NPC Issuance Wiki

NPC BN 20-170: In Re: TravelPeople, Ltd., Inc.

Issued Resolution

Resolution Text

IN RE: TRAVELPEOPLE, LTD., INC.

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission are TravelPeople, Ltd., Inc. (TravelPeople) Compliance and Motion for Partial Reconsideration dated 11 February 20211 to the Resolution issued by the Commission dated 21 September 2020.2

Facts

On 21 September 2020, the Commission issued a Resolution with the following dispositive portion:

WHEREFORE, premises considered, the request for Postponement of Notification to Data Subjects filed by TravelPeople, Ltd., is hereby DENIED. TravelPeople, Ltd., is ORDERED to comply with the following within fifteen (15) days from receipt of this Resolution:

  1. SUBMIT full breach report with the complete information required under NPC Circular 16-03 which includes among others, the nature of personal data involved and a determination of the affected data subjects; and

  2. NOTIFY the affected data subjects of the breach incident in accordance with the provisions of NPC Circular 16-03 and to SUBMIT proof of compliance thereto.

SO ORDERED.3

On 11 February 2021, TravelPeople submitted its Compliance and Motion for Partial Reconsideration dated 11 February 2021 in compliance with the Resolution dated 21 September 2020.4

In its Compliance, TravelPeople stated that the booking records of approximately one hundred thousand (100,000) or more individuals were temporarily inaccessible.5 TravelPeople had to resort to manual inputting of details and requests for payment for its suppliers as a consequence of the incident.6 The data involved in the incident as reported by TravelPeople includes the following:

  • First and last names of clients (no middle names).
  • Booking details, i.e., ticket numbers, destinations, flight schedules, and the like.
  • Email addresses (not applicable to all data subjects).
  • Telephone numbers (not applicable to all data subjects).7

As to the measures taken to address the breach, TravelPeople stated that it took the following actions:

  • All servers were shut down to contain the virus and to allow IT to conduct a check on each server.
  • An incident advisory was sent to all users and to management on August 26, 2020. All units were advised to apply their Business Continuity Plans and workarounds while the servers/systems were down.
  • Security patches for the ransomware were applied to non-affected servers.
  • Cybersecurity experts from the ePLDT Cyber Security were engaged to assist in the containment, clean-up, and possible decryption of affected files. The experts also conducted a forensic investigation to determine the methodology and behavior of the ransomware virus that infected the server.
  • All the affected data was restored from backups by September 8, 2020.
  • To prevent recurrence of the incident, [it] engaged experts to conduct a vulnerability assessment and penetration test on all systems in order to identify our risks of further exposure to cyberattacks and other security incidents and determine possible measures to mitigate or avoid them. [It] also plan[s] to deploy advanced endpoint detection and response tools to all workstations and servers in the first quarter of 2021.8

Additionally, TravelPeople stated that when it submitted its initial report, it requested a postponement of data subject notification since it initially believed that there was no personal data acquired or accessed by unauthorized persons.9

Further, TravelPeople stated that as a result of its investigation, it was determined that there is “no sensitive personal information or other information that may be used to enable identity fraud was affected by the virus”.10 TravelPeople also averred that there was no unauthorized acquisition of data and no data subjects were harmed due to the incident.11 Thus, TravelPeople manifested that there is no need for data subject notification regarding the temporary availability breach as reported.12

TravelPeople claimed that it would be impossible to notify all the data subjects directly since it does not collect and record postal addresses.13 Additionally, most of its clients do not provide personal phone numbers, email addresses, and those of the passengers when transacting with TravelPeople.14

In its request for reconsideration of the directive of the Commission to notify the affected data subjects, TravelPeople asserted that upon its forensic investigation, it found that “there were no malicious executable files dropped on the victim machine” and “there were no outbound connections to any known malicious hosts that were seen in the packet capture as signs of command and control of the miscreant”.15 Thus, it concluded that the incident did not provide access or disclosure of data to unauthorized persons and would not give rise to a real risk of serious harm to the affected data subjects.16

Furthermore, TravelPeople reiterated that it is impossible to conduct data subject notification since it does not collect and record postal addresses, and most of its clients do not provide their personal email addresses or phone numbers with TravelPeople when transacting.17

In addition, TravelServices claimed that none of the personal data involved as reported in the full breach report are considered sensitive personal information.18 There is also no reason to believe that the data involved were acquired by an unauthorized person and that no data subjects were harmed as a consequence of the ransomware attack.19

Thus, to support its claim that data subject notification is not mandatory, it cited that the three (3) requisites for the mandatory notification requirement under Section 11 of NPC Circular No. 16-03 are not present in this case.20

Issue

Whether the Commission shall grant the Motion for Partial Reconsideration filed by TravelPeople dated 11 February 2021.

