NPC Issuance Wiki

NPC BN 18-120: In re: Dyna Drug Corporation

Issued Resolution

Resolution Text

IN RE: DYNA DRUG CORPORATION

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before the Commission is Dyna Drug Corporation’s (DDC) Compliance dated 04 May 2022 following the Commission’s directive to submit a Post Breach Report and proof of notification to its affected data subjects.

Facts

DDC’s Quality Management Department (QMD) used a subscription-based site Typeform to collect customer survey data from March to June 2017.1

On 03 July 2018, DDC sent an email to the National Privacy Commission (NPC) informing the latter that its online 2017 customer survey data held by Typeform was breached on 03 May 2018.2

DDC forwarded to the NPC an email dated 29 June 2018 from Typeform.3 The email stated that Typeform’s engineering team discovered on 27 June 2018 that an unknown third-party gained access to its server and downloaded certain information including some of the data which DDC’s respondents provided through Typeform.4

On 04 July 2018, DDC submitted to the NPC its Breach Incident Report containing a detailed report of the incident.5 DDC reported that there were ninety-two (92) affected data subjects.6 Further, the personal data involved are their full names, office address, email addresses, office telephone numbers, and mobile numbers.7

DDC also stated the measures it took to address the breach and prevent its recurrence.8 It claimed that it already deleted the 2017 survey form that was the subject of the breach.9 It added that it will not renew its subscription with Typeform and will use a different online survey host for its 2018 survey.10 It further informed the Commission that its Communications Officer will coordinate with its Information Technology team (IT) to ensure the security of the host site and its internal Internet Protocol (IP) address in the event attackers try to breach.11

Further, DDC showed that it already notified its affected data subjects by submitting a screenshot of the email it sent to the affected data subjects on 04 July 2018.12 It informed the affected data subjects that their information was exfiltrated by an unauthorized third party through a breach in Typeform’s system:

Dear Valued Customer,

You are receiving this e-mail because you were one of our respondents to our 2017 Customer Survey. This was accessed online via Typeform.

We just received a message that Typeform had a data breach, which affected one (or more) of the typeforms we sent out. Typeform reported that an external attacker managed to get unauthorized access to respondent data and downloaded it.

Typeform responded immediately and fixed the source of the breach to prevent any further intrusion.

If your name and email was downloaded by the attackers, then we recommend that you watch out for potential phishing scams, or spam emails. Please be careful in opening links sent by advertisements or senders you do not know.

As Dyna Drug’s course of action, we have deleted your information from our account in Typeform.

If you have any other questions, feel free to contact us by replying to this email or thru telephone number [.].13

On 18 April 2022, the Commission, through its Complaints and Investigation Division (CID), issued an Order directing DDC to submit a Post Breach Report detailing the incident:

Pursuant to Section 9, Rule IV of the National Privacy Commission Circular No. 16-03 on Personal Data Breach Management, you are hereby required to submit a Post Breach Report detailing the incident that prompted the notification to the Commission:

  1. DDC’s investigation report;
  2. Certification that the survey form has been deleted;
  3. What were the security enhancement implemented by DDC and proof thereof;
  4. Policy on third-party Online Survey Host;
  5. Results of coordinating with IT on ensuring the security of the host site and review on the internal IP address to check its vulnerability from a direct attack on its internal systems and processes concerning personal data privacy;
  6. How many of the 92 data subjects affected were notified and provide proof of notification;
  7. Proof of other security measures implemented to address the breach and prevent its recurrence;
  8. Updated Privacy Policy of DDC; and
  9. Certification from DDC that data subjects have been appropriately notified.

DYNA DRUG CORPORATION is hereby given a period of fifteen (15) days from receipt hereof to submit its compliance through email at complaints@privacy.gov.ph.

SO ORDERED.14

On 04 May 2022, DDC submitted its Compliance with the Order.15

DDC re-submitted the Breach Incident Report it submitted on 04 July 2018 which contained DDC’s investigation report on the incident.

DDC also submitted a Certification signed by its Data Protection Officer (DPO) and its Managing Director, which stated that DDC’s former Communications Officer already deleted the 2017 survey form on 03 July 2018.16 DDC also presented an email from Typeform dated 27 April 2022 wherein Typeform confirmed the deletion of DDC’s survey form in the Typeform platform.17

On the matter of DDC’s security enhancement measures, it admitted that it had not implemented any policy related to the Data Privacy Act (DPA) in 2018.18 In 2019, it further admitted that there was still no policy implemented on “Third-party Online Survey Host[s]“.19 Nevertheless, DDC claimed that after the incident, it changed and revised its customer survey forms by removing the collection of personal identifiable information of the data subjects.20

Further, it submitted a copy of its Customer Satisfaction Survey Procedures and Computer Software and Hardware Maintenance Policy, which became effective on 21 September 202121 and 17 January 2022,22 respectively.

