Subject Rights;51 (3) Record Keeping;52 (4) Data Sharing;53 (5) Disclosure and Direct Marketing;54
(6) Responsibilities of DPO, LSGH, Students and Employees;55
(7) Creation of Data Breach Response Team and Notification Protocol;56 and,
(8) Procedure for Recovery and Restoration of Personal Data.57

LSGH likewise submitted its social media policies for students, personnel and partners which include the parents, guardians, alumni, among others.58 These policies provide guidelines on the use of social media platforms, including guidance on how students, personnel, and partners should be mindful of their legal risks and acts.59 The policies also better ensure that the students, personnel, and partners do not compromise their personal security or the security of the school’s information assets.60

LSGH further submitted its Privacy Management Plans for the school years (SY) 2021-2022 and 2022-2023.61 For SY 2022-2023, LSGH ensures the “Review and Updating of the Implementing Guidelines” of its Data Privacy Policy for students, personnel, and partners.62 LSGH stated that it shall conduct “Communication Sessions” for the implementation of its privacy policy.63

Moreover, LSGH shall draft its “data privacy consent” and shall review and update the “Risk Registry on Data Privacy” per subject area or office.64

With regard to the Security Incident Management Policy, the revised submission contains the following details:

  1. [The] Purpose and Objectives of the policy;65
  2. Security Incident/Personal Data Breach Reporting and Incident Reporting Procedure;66
  3. Initial mitigation to contain the incident/breach to prevent further damage;67
  4. Creation and composition of the Data Breach Response Team and the actions that it may take to mitigate the incident;68

In addition to the Security Incident Management Policy, LSGH likewise submitted a “Data Privacy Security Incident Reporting Form” which can be accomplished by any individual with knowledge of data privacy security incidents.69 The said form shall be used “in line with the investigation” and other legitimate purposes.70

The accomplished form shall be reviewed and assessed by the school’s DPO.71

The fields that are needed to be accomplished are:

(1) Name and Signature of the person who reports the incident, his or her department or unit; (2) Summary of the incident; (3) Timeline for the incident; (4) Reporting which includes the questions “Were there any controls in place? Who detected the breach? When was the breach isolated?” (5) Initial assessment which categorically asks the question if the incident involves sensitive personal information, among others; (6) Remedial Measures taken; (7) Impact of the incident; and, (8) Management of the incident.72

Upon review of the documents submitted and based on EnD’s evaluation, LSGH sufficiently complied with the 21 May 2020 Resolution and the subsequent Orders of the Commission. The Commission notes the revisions made by LSGH when it comes to its Privacy Policy and Security Incident Management Policy. These documents are now specific and more concrete policies, guidelines, and practices that help secure the personal data of relevant data subjects and uphold their rights.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-085, “In re: La Salle Green Hills School” is hereby considered CLOSED.

SO ORDERED.

City of Pasay, Philippines. 22 September 2022.

JOHN HENRY D. NAGA Privacy Commissioner

I CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

MMJ Data Protection Officer

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Electronic Mail dated 01 June 2018 from La Salle Green Hills School. ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Electronic Mail dated 01 June 2018 from La Salle Green Hills School. ↩