Discussion

The Commission notes the Compliance of TravelPeople dated 09 February 2021. Further, the Commission denies the Motion for Partial Reconsideration filed by TravelPeople.

The case falls under mandatory data subject notification, as provided by the provisions of NPC Circular No. 16-03.

Rule V, Section 11 of NPC Circular No. 16-03 provides:

Sec. 11. When notification is required.

Notification shall be required upon knowledge of or when there is reasonable belief by the personal information controller or personal information processor that a personal data breach requiring notification has occurred, under the following conditions:

A. The personal data involves sensitive personal information or any other information that may be used to enable identity fraud. For this purpose, “other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.

B. There is reason to believe that the information may have been acquired by an unauthorized person; and

C. The personal information controller or the Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.21 (Emphasis supplied)

It must be noted that the personal data involved in this case includes:

  • First and last names of clients (no middle names).
  • Booking details, i.e., ticket numbers, destinations, flight schedules, and the like.
  • Email addresses (not applicable to all data subjects).
  • Telephone numbers (not applicable to all data subjects).22

Further, NPC Circular No. 16-03 Section 11 provides that other information is not limited to the categories listed therein but applies also to any information that, under the circumstances, would and can be used to enable identity fraud.

In this case, the above-mentioned data when taken together, are considered other information that may be used to enable identity fraud.23 Considering that these pieces of information when combined with other information, “would directly and certainly identify an individual” are considered as other information under the circumstances that may result to enable identity fraud.24

In this case, the names and email addresses of the affected data subjects can be used to commit identity theft or any other phishing activities. Here, the Commission emphasizes that the risk of this information at the use and disposal of an unauthorized person is beyond the control of TravelPeople. The names and email addresses may be used to carry out other motives to obtain more information about the affected data subjects due to the unauthorized acquisition of this information.

As to the second requisite, the third-party forensic investigation engaged by TravelPeople stated that “there was no malicious executable files dropped on the victim machine” and “there were no outbound connections to any known malicious hosts that were seen in the packet capture as signs of command and control of the miscreant.”25 In line with this, TravelPeople stated that “the information could not have been acquired by an unauthorized person as a consequence of the ransomware”.26 The third-party forensic investigation also claimed that there is no data exfiltration as a result of the ransomware attack. However, it must be noted there is nothing on the submission to substantiate its claim that, indeed no data exfiltration was done. Thus, the investigation of the third-party forensic investigation is a mere allegation without any proof to support its claim.

Moreover, as previously held by the Commission in its Resolution dated 21 September 2020:

It should be noted that a loss of control over personal data held in custody should be enough for a personal information controller to have “reason to believe that the information may have been acquired by an unauthorized person.” An indication of exfiltration of data is not a requirement in Section 11(b). Absolute certainty of acquisition by an unauthorized person is not required by either the Circular or the Data Privacy Act (DPA), considering that the condition only provides for a determination based on the existing circumstances that can give a “reason to believe.”27

In this case, TravelPeople has lost control over the information of its clients. It must be noted that TravelPeople admitted that “booking records of approximately [one hundred thousand] 100,000 or more individuals became temporarily inaccessible” as a result of the ransomware attack in its system.28 Hence, it can be inferred that there is a loss of control over personal data when TravelPeople has lost access to its system.

Moreover, in a previous Resolution issued by the Commission, it held that:

Ransomware is defined as “a type of malicious software that infects a computer and restricts users’ access to it until a ransom is paid to unlock it… Typically, these alerts state that the user’s systems have been locked or that the user’s files have been encrypted. Users are told that unless a ransom is paid, access will not be restored.” While ransomwares primarily cause availability breaches, it is different from other availability breaches because a malefactor intentionally causes them. This is unlike other types of availability breaches that are caused by accidents or system glitches. In these cases, the total exercise of control over the data is removed from the personal information controller and is taken by the malefactor. Without this control, the personal information controller will be unable to exercise it obligations in processing the personal data according to the provisions of the DPA. Recent ransomware attacks have also shown a capability to release the encrypted data over the internet upon non-payment of the ransom, potentially leading to a confidentiality breach contemplated in Section 11(2). For the protection of the data subjects, such incidents must be notified both to the Commission and the affected data subjects.29

Thus, the second requisite is present in this case considering that due to the ransomware attack, the loss of control over the information of the data subjects would be a reason to believe that the information may have been acquired by an unauthorized person.

