NPC Issuance Wiki

NPC BN 23-015: In re: Metro Pacific Tollways Corporation

Issued Resolution

Resolution Text

IN RE: METRO PACIFIC TOLLWAYS CORPORATION

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before the Commission is the notification dated 27 January 2023 submitted by Metro Pacific Tollways Corporation (MPTC) involving a possible data breach in its MPT DriveHub application.

Facts

On 27 January 2023, MPTC notified the National Privacy Commission (NPC) of a possible data breach through the Data Breach Notification Management System (DBNMS).1

In its report, MPTC narrated that on 26 January 2023, it discovered suspicious user activity in its MPT DriveHub application caused by an individual who created several accounts or via multiple referrals.2 MPTC surmised that several accounts were created in an attempt to earn more points or raffle entries to win prizes in MPTC’s “Download, Drive, & Win” promotion, which ran from 11 November 2022 to 31 January 2023.3

In its investigation, MPTC confirmed that the multiple duplicate registrations used the same email address and mobile number to register.4 MPTC believed that this indicated a potential breach of the MPT DriveHub application system with possible access to others’ personal information such as name, username, and email address.5

MPTC also stated that the number of data subjects affected is one hundred (100) but that the actual number is still to be determined.6

MPTC requested for postponement to notify its affected data subjects.7 It requested a reasonable period to notify its data subjects from the completion of the investigation in case its investigation determined that there was an actual breach.8 It also argued that no notice to the data subjects is required at that point because its preliminary investigation indicated that there was no intrusion or access to personal information in its system.9

On 06 February 2023, the Commission directed MPTC to submit proof to substantiate its request for postponement.10

On 09 February 2023, MPTC submitted its Compliance with the directive.11 MPTC requested the Commission to “instead grant an exemption to notify the affected data subjects.”12 It claimed that upon further investigation, there is “no evidence of personal information and sensitive personal information breach affecting data subjects.”13

MPTC suggested that the incident may have been done using a method called “Replay Attack”, which permits the instant creation of several users.14 MPTC defined Replay Attack as “an attack that involves the capture of transmitted authentication or access control information and its subsequent retransmission with the intent of producing an unauthorized effect or gaining unauthorized access.”15

MPTC, however, maintained that the “attack was targeted more on inputting invalid raffle entries in an attempt to win, rather than on accessing personal data found in the MPT DriveHub databases.”16

MPTC asserted that its investigation indicated “no queries, data extraction, nor malicious activities performed on the MPT DriveHub databases.”17 Thus, it concluded that there were no leaked or extracted personal data.18

The Commission noticed a disparity between MPTC’s statements in its initial report and in its compliance with the directive dated 06 February 2023.19 Thus, it issued an Order dated 16 March 2023 directing MPTC to explain the disparity and submit additional information:

WHEREFORE, premises considered, the Commission ORDERS Metro Pacific Tollways Corporation (MPTC) within ten (10) days from receipt of this Order to:

  1. SUBMIT additional details on the number of data subjects and personal and sensitive personal information involved in the incident, if any; and

  2. EXPLAIN the disparity between the number of data subjects and the involved personal and sensitive personal information stated in the initial report submitted through the DBNMS dated 27 January 2023 with the Compliance dated 09 February 2023.

SO ORDERED.20

On 27 July 2023, MPTC submitted its Reply to the Order.21 MPTC reiterated that “following an investigation on the matter, it found that there was no data breach involving data subject and/or their personal information.”22

MPTC explained that “at the time of the submission of its initial report through the [DBNMS], it was not yet determinable whether there was a reportable breach. However, out of an abundance of caution, [MPTC] thought it prudent to submit the initial report nonetheless.”23

MPTC concluded that there was no reportable personal data breach, but rather a security incident.24

Issue

Whether the incident subject of MPTC’s notification dated 27 January 2023 is a personal data breach requiring mandatory notification to the affected data subjects.

Discussion

The Commission resolves to close the matter. The incident subject of MPTC’s notification dated 27 January 2023 is a security incident and not a personal data breach. As such, is not subject to mandatory breach notification under NPC Circular 16-03 (Personal Data Breach Management).

There is a distinction between a security incident and a personal data breach.25 Section 3 of NPC Circular 16-03 defines “Personal Data Breach” and “Security Incident” as follows:

Section 3. Definition of Terms. For the purpose of this Circular, the following terms are defined, as follows:

…

F. “Personal data breach” refers to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed. A personal data breach may be in the nature of:

  1. An availability breach resulting from loss, accidental or unlawful destruction of personal data;
  2. Integrity breach resulting from alteration of personal data; and/or
  3. A confidentiality breach resulting from the unauthorized disclosure of or access to personal data.