  6. Id. ↩

  7. Id. ↩

  8. Supplemental Breach Report received 03 August 2018 of La Salle Green Hills School. ↩

  9. In Re: La Salle Greenhills School, CID BN 18-085, Resolution dated 21 May 2020, at p. 3. ↩

  10. Electronic Mail dated 19 April 2021 from Mega Manila Customer Service. ↩

  11. Compliance Letter dated 20 April 2021 from Enforcement Division, at pp. 1-2. ↩

  12. Motion for Extension dated 27 April 2021 from La Salle Green Hills School, at ¶¶ 2-4. ↩

  13. Id., at ¶ 6. ↩

  14. Compliance dated 05 May 2021 from La Salle Green Hills School. ↩

  15. In Re: La Salle Greenhills School, CID BN 18-085, Resolution dated 06 May 2021, at p. 3. ↩

  16. Compliance Letter dated 28 July 2021 from Enforcement Division, at p. 2. ↩

  17. Compliance dated 06 August 2021 from La Salle Green Hills School. ↩

  18. Compliance Letter dated 05 April 2022 from Enforcement Division, at p. 1. ↩

  19. Id., at p. 2. ↩

  20. Id. ↩

  21. Compliance dated 19 April 2022 from La Salle Green Hills School. ↩

  22. Compliance Letter dated 08 June 2022 from Enforcement Division, at p. 1. ↩

  23. Compliance dated 18 June 2022 from La Salle Green Hills School. ↩

  24. Compliance Letter dated 19 July 2022 from Enforcement Division, at p. 2. ↩

  25. Id., at p. 1. ↩

  26. Compliance dated 29 July 2022 from La Salle Green Hills School. ↩

  27. In Re: La Salle Greenhills School, CID BN 18-085, Resolution dated 21 May 2020. ↩

  28. National Privacy Commission, Guidelines on Privacy Impact Assessment, NPC Advisory 2017-03, Definition of Terms, at item K (31 July 2017) (NPC Advisory 17-03). ↩

  29. NPC Advisory 17-03, Key Considerations. ↩

  30. Compliance dated 06 August 2021 from La Salle Green Hills School; See Compliance dated 19 April 2022 from La Salle Green Hills School. ↩

  31. Id. ↩

  32. See Compliance dated 06 August 2021 from La Salle Green Hills School. ↩

  33. Compliance dated 06 August 2021 from La Salle Green Hills School. ↩

  34. Compliance dated 19 April 2022 from La Salle Green Hills School. ↩

  35. Id. ↩

  36. Compliance dated 06 August 2021 from La Salle Green Hills School. ↩

  37. Id., in Admissions Office-Privacy Impact Assessment. ↩

  38. Id., in Finance Resource Department Privacy Impact Assessment. ↩

  39. Id., in Guidance and Education Intervention Services Privacy Impact Assessment. ↩

  40. Compliance dated 06 August 2021 from La Salle Green Hills School in Security and Safety Office-Privacy Impact Assessment. ↩

  41. National Privacy Commission, Privacy Policy and Consent of Data Subjects, NPC Advisory Opinion 2018-013, (18 April 2018) (NPC Advisory Opinion 2018-013). ↩

  42. Compliance dated 05 May 2021 from La Salle Green Hills School. ↩

  43. Compliance Letter dated 05 April 2022 from Enforcement Division, at p. 2. ↩

  44. Compliance dated 18 June 2022 from La Salle Green Hills in Data Privacy Policy, at p. 2. ↩

  45. Compliance dated 18 June 2022 from La Salle Green Hills in Data Privacy Policy. ↩

  46. Id., at pp. 4-7. ↩

  47. Id., at pp. 7-9. ↩

  48. Id., at p. 6. ↩

  49. Compliance dated 18 June 2022 from La Salle Green Hills in Data Privacy Policy, at p. 5. ↩

  50. Id., at p. 11. ↩

  51. Id., at p. 18. ↩

  52. Id., at p. 21. ↩

  53. Compliance dated 18 June 2022 from La Salle Green Hills in Data Privacy Policy, at p. 21. ↩

  54. Id., at p. 22. ↩

  55. Id. ↩

  56. Id., at p. 24. ↩

  57. Compliance dated 18 June 2022 from La Salle Green Hills in Data Privacy Policy, at p. 25. ↩

  58. Compliance dated 19 July 2022 from La Salle Green Hills referred to as Social Media Policy for Personnel and Partners; See also Social Media Policy for Students. ↩

  59. Id., at pp. 3-4; See also Social Media Policy for Students. ↩

  60. Id., at p. 2; See also Social Media Policy for Students. ↩

  61. Compliance dated 19 July 2022 from La Salle Green Hills referred to as Privacy Policy Management Plan. ↩

  62. Compliance dated 19 July 2022 from La Salle Green Hills referred to as Privacy Policy Management Plan SY 2022-2023, at p. 1. ↩

  63. Id., at pp. 1-2. ↩

  64. Id., at p. 4. ↩

  65. Compliance dated 18 June 2022 from La Salle Green Hills referred to as Data Privacy Security Incident Management Policy, at p. 2. ↩

  66. Id., at pp. 3-4. ↩

  67. Id., at p. 4. ↩

  68. Id., at pp. 4-6. ↩

  69. Compliance dated 19 July 2022 from La Salle Green Hills referred to as Data Privacy Security Incident Reporting Form, at p. 1. ↩

  70. Id. ↩

  71. Id. ↩

  72. Id., at pp. 1-4. ↩

Backlinks

  • No backlinks found