Finally, TravelPeople claimed that no harm was inflicted on the data subjects as a consequence of the incident. However, it must be noted that mere temporary inconvenience to TravelPeople’s staff in manually inputting the booking records of approximately one hundred thousand (100,000) or more individuals is not the “harm” contemplated under Section 11(c) of NPC Circular 16-03. The serious harm contemplated under Section 11 of the NPC Circular No. 16-03 means negative consequences it may pose to the affected data subjects such as identity fraud or theft that may result from the ransomware attack.30

As to the third requisite, given that the incident involves information that, under the circumstances, may be used to enable identity fraud, and that such information may have been acquired by an unauthorized person wherein PIC has lost its control over the information, as discussed above, there is reason for the Commission to believe that the unauthorized acquisition may give rise to real risk of serious harm to the affected data subjects. Hence, the third requisite is present.

In view thereof, considering that all the requisites for mandatory breach notification are present in this case, the Commission deems it proper to direct TravelPeople to notify the affected data subjects.

WHEREFORE, premises considered, this Commission resolves to:

  1. DENY the Motion for Partial Reconsideration dated 11 February 2021 filed by TravelPeople, Ltd., Inc.;

  2. DIRECT TravelPeople, Ltd., Inc. to NOTIFY the affected data subjects and SUBMIT proof of notification directly to the Compliance and Monitoring Division (CMD) within fifteen (15) days from receipt of this Resolution;

  3. DIRECT CMD to issue the appropriate orders necessary to evaluate and monitor the completeness of TravelPeople Ltd., Inc. Compliance, and assess its breach management pursuant to NPC Circular 16-03 (Personal Data Breach Management).

SO ORDERED.

City of Pasay, Philippines. 13 November 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

MJC Data Protection Officer

TRAVELPEOPLE LTD., INC.

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Compliance and Motion for Partial Reconsideration dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  2. In Re: TravelPeople, Ltd., Inc. NPC BN 20-170, Resolution dated 21 September 2020. ↩

  3. In Re: TravelPeople, Ltd., Inc. NPC BN 20-170, Resolution dated 21 September 2020. ↩

  4. Compliance and Motion for Partial Reconsideration dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  5. Compliance and Motion for Partial Reconsideration dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  6. Compliance and Motion for Partial Reconsideration dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  7. Full breach report dated 09 February 2021 of TravelServices, Ltd., Inc., at p. 2. ↩

  8. Full breach report dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  9. Full breach report dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  10. Full breach report dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  11. Full breach report dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  12. Full breach report dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  13. Full breach report dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  14. Full breach report dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  15. Compliance and Motion for Partial Reconsideration dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  16. Compliance and Motion for Partial Reconsideration dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  17. Compliance and Motion for Partial Reconsideration dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  18. Compliance and Motion for Partial Reconsideration dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  19. Compliance and Motion for Partial Reconsideration dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  20. Compliance and Motion for Partial Reconsideration dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  21. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 11 (15 December 2016) (NPC Circular 16-03). ↩

  22. Full breach report dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  23. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, chapter I, § 3(g) (2012). ↩

  24. NPC BN 18-010 (unreported), Order dated 11 May 2023, at pp. 3-4. ↩

  25. Compliance and Motion for Partial Reconsideration dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  26. Compliance and Motion for Partial Reconsideration dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  27. In Re: TravelPeople, Ltd., Inc. NPC BN 20-170, Resolution dated 21 September 2020. ↩

  28. Full breach report dated 11 February 2021 of TravelPeople, Ltd., Inc. ↩

  29. In re: Batangas Bay Carriers, Inc. NPC BN 20-157, Resolution dated 21 September 2020. ↩

  30. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 11 (15 December 2016) (NPC Circular 16-03). ↩

Backlinks

  • No backlinks found