NPC Issuance Wiki

NPC BN 18-140: In re: Datascope Communications (Philippines), Inc.

Issued Resolution

Resolution Text

IN RE: DATASCOPE COMMUNICATIONS (PHILIPPINES), INC.

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is the compliance of Datascope Communications (Philippines), Inc. (Datascope) with the Orders of the National Privacy Commission (NPC) through its Complaints and Investigation Division (CID) dated 19 October 2020 and 14 June 2021.

Facts

On 31 July 2018, Datascope submitted to the Commission its initial breach report relating to a data breach that occurred on 05 February 2018.1 In its initial report, Datascope narrated that as part of its Business Continuity Management, it conducts a backup of its personnel employment records.2 Datascope explained that as part of its procedure:

The personnel employment records are being scanned and saved in the external [hard drive] HDD and on a monthly basis[,] the HDD is being swapped and transferred to the other facility.3

In stating what occurred prior to the occurrence of the incident, Datascope narrated:

On November 28, 2017, the HR Analyst, CC who is in-charge in the scanning of personnel employment records, transferred from TARA facility to MMP Facility. She brought the external HDD from TARA Facility to MMP Facility to continue her task of scanning, but according to her she forgot to secure an approved gate pass during the transfer. CC was then able to use the external HDD in MMP Facility.

During the monthly swapping of external HDD for the month of December in MMP Facility (the monthly swapping is usually being done at the end of the month), the SND Staff, MJ approached CC on December 29, 2017 to collect the said external HDD from her, however CC was not able to provide the external HDD because she assumed that the disk might be in the other facility. CC, together with other HR staff started searching of the missing hard drive for the 2 facilities but was not able to find it.4

Upon investigation conducted by Datascope, it was revealed that:

  1. When CC transferred to MMP Facility on November 28, 2017, she brought the [HDD] from TARA Facility to MMP Facility. She forgot to secure an approved gate pass, thus there is no proof that the [HDD] was transferred.

  2. Upon checking her workstation in MMP Facility, it was confirmed that the [HDD] was used with last transaction dated November 28, 2017.

  3. CC forgot to safe keep the [HDD] before she went on leave from December 23-27, 2017.

  4. Upon her return to work on December 29, 2017, MJ started looking for the HDD, but CC requested for more time to look for the HDD.

  5. On January 5, 2018, she was approached again by MJ but CC cannot provide the HDD.

  6. On the next swapping of hard disk for the month of January (end of January), CC still was not able to provide the hard disk thus the missing hard drive was reported to the incident Response Team Coordinator on February 5, 2018.

  7. The result of the investigation cannot establish whether the external HDD was misplaced or intentionally taken.5

Datascope also stated that in estimation, there were three hundred sixty-six (366) active employees and two hundred thirty-seven (237) resigned employees whose data contained in their 201 files were compromised by the incident.6 Moreover, Datascope reported that the data in the 2015 BIR Form 2316 of four hundred thirty-eight (438) active employees and eighty (80) resigned employees were also affected.7

Moreover, the initial report of Datascope enumerated the personal data contained in the missing external HDD were: (1) full name; (2) date of birth; (3) address; (4) contact information; (5) SSS number; (6) tax identification number; (7) BIR Form 2316; (8) Philhealth number; (9) PAG-Ibig number; (10) education/transcripts/diplomas; (11) performance assessments; (12) disciplinary actions; (13) work history; (14) post-employment information; (15) hiring requirements; and (16) annual medical records, among others.8

The initial report of Datascope also identified the vulnerabilities that allowed the breach: (1) non-encryption of HDD; (2) HRD staff room is accessible by other staff; and (3) No CCTV inside the HRD staff room.9

In view of the foregoing, Datascope stated that the personal data breach can result into identity theft of personal data which can be used for blackmailing or extortion, and coercion, as well as access to personal data which can result to “reputation or financial damage or could be sold to telemarketers.”10

Thus, Datascope described the safeguards in place to avoid the recurrence of the same incident, which include the: (1) use of gate pass when transferring removable media; (2) use of company vehicle when transferring removable media; (3) HRD staff room is locked when unattended; (4) there is a dedicated workstation where external HDD should be used; (5) workstation is password protected.11

Lastly, Datascope reported on the details of the remedial measures it undertook to address the breach:

a) Description of the measures taken or proposed to be taken to address the breach

  1. We conducted thorough searching of the missing hard drive.
  2. We conducted administrative hearing.
  3. Enforcement of disciplinary action to the concerned HR staff.
  4. We conducted a meeting with HRD staff on the importance and confidentiality of the data that HRD handled.
  5. We temporarily suspend the scanning of employees’ records.

b) Actions being taken to secure or recover the personal data that were compromised

Since the missing HDD was a backup copy thus we perceived that there is no [loss] of data. We still hold a copy of the personnel employment records both in soft and hard copies in our HR storage room however the lost hard drive poses a potential exposure and may compromise employees’ personal information.

