NPC Issuance Wiki

NPC BN 18-023: In Re: Unilever Philippines

Issued Resolution

Resolution Text

IN RE: UNILEVER PHILIPPINES

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is the Compliance submitted by Unilever Philippines (Unilever), dated 26 February 2021.1

Facts

On 10 September 2020, the Commission issued an Order to Unilever, to wit:

WHEREFORE, premises considered, Unilever Philippines is hereby ORDERED to comply with the following within ten (10) days from receipt of this Order:

  1. NOTIFY the affected data subject with dispatch;

  2. SUBMIT a full breach report in compliance with Section 9 of the NPC Circular 16-03, including the following documents: (a) Post-breach report detailing the measures it has since undertaken to prevent, avoid or reduce the recurrence of a similar personal data breach; (b) Proof of deletion of the subject email from the office email accounts and from all email recipients; and (c) Proof that subject email was not successfully delivered to the Yahoo! Email account; and

  3. SHOW CAUSE in writing why contempt proceedings should not be instituted in court for its failure to notify the affected data subjects as required under NPC Circular 16-03.2

On 15 February 2021, Unilever stated that it received a copy of the Order of the Commission dated 10 September 2020.3

On 26 February 2021, Unilever submitted its Compliance to the said Order.4 In Unilever’s Compliance, they attached their Full Breach Report with its Annexes.5

In Unilever’s Compliance, they claimed that the security incident was not covered by the mandatory breach requirement under Section 11 of the NPC Circular 16-03, since the incident did not bring any risks and possible harm to the affected data subjects.6 Unilever argued that they “took into consideration several factors such as the circumstances of the breach, including whether [there was] any malicious activity involved.”7 Further, Unilever asserted that there was “zero to low possibility” that the recipients made copies of the Excel file containing the personal data since all the recipients were Unilever employees and the Company’s Information Technology (IT) system and office-issued laptops do not allow transferring or saving of files to an external drive.8

Moreover, Unilever argues that they also assessed how long the information was accessible before the breach was discovered, to wit:

The theory is that if the information had been accessible for a significant period of time, then it may be likely that the personal information was accessed in ways that could result in serious harm. In this case, the subject email with attachment was mistakenly sent by a Unilever employee on February 23, 2018, on a Friday, at around 4:36 p.m. Given the day and the time that the email was sent, it was unlikely that the subject email was accessed and opened by all of the recipients at that time. The following day, or on February 24, 2018, the Company’s Information Security Team traced emails in the servers and immediately deleted all emails containing the personal data from Unilever office email accounts.9

Unilever also stated that according to their Information Security Team, the subject email with the attachment was not successfully delivered to the Yahoo! email and no third party gained access to the personal data.10

Unilever also averred that although there were sensitive personal information involved in the incident, that the “possibility of identity fraud was very unlikely considering that no third party gained access to the personal data.”11 Moreover, Unilever stated that they “have not received any reports from the affected data subjects regarding the misuse of their personal data such as unusual banking activities or identity fraud.”12

Unilever stated that they voluntarily notified the affected data subjects and attached the “sample email notification” sent to the data subjects,13 to wit:

Further, on February 28, 2018, Unilever voluntarily notified the affected data subjects as a matter of best practice in ensuring disclosure to said employees in matters affecting their personal data, thereby retaining and bolstering their trust and confidence in the Company. The Company, through its Communications Team, sent an email notification of the breach to the affected data subjects.14

Moreover, Unilever claims that the third condition under NPC Circular 16-03 was not present, stating that “since the inadvertent sending of the email containing employee personal information within the organization, coupled with the security and mitigation measures implemented by Unilever, did not pose a real risk of serious harm to the affected data subjects.”15

Finally, in Unilever’s Compliance, they prayed that the Commission admits the Full Breach Report in compliance with the NPC Circular No. 16-03 together with its attachments, and “should be absolved from liability, including for contempt, arising or resulting from the incident.”16

Issue

Whether Unilever Philippines has sufficiently complied with the Commission’s Order dated 10 September 2020.

Discussion

The Commission resolves to note Unilever’s Compliance and close the matter.

In Unilever’s Compliance dated 26 February 2021, it stated that the affected data subjects were already notified on 27 February 2018.17 The said notification states that:

This company advisory is to inform you that we discovered an information security issue in our system involving some personal employee information.

We take matters of privacy very seriously and have taken urgent steps to protect the integrity of all personal information. While this issue has been limited in our internal systems only, please be assured that our I.T. security was able to delete and prevent any further disclosure of any confidential employee information.

You may email XXXXXX for any queries that you may have.

Thank you.18

Section 18 (C) of NPC Circular 16-03 provides the contents of proper notification to the affected data subjects:

Section 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

…

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.19

Unilever’s notification to the affected data subjects does not conform with the contents required for notification under NPC Circular 16-03, the same only provides for a general statement as to the measures they undertook in deleting the email and provides for the e-mail address of the representative should there be a need for any assistance.

