Resolution Text
IN RE: ELS LANGUAGE SERVICES, INC.
x----------------------------------------------------x
NAGA, P.C.;
Before the Commission is the Compliance submitted by ELS Language Services, Inc. (ELS) dated 28 October 2020 in accordance with the Order dated 13 October 2020.
Facts
ELS is a company organized and existing in the United States of America which provides English language training and instructions.1 On 04 October 2018, it appointed ACCRALAW and/or any of its lawyers as its Attorney-In-Fact, through a Special Power of Attorney executed by PHW, its Vice President, General Counsel, and Secretary.2
On 11 October 2018, ELS, through ACCRALAW, notified the Commission that a possible security incident involving one (1) of its customers in the Philippines had occurred, attaching therein a letter dated 04 October 2018, detailing said incident.3
In its letter, ELS narrated that it learned from the Federal Bureau of Investigation (FBI) that a former employee of ELS Santa Monica, in California, United States, has been arrested and charged in connection with a conspiracy to launder funds derived from Business Email Compromise fraud schemes.4
ELS alleged that the incident probably occurred between April 2017 and 22 August 2018, the period during which the former employee was working for it and was responsible for processing credit card information.5 Nonetheless, the latest information ELS received from the FBI revealed that no information from any Philippine resident was affected or involved in the incident.6
However, during the period in question, ELS processed credit card payments made by approximately three thousand five hundred (3,500) customers that involve student records, including: customer’s first and last name, passport number, photograph, email address, mailing address, billing address, and credit or debit card information as well as its security code.7
According to ELS, it is cooperating with the FBI and other law enforcement agencies while also conducting its own investigation “to identify the customers and personal data categories affected by the incident and to determine how it might improve their practices to prevent similar instances in the future.”8
Thus, on 10 September 2018, ELS was able to notify the potentially affected data subjects through mail.9 ELS recommended therein that they contact their bank or credit card provider promptly to dispute charges they feel may have been unauthorized, inform them of an FBI investigation of criminal activity, and request immediate re-issuance of their credit card.10
In addition, ELS informed them that it is prepared to offer twelve (12) months of free credit monitoring and fraud detection to potentially affected customers who suspect fraudulent activity on their credit card or bank account.11
On 13 October 2020, the Commission, through its Complaints and Investigation Division, ordered ELS to submit a Full Breach Report, describing the nature of the breach, personal data possibly affected, and measures taken to address the breach.12
On 28 October 2020, ELS submitted its Personal Data Breach Report in compliance with the abovementioned Order, reiterating its previous submissions and expounding on the measures it took to address the breach, namely:
a. ELS implemented a number of measures in response to the breach to secure credit card information across its enterprise, including in store audits, purging of all credit card data and re-examination of all background check procedures;
b. Law enforcement was notified and the U.S. Attorney’s office was involved in the prosecution of the individual responsible for the theft;
c. Affected individuals were offered 12 months of free credit monitoring and provided detailed instruction on how to monitor credit reporting and how to report criminal activity to law enforcement.
d. Affected individuals were notified by mail on September 10, 2018;
e. As a result of this incident credit card processing has been outsourced to eliminate the risk of physical/electronic access. Additionally, access to sensitive student information is based upon least-privilege and need-to-know. ELS continues to monitor need to for additional control measures as necessary.13
Issue
Whether ELS has sufficiently complied with the Commission’s Order dated 13 October 2020.
Discussion
The Commission finds that ELS has sufficiently complied with the Order dated 13 October 2020. As such, the Commission resolves to terminate the investigation and consider the matter closed.
Section 18 (D), NPC Circular 16-03 provides how notification shall be made, to wit:
Section 18. Notification of Data Subjects.