Further when the incident was discovered it underwent incident management process as follows:

  1. The Incident Response Team conducted an investigation.

  2. As part of the investigation and mitigation process, the Accounting Department was tasked to conduct a physical audit of all external HDD issued to HR Department.

  3. A Corrective Action Report was issued to the HR Head. The HR Head was required to provide root cause analysis of the incident and corrective action plan in a given period.

  4. All the HRD personnel including the utility clerks and company driver were asked to submit their answer on the below questions in a written form during the same period:

    a) What are their knowledge with regards to keeping HRD files secured b) What are their awareness with HRD files c) What are their practices in keeping HRD rooms secured

c) Actions performed or proposed to mitigate possible harm or negative consequences and limit the damage or distress to those affected by the incident

As of today, there is no indication that the data were compromised, because there are no complaints or claims against the company pertaining to personnel employment records.

d) Action being taken to inform the data subjects affected by the incident or reasons for any delay in the notification

We plan to inform the data subjects by August 3, 2018 upon completion of the Mandatory Personal Data Breach Notification to Data Subjects.

e) Measures being taken to prevent a recurrence of the incident

  1. We formulated written guidelines in the proper scanning and back up of HR files to include that external hard disk containing sensitive information shall be attached solely to the workstation located inside the HR inner room where the HR Head is located.

  2. We defined the access and restrictions of the HR staff with regards to their access to confidential information of personnel employment records.

  3. We implemented a monthly monitoring and inspection of external HDD.

  4. We installed a CCTV camera inside the HRD room due to the incident.

  5. We will implement encryption for the external HDD with confidential files.

  6. We will create a procedure for pick up and transfer of hard drives aside from the logs. (Specifically include in the procedure that refusal of pickup of HDD is not allowed).

  7. We will allocate a dedicated server for HRD back up files to be stored inside the Data Center.12

On 19 October 2020, the NPC through its CID issued an Order requiring Datascope to submit a Full Report “expounding the details of the incident with emphasis supplied on the lacking information from the initial notification report” within fifteen (15) days from the receipt of such Order.13

On 03 November 2020, Datascope submitted its compliance with the abovementioned Order dated 19 October 2020.14 In the said compliance, Datascope specifically stated that the total number of affected data subjects is six hundred fifty-one (651) broken down into: (1) three hundred eighty-four (384) active employees; (2) two hundred sixty (260) resigned employees; (3) seven (7) employees on leave.15 According to Datascope, the inconsistency in the number of affected data subjects from its Initial Report was due to the fact that “data subjects that were listed under ‘201 files’ were also listed under the ‘2015 BIR Form 2316[.]‘”16 Aside from specifically identifying the number of data subjects, Datascope reiterated the details contained in its initial report attaching therewith the following:

  1. Collection and Swapping Procedure of External HDD;
  2. Personal Information Protection Guidelines;
  3. Guidelines in the Scanning of 201 Files and Procedure in the Proper Safekeeping of External HDD;
  4. Organizational Records Protection Procedures;
  5. Incident Report Form from the Incident Response Team;
  6. Gate Pass Procedure and Guidelines;
  7. Removable Media Guidelines;
  8. Media Transport Procedure;
  9. Physical Security Perimeter Guidelines;
  10. Clear Desk-Clear Screen and Unattended User Equipment Policy;
  11. Root Cause Analysis of the investigation conducted;
  12. Corrective Action Report from the HR Department;
  13. Report on the thorough searching of missing HDD;
  14. Interview/written statements of HR Department Staff;
  15. Internal Memorandum containing the Mandatory Personal Data Breach Notification to Data Subjects;
  16. Proof of awareness training and orientation conducted;
  17. Documented Information Control Guidelines and Procedures;
  18. Manual on the List of Access Rights;
  19. Monitoring Log of External HDD;
  20. Proof of installed CCTVs in the HR Department; and,
  21. Proof of encryption of payroll HDD.17

