Resolution Text
IN RE: TAGUIG CITY UNIVERSITY
x----------------------------------------------------x
RESOLUTION
NAGA, P.C.;
Before the Commission is the Breach Notification submitted by Taguig City University (TCU) on 23 April 2018 pursuant to NPC Circular 16-03 (Personal Data Breach Management).
Facts
On 23 April 2018, TCU notified the Commission of a data breach and recounted the events that transpired when the hackers defaced its website.1
TCU narrated that on 23 March 2018, it was informed by its alumnus that the TCU website has been defaced.2 As a response, TCU temporarily shut down the website and immediately informed its hired website hosting, Zoom Hosting, regarding the event.3 Zoom Hosting then verified the incident and employed the appropriate measures.4 Thereafter, TCU closely monitored the daily posts of the website and discovered that several websites were already defaced, as well.5
On 01 April 2018, it was found that the Blackhat hacker group named “Pinoy Lulzsec” conducted a concerted attack on several websites of both government and private entities.6 The aim of its attack was to deface, breach, and/or leak data from the websites, and among the entities affected was TCU.7
TCU also found that the login credentials of its Cpanel were changed, and the IP address of its Gmail account was used in the attack.8 It discovered that the hackers used the IP address of its Gmail because the directory of TCU’s Cpanel is in the latter’s Gmail account.9 As their remedial measure, it blocked the IP address using the IP blocker on Cpanel.10
In an Order dated 12 January 2021, the National Privacy Commission (NPC), through its Complaints and Investigation Division (CID), found TCU’s breach notification report insufficient to determine whether the security incident involves a personal data breach.11 Thus, it directed TCU to submit a Post Breach Report detailing the remedial measures taken to notify the affected data subjects, address the incident, and prevent its recurrence.12 However, the Commission did not receive any response or submission of compliance.
On 03 May 2023, the CID issued another Order requiring TCU to submit a Post Breach Report.13 On 30 May 2023, TCU submitted its compliance with the Order.14
In its submission dated 29 May 2023, TCU reported that it “emailed all affected concerns dated May 5, 2018, that the server hosting has been breached by [a] black hat hackers and assured them that they are not responsible for any loss or change of the [data] in the system arising from the [incident].”15
Attached to the report were the body of the e-mail informing the data subjects of the incident, the type of personal information affected, the measures taken to address or prevent its recurrence, and the screenshots of the sent items to prove that it was individually sent to the affected data subjects.16
Once the incident was reported to the web service provider, its website, tcu.edu.ph, was discontinued and shut down.17 In addition, it ended its contract with Zoom.ph.18
For the appropriate security measures implemented to mitigate any negative effect of the incident and prevent its recurrence, TCU restated that it changed its website hosting provider and indicated that it will apply additional security measures on the next website using Laravel security framework.19
Issue
Whether TCU has sufficiently addressed the breach and implemented appropriate measures pursuant to NPC Circular 16-03.
Discussion
The Commission resolves to close the matter. TCU’s submissions show that it properly notified the affected data subjects, sufficiently addressed the breach, and implemented measures to prevent its recurrence.
Rule V, Section 18 (C) and (D) of NPC Circular 16-03 provide:
C. Content of Notification. The notification shall include, but not be limited to:
- nature of the breach;
- personal data possibly involved;
- measures taken to address the breach;
- measures taken to reduce the harm or negative consequences of the breach;
- representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
- any assistance to be provided to the affected data subjects.
Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.