D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.14
Whenever a personal data breach occurs, the personal information controller (PIC), shall identify the data subjects who are affected by the breach and shall notify all of them individually using secure means of communication.15
In this case, despite the FBI’s finding that no resident of the Philippines was on the list of individuals whose credit card information was compromised, ELS still notified the potentially affected customers through mail on 10 September 2018 as a precautionary measure because at the time of the incident, ELS processed credit card payments made by approximately three thousand five hundred (3,500) customers.16
On this note, the Commission emphasizes the importance of ensuring that affected data subjects receive timely notification, viz:
The purpose of the requirement to notify data subjects of a breach incident is to give them the opportunity to take the necessary precautions or such other measures to protect themselves against possible effects of the breach. Personal information controllers (PICs) are likewise required to establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach. A delay in notification can cause harm to affected data subjects as they cannot protect themselves from the consequences of the breach.17
Moreover, to further comply with the Commission’s Order dated 13 October 2020, ELS undertook the following measures to protect the personal information of its potentially affected data subjects, to wit:
- It audited its stores, purged credit card data and re-examined its background check procedures;
- It notified the law enforcement and the US Attorney’s Office was involved in the prosecution of the individual responsible for the theft;
- Affected individuals were offered 12 months of free credit monitoring and provided instruction on how to monitor credit reporting and how to report criminal activity to law enforcement;
- Affected individuals were notified by mail on September 10, 2018;
- Credit card processing was outsourced to eliminate the risk of physical/electronic access;
- It also cooperated with the FBI and other law enforcement agencies in the investigation and conducted its own investigation to identify individuals affected by the incident and to determine how it can improve its operation to prevent similar recurrence;
- Notified this Commission;
- Designation of a Data Protection Officer (DPO), RT.18
In this regard, Section 20 (a) of the Data Privacy Act of 2012 provides:
Sec. 20. Security of Personal Information.
(a) The personal information controller must implement reasonable and appropriate organizational, physical, and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.19
Furthermore, as also emphasized in Section 4 (B) of NPC Circular 16-03:
SECTION 4. Security Incident Management Policy.
A personal information controller or personal information processor shall implement policies and procedures for the purpose of managing security incidents, including personal data breach. These policies and procedures must ensure:
B. Implementation of organizational, physical and technical security measures and personal data privacy policies intended to prevent or minimize the occurrence of a personal data breach and assure the timely discovery of a security incident.20
The implementation of the abovementioned measures after the security incident had occurred, as well as the notification made by ELS on its own initiative, demonstrated its diligence and commitment to protect the rights of its data subjects and abide by the DPA and its existing rules and regulations.
These are reasonable and appropriate remediation measures to address and correct the incident which can otherwise lead to issues arising from the use of personal data by any person not authorized to access it.
Hence, ELS was able to mitigate the risks caused by the incident through its existing security measures and the notification it sent to the potentially affected data subjects.
In view of the foregoing, the Commission holds that ELS Language Services Inc. had sufficiently notified the potentially affected data subjects and it has implemented reasonable and appropriate security measures to prevent a recurrence of the incident.
WHEREFORE, premises considered, the Commission resolves that the matter of NPC BN 18-194 “In re ELS Language Services, Inc.” is hereby CLOSED.
SO ORDERED.
City of Pasay, Philippines.
17 August 2023.
JOHN HENRY D. NAGA Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
NERISSA N. DE JESUS Deputy Privacy Commissioner
Copy furnished:
RT Chief Operating Officer & Data Protection Officer
JMG MML Attorney-In-Fact for ELS Language Services, Inc.
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
Electronic Mail dated 11 October 2018 from ELS Language Services, Inc. ↩
-
Special Power of Attorney, Attachment to Electronic Mail dated 11 October 2018 from ELS Language Services, Inc. ↩
-
Electronic Mail dated 11 October 2018 from ELS Language Services Inc. ↩
-
ELS Letter to NPC, Attachment to Electronic Mail dated 11 October 2018 from ELS Language Services, Inc. ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
ELS Letter to NPC, Attachment to Electronic Mail dated 11 October 2018 from ELS Language Services, Inc. ↩
-
Personal Data Breach Report of ELS Language Services, Inc., dated 28 October 2020. ↩
-
ELS Letter to NPC, Attachment to Electronic Mail dated 11 October 2018 from ELS Language Services, Inc. ↩
-
Id. ↩
-
In re: ELS Language Services, Inc., NPC BN 18-194, Order to Submit Full Breach Report, 13 October 2020. ↩
-
Personal Data Breach Report of ELS Language Services, Inc., dated 28 October 2020. ↩
-
National Privacy Commission, Personal Data Breach Management, NPC Circular 2016-03, rule V, § 18 (D) (15 December 2016) (NPC Circular 16-03). ↩
-
RPR vs. Edukasyon.ph, NPC 19-438, Resolution dated 22 September 2022, at p. 4. ↩
-
ELS Letter to NPC, Attachment to Electronic Mail dated 11 October 2018 from ELS Language Services, Inc. ↩
-
In Re BPI Philam Life Assurance Corporation, NPC BN 21-054, Order dated 15 April 2021, at p. 3. ↩
-
Final Breach Notification Evaluation Report, 12 December 2022, at 6, in In Re ELS Language Services, Inc., NPC BN 18-194 (NPC 2018). ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Chapter V, § 20 (a) (2012) (Data Privacy Act of 2012). ↩
-
NPC Circular 16-03, rule II, § 4 (B). ↩