Subsequently, CID issued an Order dated 14 June 2021 requiring Datascope to submit the following:

  1. [T]he Audit Report containing the result of the physical audit of all external HDDs conducted by the Accounting Department; and

  2. [T]he result of the Privacy Impact Assessment (PIA) on the identification of privacy risks and adaption of the appropriate security measures to protect personal data against natural and human dangers with guidelines provided under NPC Advisory No. 2017-03 particularly on the process of scanning of employment record and transfer thereof of HDDs, and the handling, transport and storage of such HDDs containing backup copy of personal data.18

Accordingly on 19 May 2022, Datascope submitted to the Commission’s CID the above-requested documents.19

Issue

Whether Datascope has sufficiently complied with the Orders dated 19 October 2020 and 14 June 2021.

Discussion

In the Order of the CID dated 19 October 2020, Datascope was required to submit a Full Report “expounding the details of the incident” and “attaching the specified documents” to be used in the investigation of the breach incident.20

On the other hand, another Order dated 14 June 2021 was issued by the CID requiring Datascope to submit the following documents: (1) Audit Report containing the result of the physical audit of all external HDDs; and (2) Result of the Privacy Impact Assessment (PIA) which Datascope has conducted.21

The Commission finds Datascope’s submissions to be sufficiently compliant with the abovementioned Orders.

I. Datascope sufficiently provided the details in its Full Report pursuant to NPC Circular 16-03

On 19 October 2020, Datascope was required by CID to submit a Full Report “expounding the details of the incident” and “attaching the specified documents” to be used in the investigation of the breach incident, pursuant to Section 17(D) of NPC Circular 16-03 (Personal Data Breach Management).22 Likewise, an Order dated 14 June 2021 was issued by the CID requiring Datascope to submit an Audit Report containing the result of the physical audit of all external HDDs.23

In order to promote cooperation with the personal information controller (PIC) regarding investigations on matters relating to personal data breach, Rule V, Section 17(D) of NPC Circular 16-03 requires such PIC to notify the Commission of the incident which shall contain the following details:

D. Content of Notification. The notification shall include, but not be limited to:

  1. Nature of the Breach a. description of how the breach occurred and the vulnerability of the data processing system that allowed the breach; b. a chronology of the events leading up to the loss of control over the personal data; c. approximate number of data subjects or records involved; d. description or nature of the personal data breach; e. description of the likely consequences of the personal data breach; and f. name and contact details of the data protection officer or any other accountable persons.

  2. Personal Data Possibly Involved a. description of sensitive personal information involved; and b. description of other information involved that may be used to enable identity fraud.

  3. Measures Taken to Address the Breach a. description of the measures taken or proposed to be taken to address the breach; b. actions being taken to secure or recover the personal data that were compromised; c. actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident; d. action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification; e. the measures being taken to prevent a recurrence of the incident.

The Commission reserves the right to require additional information, if necessary.24

To comply with the Order to submit its Full Report, Datascope forwarded to the Commission its compliance providing the required information.25 Datascope reiterated the details provided in its initial report, attaching therein a “flowchart for the collection and swapping procedure of external HDD” as well as its “restoration procedure.”26

In the Collection and Swapping Procedure of External HDD, according to Datascope, the System Administrator will send to the authorized personnel an email notification for the collection of external HDDs.27 Thereafter, upon checking the completeness of the external HDDs to be picked-up, the external HDD’s envelope shall be sealed in front of the owner and the owner to “put his/her signature on the envelope” and thereafter sign the same in a logbook.28 As part of its procedure, Datascope also stated that if there are unavoidable circumstances during the collection and swapping of external HDDs, the owner shall write such reason in the logbook.29 Also, the external HDDs shall be transported to MMP and TARA Facility and vice versa every end of the month for offsite back-up and safekeeping.30 The procedure also includes the preparation and accomplishment of a gate pass before transferring the HDDs to other facility.31 Lastly, once the external HDD becomes full, the deletion or reformatting of the files shall be with the approval of the owner.32