DDC also submitted its Data Privacy Manual which became effective on 06 April 2022.23 DDC pointed out that its policies regarding third-party online survey host is found in Section 12 of its Data Privacy Manual24 that sets out its policies on Outsourcing and Subcontracting Agreements.25

With regard to the notification of the affected data subjects, DDC already presented proof of its notification when it attached in its Breach Incident Report a screenshot of the email it sent to the affected data subjects.26 Nevertheless, DDC acknowledged that the screenshot in the Report only captured a part of the email recipient field which listed up to only thirty (30) affected data subjects.27 Therefore, DDC submitted a Certification signed by its DPO and Managing Director which stated that DDC successfully delivered the notifications to the ninety-two (92) affected data subjects on 04 July 2018.28

Issue

Whether DDC notified its affected data subjects and sufficiently addressed the breach and implemented measures to prevent its recurrence.

Discussion

The Commission resolves to close the matter. DDC’s submissions show that it properly notified its affected data subjects, sufficiently addressed the breach, and implemented measures to prevent its recurrence.

It is the obligation of a Personal Information Controller (PIC), such as DDC, to ensure that it promptly and properly notifies its affected data subjects of the breach.29 Further, the Commission has consistently pointed out that the purpose of the required notification to the data subjects of a breach is to allow them to take the necessary precautions or other measures to protect themselves against its possible effects.30

In this case, DDC notified its affected data subjects through email.31 It informed them that a breach occurred in Typeform’s system which allowed an unauthorized person to gain access and exfiltrate their data in the system.32 The notification also specified that the recipient data subject was affected because he or she was a respondent to DDC’s 2017 Customer Survey collected through Typeform.33

DDC also advised its affected data subjects to watch out for potential phishing scams, spam emails, or any links from unknown senders.34 This allowed the data subjects to take the necessary precautions to protect themselves against the possible effects of the breach considering that the exfiltrated data included their names and email addresses.35

Further, DDC informed the data subjects that it deleted the information from its affected data subjects’ accounts in Typeform.36 DDC provided the data subjects with its contact information in case they have any further concerns regarding the breach.37

DDC also presented evidence of the notifications sent through email by attaching a screenshot of the email notification.38 The screenshot also showed that the email addresses of the recipient data subjects were inputted in the blind carbon copy (BCC) field.39 This conforms to the requirement under Section 18 (D) of NPC Circular 16-03 (Personal Data Breach Management), which provides that notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic.40

Although the screenshot presented by DDC captured only a part of the email BCC recipient list,41 it, nevertheless, submitted a Certification by its DPO to assure the Commission that all ninety-two (92) affected data subjects were notified through email.42

DDC sufficiently addressed the breach and adopted measures to prevent its recurrence. DDC claimed that it changed and revised its customer survey forms by removing the collection of personal information of the data subjects.43

DDC confirmed that the deletion of the 2017 customer survey form and respondents’ information with Typeform.44 In addition, DDC terminated its subscription with Typeform and decided to use a different host to conduct its online 2018 survey.45

On 21 September 2021, DDC introduced a new process for the conduct of its Customer Satisfaction Survey.46 The process measures customer satisfaction in relation to the company’s quality management system at planned intervals.47 The survey activity is set to be conducted semi-annually.48 In addition, the process includes a new method for identifying participants for the survey.49

DDC also adopted a Computer Software and Hardware Maintenance Policy to maintain the security of its own systems.50 DDC’s computer hardware and software must undergo periodic maintenance to improve the performance of its operating system.51 All computer hardware must be tagged for identification, and only approved company products must be installed.52 Employees are required to provide access to all DDC computer systems for scheduled maintenance to enhance operating system performance.53 During such maintenance activities, unauthorized removal of hardware or software components is strictly prevented to safeguard the computer system.54

Further, DDC requires the conduct of diagnosis for new security risks and vulnerabilities,55 regular scanning for virus detection,56 and monitoring to detect system issues or disruption within its organization.57 This allows DDC to update and configure its operation system to mitigate the identified risks and vulnerabilities.58

Lastly, DDC also adopted a Data Privacy Manual to ensure the safety and security on processing of all personal data of its data subjects.59 It provided guidelines for the implementation of organizational security measures,60 physical security measures,61 and technical security measures.62 It also provided for procedures on managing breach and security incidents.63

DDC’s Data Privacy Manual also contained provisions on outsourcing and subcontracting agreements64 which may serve as its guideline should it outsource the collection of customer survey responses.

