NPC Issuance Wiki

NPC BN 18-179: In re: ABS-CBN Corporation

Issued Resolution

Resolution Text

IN RE: ABS-CBN CORPORATION

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before the Commission is the Compliance dated 12 May 2021 submitted by ABS-CBN Corporation (ABS-CBN) in fulfillment of the directive in the Order dated 11 March 2021.1

Facts

On 11 March 2021, the Commission issued an Order instructing ABS-CBN to submit proof of its notification to the affected data subjects:

WHEREFORE, the Commission ORDERS ABS-CBN Corporation to submit proof of notification to the two-hundred eight (208) data subjects who were affected by the breach, within fifteen (15) days from receipt of this Order.

SO ORDERED.2

ABS-CBN, through its newly appointed Data Protection Officer (DPO), acknowledged that it received the Order dated 11 March 2021 through e-mail on 05 April 2021.3 Further, it informed the Commission that according to its former DPO, it provided an update on the notification of data subjects to the Commission in September or October 2018.4 Thereafter, ABS-CBN forwarded to the Commission the email threads that showed the internal reports regarding the notification of affected data subjects.5

The National Privacy Commission’s Enforcement Division (EnD) sent a Compliance Letter dated 22 April 2021 to ABS-CBN acknowledging receipt of the copy of email threads.6 The EnD, however, found the submissions insufficient and inadequate since the submissions did not contain proof that the data subjects were actually informed of the breach.7 ABS-CBN’s report only mentioned that it notified the data subjects through e-mails, phone calls, and letters sent through couriers.8 The EnD instructed ABS-CBN to submit a copy of the breach notification sent to the affected data subjects and proof that the notification was received by the respective data subjects.9

On 12 May 2021, ABS-CBN submitted the following documents:

  1. A template of the notification sent to the affected data subjects;10
  2. Online Store Report – Summary of Actions Taken;11
  3. Copy of the actual emails sent to affected data subjects;12
  4. Outbound Call Log Results;13
  5. Status of E-mails and Callouts;14
  6. Recordings of the phone calls to affected data subjects;15
  7. Certification from Slash.PH;16 and
  8. Delivery Status Report of Couriered Mail.17

The EnD acknowledged the receipt of ABS-CBN’s submissions, but it determined that there were still insufficiencies in the submissions.18 It stated that the copy of the emails sent to affected data subjects failed to prove that they received the notification since there were no acknowledgments from the recipients that were included.19 The EnD further noted the discrepancy between the number of recorded successful call-outs and the number of data subjects actually notified by phone call.20 According to the EnD, the Online Store Report identified a total of sixty (60) successful call-outs, while ABS-CBN only sent thirty-four (34) call recordings.21 The EnD also stated that in relation to the notification of data subjects by mail, the tracking numbers provided by ABS-CBN from the courier could not be verified on the courier’s website.22

The EnD, thus, reiterated its instructions for ABS-CBN to submit a copy of the breach notification sent to the affected data subjects and proof of receipt of the notification.23 It further ordered ABS-CBN to submit a complete status report of the notification to affected data subjects, which should specify the number of data subjects notified through email, phone, or courier.24

On 22 October 2021, ABS-CBN explained that it sent a copy of the e-mails sent to the affected data subjects because it no longer has a copy of the return receipts in its system.25 As to the discrepancy with the number of data subjects successfully notified by phone call, ABS-CBN stated that it submitted four (4) emails containing the call recordings to the Commission on 12 May 2021.26 In relation to the tracking numbers from the courier, ABS-CBN explained that old tracking numbers could no longer be accessed from the courier’s website.27 It manifested that it would submit a certification from the courier that the tracking numbers were valid and the mails were successfully delivered.28

On 14 February 2022, the EnD sent another letter to ABS-CBN informing it that the submitted copy of the contents of the breach notification still failed to show proof that all affected data subjects received the notification.29 According to the EnD, ABS-CBN reported that it sent email notifications to two hundred one (201) out of two hundred twenty-five (225) data subjects.30 The screenshots submitted by ABS-CBN, however, did not show that the data subjects acknowledged that they received the email.31 The EnD found that the email notification failed to prove that the data subjects were actually notified or that they received the notification.32 It instructed ABS-CBN to submit proof that all affected data subjects received the notification, which may include “email tracking showing the status of the email sent, sworn affidavit of the person who sent the email notifications, sworn affidavit of the person who called the data subjects through phone, or proof of receipt from the private courier.”33

As to the submitted call recordings, the EnD reiterated that it was able to extract only thirty-four (34) call recordings.34