As to the Restoration Procedure, notification regarding data loss must be made within one (1) business day, providing thereof the file names and the description of the files.33 The procedure likewise provided that the restoration’s response time will be variable, but “users should anticipate approximately six (6) business hours to restore data.”34 Once data restoration was done, the integrity of the data must be verified.35

As to the safeguards it took to mitigate the impact of the data breach, Datascope submitted the following documents: (1) Personal Information Protection Guidelines;36 (2) Guideline in the scanning of 201 files and procedure in the proper safekeeping of external HDD;37 and (3) Organizational records protection procedures.38

In its Personal Information Protection Guidelines, Datascope stated that the 201 files of its employees “are disposed after 4 years of separation” from the company.39 The document also provided that the Human Resources (HR) Head acts as the data protection officer (DPO) of the company who shall:

[O]versee the compliance of the organization with the [Data Privacy Act of 2012] DPA, its Implementing Rules and Regulations IRR, and other related policies, including the conduct of [PIA], implementation of security measures, security incident and data breach protocol, and the inquiry and complaints procedure.40

Moreover, the Personal Information Protection Guidelines provided for the precautionary measures in protecting its clients’ or customers’ personal data such as:

  1. All the employees undergo the ISMS policy orientation including the new hires.
  2. Employees sign the Undertaking of Confidentiality (non-disclosure agreement).
  3. Employees sign the Job Description stating their responsibility to ensure compliance to the ISMS.41

Lastly, the following personnel are authorized to process the statutory and government benefits:

  1. HR Specialist- for Production employees (Data Entry and Search).
  2. Senior Accountant- for staff employees.
  3. Accounting Head- for department heads.42

The procedure for processing of the abovementioned benefits shall be as follows:

  1. Payment for SSS and Pag-IBIG are transmitted by the Accounting Head thru online facility. Payment for PhilHealth is done manually thru bank.
  2. Submission of reports are done by the messenger. The messenger signed Undertaking of Confidentiality.
  3. The loan application, registration and update are submitted by the employees to HR Staff. There documents are recorded in the incoming documents log.
  4. HR staff ensure utmost protection of received documents until it is submitted to the government agencies.43

As regards the Guidelines in the Scanning of 201 Files and Procedure in the Proper Safekeeping of External HDD, Datascope stated that “only the allocated PC” located inside the HR Head’s room, shall be used when scanning the 201 files.44 In the same document, Datascope shall undertake the following security measures for the safekeeping of external HDD:

  1. The external HDD should be labeled for proper identification.
  2. The external HDD shall be attached only to the allocated PC during the scanning activity and to be detached once the scanning activity is finished.
  3. When not in use, the external HDD should be properly stred in the process owner’s cabinet.
  4. The external HDD will be copied by SND staff on a monthly basis for back-up purposes.
  5. Bac-up copy of HDD is taken care of by SND.
  6. Both external HD of HRD and SND are to be encrypted.
  7. The external HDD shall not be transferred to the other facility without prior approval of the HR and ISMR.45

As to the Organizational Records Protection Procedures, Datascope stated that HR documents in hard copies, including employees’ records, shall be kept safely in the HR stockroom where only the HR staff has access.46 Moreover, 201 files shall be accessible only to HR assistant, specialist, head, and general manager of Datascope.47

Datascope also attached in its Full Report a Formal Incident Report containing a recommendatory action from Datascope’s Incident Response Team:

  1. Implement encryption for the external [HDD] with confidential files.
  2. Make an equipment inventory to make sure that it is not just the [HDD] that is missing.
  3. Monitoring/inspection log of external [HDDs].
  4. Ensure external [HDDs] were swapped every month even without changes/updates.
  5. Strict implementation: always have a transmittal/gate pass to serve as proof that the item was being transferred.48

In line with the recommendations made by its Incident Response Team, Datascope also submitted the following documents to serve as proof of security measures it implemented:

  1. Gate Pass Procedure and Guidelines49
  2. Removable Media Guidelines50
  3. Media Transport Procedure51
  4. Physical Security Perimeter Guidelines52
  5. Clear Desk-Clear Screen and Unattended User Equipment Policy53
  6. Documented Information Control Guidelines and Procedures.54

Moreover, Datascope attached a full investigation report containing the result of the investigation conducted by its Incident Response Team.55 On account of the said investigation report, Datascope likewise attached the Corrective Action Report which contained the following details:

Immediate Corrective Action:

  1. Conducted thorough searching of the missing equipment.
  2. Reminded all the HR staff about the proper storing of HR files including external [HDD] and the impact of the incident to the company and employees in general.56

Corrective Action Plans:

  1. Draft a written guideline in the proper scanning and back up of HR files to include that external [HDD] containing sensitive information shall be attached solely to workstation located inside the HR Head’s room.
  2. Monitoring/inspection of external [HDDs] on a monthly basis.
  3. Implement encryption for the external [HDD] with confidential files.57

Further, as part of its investigation, Datascope stated that its Accounting Department conducted a physical audit of all external HDD issued to HR Department.58

Datascope also asked all HRD personnel, as well as the utility clerks and company driver, to answer the following questions on a written form:

a) What [is] their knowledge with regards sic to keeping HRD files secured? b) What [is] their awareness with HRD files? c) What are their practices in keeping HRD rooms secured?59

In answering the above-mentioned questions, the HRD personnel, utility clerks and company driver stated that the files are properly safe kept in cabinet in the HRD room.60 The said employees and personnel also stated that the HRD files are confidential in nature, and as a practice, the HRD room must always be locked and ensure that no unauthorized person is left inside.61

Likewise in its Full Report, Datascope made a detailed report on the measures it took to prevent a recurrence of the incident:

  1. DCPI formulated written guidelines in the proper scanning and back up of HR files to include that external hard disk containing sensitive information shall be attached solely to the workstation located inside the HR inner room where the HR Head is located.

  2. DCPI defined the access and restrictions of the HR staff with regards to their access to confidential information of personnel employment records.

  3. DCPI implemented a monthly monitoring and inspection of external HDD.

  4. DCPI installed a CCTV camera inside the HRD room due to the incident.

  5. DCPI will implement encryption for the external HDD with confidential files.

  6. DCPI will create a procedure for pick up and transfer of hard drives aside from the logs recording the movement of the hard drives and chain of custody handling. (Specifically include in the procedure that refusal of pickup of HDD is not allowed).

  7. DCPI will allocate a dedicated server for HRD back up files to be stored inside the Data Center.62

Datascope also submitted proof of training attendance of its employees in relation to compliance with cyber safety and data privacy.63

As one of Datascope’s security management, Datascope submitted a List of Access Rights of the company personnel and/or staff who are authorized to access company documents related to its employees such as employment contract, payroll approval, and claims for SSS, Pag-IBIG, and PhilHealth, among others.64

Datascope also attached a copy of its inventory conducted by the Accounting Department on the HRD external HDDs containing details of which facility where such HDDs are found, as well as their specifications, and the personnel who are accountable to such external HDDs.65

Finally, Datascope submitted photographs of the closed-circuit television (CCTV) installed inside the HRD room,66 and proof of payroll with encryption.67

Upon review of the Full Report and the attached documents, Datascope was able to include the details that were lacking from its initial report. Thus, the Commission finds that Datascope sufficiently complied with the Orders dated 19 October 2020 and 14 June 2021.68

II. Datascope submitted a PIA on its various data processing systems

In an Order dated 14 June 2021, the CID required Datascope to submit the following:

  1. the Audit Report containing the results of the physical audit of all external HDDs conducted by the Accounting Department; and

  2. the result of the Privacy Impact Assessment (PIA) on the identification of privacy risks and adaption of the appropriate security measures to protect personal data against natural and human dangers with guidelines provided under NPC Advisory No.69

Accordingly on 19 May 2022, Datascope submitted to the Commission the required PIA.70

NPC Advisory No. 2017-03 defines a PIA as a:

[P]rocess undertaken and used to evaluate and manage impacts on privacy of a particular program, project, process, measure, system or technology product of a PIC or PIP program, project, process, measure, system or technology product of a PIC or PIP. It takes into account the nature of the personal data to be protected, the personal data flow, the risks to privacy and security posed by the processing, current data privacy best practices, the cost of security implementation, and, where applicable, the size of the organization, its resources, and the complexity of its operations.71

Datascope’s PIA provided and tabulated the observations, recommendations, and a corresponding management action plan related to the general data privacy principles of transparency, legitimate purpose, and proportionality;72 the privacy impact analyses on the collection, and the use and disclosure of personal data;73 the preservation of the quality of personal data being processed;74 organizational, physical, and technical security measures;75 and, a privacy risk assessment or management as to the disposal of personal data.76

