NPC Issuance Wiki

NPC BN 18-229: In re: Leapfroggr, Inc.

Issued Resolution

Resolution Text

IN RE: LEAPFROGGR, INC.

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is the Compliance submitted by Leapfroggr, Inc. (Leapfroggr) to the Order of the Commission dated 10 November 2022.

Facts

On 10 November 2022, the Commission issued an Order requiring Leapfroggr “to submit an affidavit, sworn oath or its equivalent showing proof of notification to the two affected data subjects, the contents of the notification, and the corresponding receipt of the notification.”1 The dispositive portion of the Order reads:

WHEREFORE, premises considered, LEAPFROGGR, INC. is hereby ORDERED to SUBMIT proof of notification to the affected data subjects within fifteen (15) days from the receipt of this Order:

SO ORDERED.2

On 21 December 2022, Leapfroggr submitted its compliance with the Order wherein it attached separate affidavits of LYB3 and TMR.4

Issue

Whether Leapfroggr sufficiently complied with Commission’s Order dated 10 November 2022.

Discussion

The Commission finds that Leapfroggr has sufficiently complied with the Order dated 10 November 2022.

As reflected in the submissions made by Leapfroggr, the affidavits of LYB and TMR sufficiently proved that it actually notified the affected data subjects.

Rule V, Section 18 (D) of NPC Circular No. 16-03 (Personal Data Breach Management) provides:

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach[.] x x x Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.5

In the Order dated 10 November 2022, the Commission noted that Leapfroggr’s attachment of screenshots of email notifications to TMR and LYB in its Post-Breach Report dated 03 February 2022 were inadequate to prove that the email was received by TMR.6 Thus, Leapfroggr was ordered to submit an affidavit showing proof of notification to the affected data subjects.7

Accordingly, Leapfroggr submitted its compliance containing two (2) separate affidavits from TMR and LYB stating that they received an email from Leapfroggr dated 29 November 2018 notifying them of a data breach incident.8

This Commission finds that these affidavits submitted by Leapfroggr, containing statements that the email notifications were received by TMR and LYB, are sufficient proof that it has indeed notified the affected data subjects of the incident.

Moreover, the email notifications dated 29 November 2018 provided detailed information relating to the breach.9 Leapfroggr explained that in its usual export process, its “system schedules the export and when it can start automatically converting [sic] patient profiles to Word documents.”10 When the process is done, a zip file protected by a password, is created and a message will be generated which is sent to the “messenger inside the SeriousMD application.”11

Further, Leapfroggr explained that the generated message “should have been an automated message but [it] manually sent the generated message instead.”12

In addition, Leapfroggr stated that in addressing the breach, the erroneous message and the exported file were deleted immediately,13 the export process was changed,14 and the manual sending of files was disabled, changing the process to automated sending.15

The Commission reminds the personal information controllers (PICs) like Leapfroggr, and personal information processors (PIPs) of their obligation under the Data Privacy Act of 2012 (DPA). Under the DPA, notification to the affected data subjects is required especially in breach cases that involves sensitive personal information or other information that may be used to enable identity fraud and are reasonably believed to have been acquired by an unauthorized person, which may likely give rise to a real risk of serious harm to the affected data subjects.16

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-229 “In re: Leapfroggr, Inc.” is hereby considered CLOSED.

SO ORDERED.

City of Pasay, Philippines. 19 January 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

SS Data Protection Officer

BDC Head of the Organization

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. In re: Leapfroggr, Inc., NPC BN 18-229, Order dated 10 November 2022, at p. 4 ↩

  2. Id. ↩

  3. Affidavit dated 21 December 2022 of LYB. ↩

  4. Affidavit dated 21 December 2022 of TMR. ↩

  5. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18(D) (15 December 2016) (NPC Circular 16-03). ↩

  6. In re: Leapfroggr, Inc., NPC BN 18-229, Order dated 10 November 2022, at p. 3 ↩

  7. Id., at p. 4 ↩

  8. Affidavits dated 21 December 2022 of LYB and TMR. ↩

  9. Id. ↩

  10. Id. ↩

  11. Id. ↩

  12. Affidavits dated 21 December 2022 of LYB and TMR. ↩

  13. Id. ↩

  14. Id. ↩

  15. Id. ↩

  16. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter V, § 20 (f) (2012). ↩

Backlinks

  • No backlinks found