It provided for the appointment of a Data Protection Officer (DPO) to make the necessary control measures in securing personal information and preserve the rights of the data subjects and to be the advisor of DDC’s Managing Director in data protection improvement initiatives.65

It also outlined the creation of a Data Breach Response Team responsible for implementing security incident management policies, managing incidents, and ensuring compliance with the DPA.66

DDC, through its DPO, also implements preventive measures such as an annual Privacy Impact Assessment and Privacy Audit;67 backup systems are in place in case of data recovery and restoration;68 backup systems have their own backups to ensure data restoration in the event of data losses;69 and security breaches are reported directly to the DPO who assesses the breach and notifies the NPC.70

Given the foregoing, the Commission finds that the measures undertaken by DDC has sufficiently addressed the incident and prevents its recurrence.

WHEREFORE, premises considered, the Commission resolves that the matter of NPC BN 18-120 In re: Dyna Drug Corporation is CLOSED.

SO ORDERED.

City of Pasay, Philippines. 17 August 2023.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

KTG Data Protection Officer Dyna Drug Corporation

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Breach Incident Report, 04 July 2018, at 2, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2018). ↩

  2. Email from Dyna Drug Corporation to NPC Reports, National Privacy Commission (03 July 2018). ↩

  3. Id. ↩

  4. Email from Typeform to Dyna Drug Corporation (29 June 2018). ↩

  5. Email from Dyna Drug Corporation to NPC Reports, National Privacy Commission (04 July 2018). ↩

  6. Breach Incident Report, 04 July 2018, at 1, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2018). ↩

  7. Id. ↩

  8. Id. at 2. ↩

  9. Id. ↩

  10. Id. ↩

  11. Id. ↩

  12. Breach Incident Report, 04 July 2018, Annex B, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2018). ↩

  13. Id. ↩

  14. Order, 18 April 2022, at 1, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  15. Compliance, 04 May 2022, at 1, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  16. Certificate of Survey Form Deletion, 02 May 2022, at 1, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  17. Post Breach Report, 04 May 2022, at 3, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  18. Id. ↩

  19. Id. ↩

  20. Id. ↩

  21. Customer Satisfaction Survey Procedures, 21 September 2021, at 1, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  22. Computer Software and Hardware Maintenance Policy, 17 January 2022, at 1, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  23. Data Privacy Manual, 06 April 2022, at 1, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  24. Post Breach Report, 04 May 2022, at 4, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  25. Data Privacy Manual, 06 April 2022, at 14, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  26. Breach Incident Report, 04 July 2018, Annex B, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2018). ↩

  27. Id. at 5. ↩

  28. Certification of Notification, 02 May 2022, at 1, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  29. National Privacy Commission, Personal Data Breach Management, Circular No. 03, Series of 2016 [NPC Circ. No. 16-03], § 18 (A) (15 December 2016). ↩

  30. Id. ↩

  31. Breach Incident Report, 04 July 2018, Annex B, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2018). ↩

  32. Id. ↩

  33. Id. ↩

  34. Id. ↩

  35. Id. ↩

  36. Id. ↩

  37. Breach Incident Report, 04 July 2018, Annex B, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2018). ↩

  38. Id. ↩

  39. Id. ↩

  40. National Privacy Commission, Personal Data Breach Management, Circular No. 03, Series of 2016 [NPC Circ. No. 16-03], § 18 (A) (15 December 2016). ↩

  41. Breach Incident Report, 04 July 2018, Annex B, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2018). ↩

  42. Certification of Notification, 02 May 2022, at 1, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  43. Post Breach Report, 04 May 2022, at 3, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  44. Id. ↩

  45. Breach Incident Report, 04 July 2018, at 2, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2018). ↩

  46. Customer Satisfaction Survey, 21 September 2021, at 1, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2021). ↩

  47. Id. ↩

  48. Id. ↩

  49. Id. at 2. ↩

  50. Computer Software and Hardware Maintenance Policy, 17 January 2022, at 1, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  51. Id. ↩

  52. Id. ↩

  53. Id. ↩

  54. Id. at 2. ↩

  55. Id. ↩

  56. Computer Software and Hardware Maintenance Policy, 17 January 2022, at 2, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  57. Id. at 3. ↩

  58. Id. at 2. ↩

  59. Data Privacy Manual, 06 April 2022, at 1, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  60. Id. at 6. ↩

  61. Id. at 8. ↩

  62. Id. at 10. ↩

  63. Id. at 17. ↩

  64. Id. at 14. ↩

  65. Data Privacy Manual, 06 April 2022, at 17, in In re: Dyna Drug Corporation, NPC BN 18-120 (NPC 2022). ↩

  66. Id. at 17-18. ↩

  67. Id. at 18. ↩

  68. Id. ↩

  69. Id. ↩

  70. Id. ↩

Backlinks

  • No backlinks found