On 03 March 2022, ABS-CBN further clarified certain matters in relation to its submissions.35 It explained that it could not provide a sworn affidavit of the person who sent the notification to affected data subjects by email because the person is no longer connected with ABS-CBN’s third-party service provider.36 Hence, ABS-CBN manifested whether it could submit a certification from iCONN, ABS-CBN’s third-party service provider, attesting that all emails were successfully delivered and that there were only seven (7) undeliverable receipts.37 As to the call recordings, ABS-CBN explained that sixty-four (64) call-outs were actually made, but four (4) of the call recordings were no longer on file; thus, only sixty (60) call recordings were submitted through email on 12 May 2021.38 Lastly, ABS-CBN stated that it submitted a copy of the certification from the courier to prove that seven (7) mails were successfully delivered to the recipients who had no email addresses nor contact numbers on record.39

The EnD, through its Compliance Letter dated 01 August 2022, instructed ABS-CBN to submit proof that the two hundred eight (208) affected data subjects indicated in the Order dated 11 March 2021 received the breach notification and submit the remaining recordings of successful callouts.40

On 18 August 2022, ABS-CBN clarified that there were actually two hundred nine (209) affected data subjects.41 According to ABS-CBN, out of the two-hundred nine (209) affected data subjects, two-hundred two (202) were notified by email.42 ABS-CBN manifested that it submitted copies of the two hundred one (201) emails to the Commission on 12 May 2021, while the remaining e-mail was missing from its records.43 The remaining seven (7) out of the two-hundred nine (209) affected data subjects were notified by mail sent through a private courier.44 ABS-CBN specified that it submitted on 18 November 2021 the private courier’s certification that the mails were received by the appropriate recipients.45

ABS-CBN further manifested that it has successfully notified by phone call sixty (60) data subjects out of eighty-one (81) affected data subjects whose contact numbers were found on record.46 It reported that it submitted the recordings of the sixty (60) successful callouts in three (3) separate emails to the Commission.47

In its email to the Commission dated 18 August 2022, ABS-CBN attached the Sworn Affidavit of RSC, the team lead who was directly involved in sending the notification to affected data subjects by e-mail.48 Further, ABS-CBN re-sent the recordings of the sixty (60) successful callouts.49

Issue

Whether the submissions of ABS-CBN sufficiently complied with the Order dated 11 March 2021.

Discussion

The Commission resolves to close the case upon finding that ABS-CBN has complied with the Order dated 11 March 2021.

In concurrence with the EnD’s assessment,50 the Commission finds that the documents submitted by ABS-CBN are sufficient to prove that it adequately notified the affected data subjects of the details of the breach.

ABS-CBN’s notification to affected data subjects included the information required under NPC Circular 16-03 (Personal Data Breach Management).

Section 18 (C) of NPC Circular 16-03 provides:

Section 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

…

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;

In Re: ABS -CBN Corporation

  1. measures taken to reduce the harm or negative consequences of the breach;
  2. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  3. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.51

The notification stated that there was a report of a data breach of ABS-CBN’s online shopping facility and identified that the credit card details of the affected data subjects may have been exposed.52 The notification also specified that ABS-CBN temporarily took down the ABS-CBN Store and the UAAP Store websites.53 It also advised the data subjects to change their usernames and passwords and to not provide any personal data to anyone who claims to be an ABS-CBN representative.54 The notification also provided an e-mail address where the data subjects could send their questions or concerns.55

In addition, the copies of the e-mails sent to the affected data subjects,56 the Sworn Affidavit of RSC,57 the recordings of phone calls to affected data subjects,58 and the delivery status report from the courier59 substantially prove that ABS-CBN notified the affected data subjects regarding the breach. The EnD found that these submissions comply with the requirements provided under Section 18 (A) and Section 18 (D) of NPC Circular 16-03.60 Hence, it is recommended that the case be closed.61 The Commission affirms the EnD’s recommendation and closes the case.

Nonetheless, the Commission stresses that the determination of whether ABS-CBN’s acts or omissions contributed to the breach or gave rise to other violations of the DPA are beyond the scope of NPC Circular 16-03 and the matters currently before the Commission.

WHEREFORE, premises considered, the Commission resolves that NPC BN 18-179 – In re: ABS-CBN Corporation is hereby CLOSED.

Further, pursuant to Rule X, Section 1 of NPC Circular 2021-01 (2021 NPC Rules of Procedure), the Commission ORDERS its Complaints and Investigation Division (CID) to conduct a sua sponte investigation on possible violations under Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012, that may have been committed by ABS-CBN Corporation.

SO ORDERED.

City of Pasay, Philippines.