Moreover, as stated in Unilever’s Compliance, they have not received any reports from the affected data subjects regarding the misuse of their personal data such as unusual banking activities or identity fraud.20

The Commission stresses that as PIC, Unilever must employ all necessary and reasonable means to ensure the security of personal information under its custody and control.21

Section 20 (a) of the Data Privacy Act of 2012 provides:

Sec. 20. Security of Personal Information. (a) The personal information controller must implement reasonable and appropriate organizational, physical, and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.22

Furthermore, as also emphasized in Section 4 (B) of NPC Circular 16-03:

SECTION 4. Security Incident Management Policy. A personal information controller or personal information processor shall implement policies and procedures for the purpose of managing security incidents, including personal data breach. These policies and procedures must ensure:

B. Implementation of organizational, physical and technical security measures and personal data privacy policies intended to prevent or minimize the occurrence of a personal data breach and assure the timely discovery of a security incident.23

In Unilever’s Full Breach Report, it declared that their Information Security Team “confirmed” that the e-mail with attachment was not successfully delivered to the Yahoo! e-mail account, declaring that no third party gained access to the personal data.24 In addition, Unilever’s Global IT Team confirmed that they have a policy that “disallows or blocks all auto-forwarding to an external address at the server level.”25

As to the employee who erroneously sent the email and the employee who forwarded the subject email to two other recipients, Unilever stated that they instituted an internal investigation and administrative cases to said employees.26 Unilever claims their investigation showed that the employee who erroneously sent the email “had no ill intention but was negligent as he failed to check the contents of the Excel file before sending it out.”27 As to the employee who forwarded the subject e-mail, he claimed that “he sent the email without thoroughly reading what the email was about.”28 Thus, Unilever imposed a 15-day suspension for each employee.29

Unilever stated that prior to the incident, they had been “active in cultivating the culture of protecting data privacy within the organization as data privacy is one of the fundamental key principles upheld in the Company’s Code of Business Principles.”30 Unilever further claimed that “all new employees are required to undergo training on handling data privacy as part of their onboarding process.”31 Unilever also declared that they regularly conduct trainings and cascades on how to handle personal data on all its employees and conducted to each function across the Company.32

In Unilever’s Full Breach Report, they also stated that they require all its employees to take mandatory data privacy training annually.33 They also averred that they had “set up Degreed Pathways dedicated to educating its employees on data privacy, such as “Privacy 101 and 102” pathways.”34

Unilever declared that aside from the online and offline trainings, they “regularly remind its employees of the importance and the employees’ role in safeguarding data privacy” by sending e-mail reminders and materials posted on their premises.35 In addition, Unilever also attached in its Full Breach Report an email from its Information Security Incident Response Office that their IT Team has deleted the subject emails from their server.36

Given the foregoing, the implementation of the abovementioned measures demonstrated Unilever’s commitment to protect the rights and mitigated the risks of the incident to its data subjects. However, it is bears stressing that the notification done by Unilever cannot be considered substantial compliance, since NPC Circular 16-03 requires more than just a general statement of the measures plus the email address of its representative, but the PIC must provide for the required information provided under Section 18 of the said Circular. The PIC’s notification must adhere to Section 18 (C) of NPC Circular 16-03 to ensure that the affected data subjects are fully informed them about the incident. This enables the affected data subjects to understand the nature of the incident and take precautionary measures of its personal information.

After extensively evaluating the submissions, the Commission finds that the measures undertaken by Unilever are sufficient to prevent the recurrence of the incident.

WHEREFORE, premises considered, the Commission resolves that the matter of NPC BN 18-023 “In re: Unilever Philippines” is hereby considered CLOSED.

SO ORDERED.

City of Pasay, Philippines. 13 November 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

CPA Data Protection Officer Unilever Philippines

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Compliance of Unilever Philippines dated 26 February 2021. ↩

  2. In re: Unilever Philippines, NPC BN 18-023, Order dated 10 September 2020. ↩

  3. Compliance of Unilever Philippines dated 26 February 2021, at p. 1. ↩

  4. Id. ↩

  5. Full Breach Report of Unilever Philippines dated February 2021. ↩

  6. Compliance of Unilever Philippines dated 26 February 2021, at p. 3. ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. ↩

  10. Compliance of Unilever Philippines dated 26 February 2021, at p. 3. ↩

  11. Id. ↩

  12. Id. ↩

  13. Compliance of Unilever Philippines dated 26 February 2021, See: Annex C. ↩

  14. Compliance of Unilever Philippines dated 26 February 2021, at p. 4. ↩

  15. Compliance of Unilever Philippines dated 26 February 2021, at p. 5. ↩

  16. Id. ↩

  17. Full Breach Report of Unilever Philippines dated 26 February 2021, at p. 2. ↩

  18. Full Breach Report of Unilever Philippines dated 26 February 2021, Annex “C” Sample Notification sent to the affected data subjects. ↩

  19. National Privacy Commission, Personal Data Breach Management, NPC Circular No. 16-03, rule V, § 18 (C). ↩

  20. Full Breach Report of Unilever Philippines dated February 2021, at p. 2. ↩

  21. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, Chapter V, § 20 (a) (2012) (Data Privacy Act of 2012). ↩

  22. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, Chapter V, § 20 (a) (2012) (Data Privacy Act of 2012). ↩

  23. National Privacy Commission, Personal Data Breach Management, NPC Circular 2016-03, rule II, § 4 (B) (15 December 2016) (NPC Circular 16-03). ↩

  24. Full Breach Report of Unilever Philippines dated February 2021, at p. 2, See: Annex “B” Copy of E-mail confirming that the subject email was not successfully delivered to the Yahoo! Email. ↩

  25. Full Breach Report of Unilever Philippines dated 26 February 2021, at p. 2. ↩

  26. Id. ↩

  27. Id. ↩

  28. Full Breach Report of Unilever Philippines dated 26 February 2021, at p. 2. ↩

  29. Id. ↩

  30. Full Breach Report of Unilever Philippines dated 26 February 2021, at p. 3. ↩

  31. Id. ↩

  32. Id. ↩

  33. Full Breach Report of Unilever Philippines dated 26 February 2021, at p. 3, See: Annexes F, G, and H-Series. ↩

  34. Full Breach Report of Unilever Philippines dated 26 February 2021, at p. 3. ↩

  35. Id. ↩

  36. Full Breach Report of Unilever Philippines dated 26 February 2021, See: Annex A ↩

Backlinks

  • No backlinks found