D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach.
x x x
Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.20
Whenever a personal data breach occurs, the personal information controller (PIC) shall identify the data subjects who are affected by the breach and shall notify all of them individually using secure means of communication.21
Here, TCU sufficiently notified the affected data subjects individually through its Notice of Data Breach where it reported the nature of the breach, the personal data possibly involved, and all actions taken to immediately address the incident and prevent the hackers from further defacing its website.22
On this note, the Commission emphasizes the importance of ensuring that affected data subjects receive timely notification:
The purpose of the requirement to notify data subjects of a breach incident is to give them the opportunity to take the necessary precautions or such other measures to protect themselves against possible effects of the breach. Personal information controllers (PICs) are likewise required to establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach. A delay in notification can cause harm to affected data subjects as they cannot protect themselves from the consequences of the breach.23
Moreover, Section 20 (a) of the Data Privacy Act of 2012 (DPA) provides:
Sec. 20. Security of Personal Information.
(a) The personal information controller must implement reasonable and appropriate organizational, physical, and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.24
The Commission finds that TCU undertook reasonable and appropriate measures to protect the personal data of the affected data subjects. Upon knowledge of the incident and to immediately address the breach, TCU acted promptly to prevent the recurrence of the incident when it blocked the IP address using the IP blocker on Cpanel.25 It also changed its password using the password generator of its CPanel twice a day.26 It likewise updated its hosting of the website and temporarily shut down its Cpanel account or its server.27
As to the security measures implemented to mitigate any negative effect of the incident and prevent its recurrence, it ended its contract with its web hosting and applied additional security measures with its new website.28
Additionally, the President of TCU immediately directed the MIS Director to create a committee to plan a program for the University to implement the provisions of the DPA.29 It also conducted a Regional Orientation Workshop on the DPA and its Implementing Rules and Regulations and a Consultation on Draft DPA DepEd Privacy Manual in its effort to comply with the provisions of the DPA.30
Therefore, the implementation of the abovementioned actions after the breach has occurred, as well as the notification made by TCU, were adequate to mitigate the potential harm against the affected data subjects.
In view of the foregoing, the Commission finds that TCU has conducted proper breach management, sufficiently notified the affected data subjects, and implemented reasonable and appropriate measures that not only mitigated the harm that may have been caused by the incident, if any, but also prevented its recurrence.
WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-057 “In re: Taguig City University” is hereby CLOSED.
SO ORDERED.
City of Pasay, Philippines. 17 October 2024.
JOHN HENRY D. NAGA Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
NERISSA N. DE JESUS Deputy Privacy Commissioner
Copy furnished:
FER MIS Director
COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission
Footnotes
-
Breach Notification Report dated 23 April 2018 of Taguig City University at p.1. ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
Breach Notification Report dated 23 April 2018 of Taguig City University at p.1. ↩
-
Final Breach Notification Evaluation Report dated 08 June 2023 of the Complaints and Investigation Division at p.6. ↩
-
Id. ↩
-
Breach Notification Report dated 23 April 2018 of Taguig City University at p.2. ↩
-
Id. ↩
-
Id. ↩
-
Order dated 12 January 2021 of the Complaints and Investigation Division. ↩
-
Id. ↩
-
Order dated 03 May 2023 of the Complaints and Investigation Division. ↩
-
Electronic Mail dated 30 May 2023 from Taguig City University. ↩
-
Post Breach Report dated 29 May 2023 of Taguig City University. ↩
-
Id. ↩
-
Post Breach Report dated 29 May 2023 of Taguig City University. ↩
-
Id. ↩
-
Id. ↩
-
National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18 (15 December 2016) (NPC Circular 16-03). ↩
-
RPR vs. Edukasyon.ph, NPC 19-438, Resolution dated 22 September 2022, at p. 4. ↩
-
Notice of Data Breach dated 05 May 2018 of Taguig City University. ↩
-
In Re BPI Philam Life Assurance Corporation, NPC BN 21-054, Order dated 15 April 2021, at p. 3. ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, Chapter V, § 20 (a) (2012) (Data Privacy Act of 2012). ↩
-
Breach Notification Report dated 23 April 2018 of Taguig City University at p.2. ↩
-
Id. ↩
-
Id. ↩
-
Post Breach Report dated 29 May 2023 of Taguig City University. ↩
-
Id. ↩
-
Id. ↩