12 October 2022.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

Copy furnished:

LSA

Data Protection Officer

ABS-CBN Corporation

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Compliance, 12 May 2021, in In re: ABS-CBN Corporation, NPC BN 18-179 (NPC 2022). ↩

  2. Order, 11 March 2021, at 8, in In re: ABS-CBN Corporation, NPC BN 18-179 (NPC 2022). ↩

  3. E-mail from LSA, Data Protection Officer of ABS-CBN Corporation, to National Privacy Commission (06 April 2021). ↩

  4. Id. ↩

  5. Id. ↩

  6. Letter Re: Order of the Commission En Banc dated 11 March 2021 (CID BN 18-179 “IN RE: ABS-CBN CORPORATION”), 22 April 2021, in In re: ABS-CBN Corporation, NPC BN 18-179 (NPC 2022). ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. ↩

  10. E-mail from LSA, Data Protection Officer of ABS-CBN Corporation, to National Privacy Commission (12 May 2021), Annex A. ↩

  11. Id. Annex B. ↩

  12. Id. Annex C. ↩

  13. Id. Annex D. ↩

  14. Id. Annex E. ↩

  15. Id. Annex F. ↩

  16. E-mail from LSA, Data Protection Officer of ABS-CBN Corporation, to National Privacy Commission (12 May 2021), Annex G. ↩

  17. Id. Annex H. ↩

  18. Letter Re: Order of the Commission En Banc dated 11 March 2021 (CID BN 18-179 “IN RE: ABS-CBN CORPORATION”), 11 October 2021, in In re: ABS-CBN Corporation, NPC BN 18-179 (NPC 2022). ↩

  19. Id. ↩

  20. Id. ↩

  21. Id. ↩

  22. Id. ↩

  23. Id. ↩

  24. Letter Re: Order of the Commission En Banc dated 11 March 2021 (CID BN 18-179 “IN RE: ABS-CBN CORPORATION”), 11 October 2021, in In re: ABS-CBN Corporation, NPC BN 18-179 (NPC 2022). ↩

  25. E-mail from LSA, Data Protection Officer of ABS-CBN Corporation, to National Privacy Commission (22 October 2021). ↩

  26. Id. ↩

  27. Id. ↩

  28. Id. ↩

  29. Letter Re: Order of the Commission En Banc dated 11 March 2021 (CID BN 18-179 “IN RE: ABS-CBN CORPORATION”), 14 February 2022, in In re: ABS-CBN Corporation, NPC BN 18-179 (NPC 2022). ↩

  30. Id. ↩

  31. Id. ↩

  32. Id. ↩

  33. Id. ↩

  34. Id. ↩

  35. E-mail from LSA, Data Protection Officer of ABS-CBN Corporation, to National Privacy Commission (03 March 2022). ↩

  36. Id. ↩

  37. Id. ↩

  38. Id. ↩

  39. Id. ↩

  40. Letter Re: Compliance with Order dated 11 March 2021 (CID BN 18-179 “IN RE: ABS-CBN CORPORATION”), 01 August 2022, in In re: ABS-CBN Corporation, NPC BN 18-179 (NPC 2022). ↩

  41. E-mail from LSA, Data Protection Officer of ABS-CBN Corporation, to National Privacy Commission (18 August 2022). ↩

  42. Id. ↩

  43. Id. ↩

  44. Id. ↩

  45. Id. ↩

  46. Id. ↩

  47. E-mail from LSA, Data Protection Officer of ABS-CBN Corporation, to National Privacy Commission (18 August 2022). ↩

  48. Id. Annex A. ↩

  49. Id. ↩

  50. Enforcement Assessment Report, 27 September 2022, at 4, in In re: ABS-CBN Corporation, NPC BN 18-179 (NPC 2022). ↩

  51. National Privacy Commission, Personal Data Breach Management, Circular No. 3, Series of 2016 [NPC Circ. No. 16-03], § 18 (C) (15 December 2016). ↩

  52. E-mail from LSA, Data Protection Officer of ABS-CBN Corporation, to National Privacy Commission (12 May 2021), Annex A. ↩

  53. Id. ↩

  54. Id. ↩

  55. Id. ↩

  56. Id. Annex C. ↩

  57. Id. Annex A. ↩

  58. E-mail from LSA, Data Protection Officer of ABS-CBN Corporation, to National Privacy Commission (12 May 2021), Annex F. ↩

  59. E-mail from LSA, Data Protection Officer of ABS-CBN Corporation, to National Privacy Commission (12 May 2021). ↩

  60. Enforcement Assessment Report, 27 September 2022, at 6, in In re: ABS-CBN Corporation, NPC BN 18-179 (NPC 2022). ↩

  61. Id. ↩

Backlinks

  • No backlinks found