…

J. “Security incident” is an event or occurrence that affects or tends to affect data protection, or may compromise the availability, integrity, and confidentiality of personal data. It shall include incidents that would result to a personal data breach, if not for safeguards that have been put in place26

MPTC reported that an individual was able to create several accounts in its MPT DriveHub application using the same email address and mobile number.27

MPTC reported the incident to the NPC because of its initial belief that this indicated a potential breach of the application system with possible access to others’ personal information.28

MPTC, however, later explained that the submission of the initial report was out of caution and prudence despite at that time, it was not yet determined whether there was a reportable breach.29

MPTC claimed that its further investigation showed “no evidence of personal information and sensitive personal information breach affecting data subjects.”30 It suggested that the incident was “targeted more on inputting invalid raffle entries in an attempt to win, rather than on accessing personal data found in the MPT DriveHub databases.”31

The accuracy of MPTC’s proposition regarding the reason for the creation of multiple accounts is inconsequential in this case. Nevertheless, what is clear and determinable from MPTC’s reports is that the incident only involved the creation of multiple accounts. Based on the evidence on record, the creation of multiple accounts did not lead to an unauthorized access of the MPT DriveHub databases nor an acquisition by an unauthorized person of any personal information from the databases. MPTC’s investigation indicated no evidence of leaked or extracted personal and sensitive personal information.32 It also did not find any malicious activities performed in its MPT DriveHub databases.33

Therefore, the incident is considered a security incident since there is no personal data that was compromised. The incident did not indicate any breach in MPTC’s DriveHub databases that led to an accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data stored or processed in the databases.

WHEREFORE, premises considered, the Commission NOTES the submissions of Metro Pacific Tollways Corporation (MPTC) and resolves that the matter of NPC BN 23-015 In re: Metro Pacific Tollways Corporation is CLOSED.

SO ORDERED.

City of Pasay, Philippines. 17 August 2023.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

ATTY. CSM Data Privacy Officer Metro Pacific Tollways Corporation

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Initial Notification through the Personal Data Breach Notification Form, 27 January 2023, in In re: Metro Pacific Tollways Corporation, NPC BN 23-015 (NPC 2023). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Initial Notification through the Personal Data Breach Notification Form, 27 January 2023, in In re: Metro Pacific Tollways Corporation, NPC BN 23-015 (NPC 2023). ↩

  8. Id. ↩

  9. Id. ↩

  10. Minute Resolution, 06 February 2023, at 1, in In re: Metro Pacific Tollways Corporation, NPC BN 23-015 (NPC 2023). ↩

  11. Compliance by Metro Pacific Tollways Corporation, 09 February 2023, at 1, in In re: Metro Pacific Tollways Corporation, NPC BN 23-015 (NPC 2023). ↩

  12. Id. ↩

  13. Id. ↩

  14. Id. at 2. ↩

  15. Id. ↩

  16. Id. ↩

  17. Compliance by Metro Pacific Tollways Corporation, 09 February 2023, at 2, in In re: Metro Pacific Tollways Corporation, NPC BN 23-015 (NPC 2023). ↩

  18. Id. ↩

  19. Order, 16 March 2023, at 6, in In re: Metro Pacific Tollways Corporation, NPC BN 23-015 (NPC 2023). ↩

  20. Id. ↩

  21. Reply by Metro Pacific Tollways Corporation, 27 July 2023, at 1, in In re: Metro Pacific Tollways Corporation, NPC BN 23-015 (NPC 2023). ↩

  22. Id. ↩

  23. Id. ↩

  24. Id. ↩

  25. In re: University of the Philippines – Visayas, NPC BN 18-045, 10 November 2022, at 4, available at https://privacy.gov.ph/wp-content/uploads/2023/05/NPC-BN-18-045-2022.11.10-In-re-University-of-the-Philippines-Visayas-Resolution-Final.pdf (last accessed 29 August 2023). ↩

  26. National Privacy Commission, Personal Data Breach Management, Circular No. 03, Series of 2016 [NPC Circ. No. 16-03], § 3 (F) & (J) (15 December 2016). ↩

  27. Initial Notification through the Personal Data Breach Notification Form, 27 January 2023, in In re: Metro Pacific Tollways Corporation, NPC BN 23-015 (NPC 2023). ↩

  28. Id. ↩

  29. Reply by Metro Pacific Tollways Corporation, 27 July 2023, at 1, in In re: Metro Pacific Tollways Corporation, NPC BN 23-015 (NPC 2023). ↩

  30. Compliance by Metro Pacific Tollways Corporation, 09 February 2023, at 1, in In re: Metro Pacific Tollways Corporation, NPC BN 23-015 (NPC 2023). ↩

  31. Id. at 2. ↩

  32. Id. at 2-4. ↩

  33. Id. at 2. ↩

Backlinks

  • No backlinks found