First, Datascope’s PIA included an assessment of its data processing systems, specifically on the scanning of 201 files of the company’s regular employees.77 According to Datascope, the scanning of the said 201 files will serve as its back up copy of the employees’ records.78 Datascope enumerated the personal data it collects, such as the employees’ names, addresses, dates of birth, contact information, government identification numbers, transcripts of diplomas, performance assessments, disciplinary actions, work histories, post-employment information, hiring requirements, and annual medical results.79

The process flow for the scanning activity of the 201 files were also provided in the PIA.80 Datascope mentioned that the HR Analyst shall be responsible for the handling and processing of the personal data contained in the 201 files as well as other HR documents.81 Datascope likewise mentioned that the personal data it collects shall be retained for four (4) years upon the separation of the employee from the company, after which, the personal data shall be disposed through deletion.82

Datascope added that its HR Analyst shall be responsible for the disposal of the personal data it collects, including the security measures it will take to implement such disposal.83 Datascope stated in its PIA that the external HDD containing personal data is being disclosed by transferring it to other facility for offsite back-up.84 Datascope likewise mentioned in its PIA that the nature, purpose, and extent of processing of personal data of its data subjects was made aware to them.85

As regards the adherence to the general data privacy principle of transparency, Datascope stated that the data subjects are “aware of the risks and safeguards involved in the processing of [their] personal data” as well as their data subject rights and on how these rights are exercised.86 Datascope also indicated that there are “steps in place to allow an individual to know what personal data it holds about [him or her] and its purpose of collection, usage, and disclosure.”87 Datascope specified that these policies for the management of personal data are being set out in the company’s Privacy Notice and Privacy Manual.88

As to the Legitimate Purpose principle, Datascope indicated in its PIA that its “processing of personal data [is] compatible with a declared and specified purpose which are not contrary to law, morals, or public policy.”89 The PIA also identified that data subjects are aware of the identity of the company as personal information controller (PIC) which processes their personal data, and on how the company’s DPO will be contacted.90

Lastly, Datascope indicated that its data processing is “adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose,”91 in adherence to the Proportionality principle.92 In addition thereto, the PIA also stated that the processing of personal data was “authorized by a specific law or regulation, or by the individual through express consent.”93

The PIA of Datascope also contains Privacy Impact Analyses of its personal data collection and, use and disclosure of personal data.94 In collecting the personal data, Datascope stated that the collection and processing of personal data are made available in its Privacy Notice.95 Datascope indicated that the consent of data subjects is “time-bound in relation to the declared, specified, and legitimate purpose.”96

Datascope likewise mentioned that it collects the personal data directly from the concerned individual, as well as the capacity of data subjects to withdraw their consent in the processing of their personal data.97 Datascope also maintained that the personal data will only be used or disclosed for its primary purposes.98

Moreover, as to the quality of data being processed by Datascope, the PIA identified the following steps it takes to “ensure that all data that is collected, used, or disclosed will be accurate, complete, and up to date:”

  1. A disposal schedule in place that deletes information that is over the retention period.
  2. Staff are trained in the use of the tools and receive periodic updates.
  3. Incidents are reviewed for lesson learnt and systems/processes updated appropriately.99

In implementing organizational security, Datascope’s PIA indicated that it has appointed a company’s DPO or Compliance Officer, as well as the existence of data protection and security measure policies within the organization.100 Datascope ensured that it has an inventory of the company’s data processing systems, and that all the personnel or employees who are processing through its data processing systems shall process personal data with strict confidentiality especially “if the personal data are not intended for public disclosure.”101

On the other hand, Datascope’s physical security includes the following:

  1. Policies and procedures to monitor and limit the access to this project/system.
  2. Duties, responsibilities, and schedule of the individuals that will handle the personal data processing are clearly defined.102

As regards technical security, Datascope provides for the following:

  1. Security policy with respect to the processing of personal data.
  2. Policies and procedures for the restoration of availability and access to personal data when security incidents occur.
  3. Regular test, assessment, and evaluation of the effectiveness of security measures.
  4. Encryption of personal data processed while in transit or at rest.103

Lastly, Datascope has identified threats, vulnerabilities, and the existing controls it implemented to address such threats and vulnerabilities.104

As a procedure of Datascope’s disposal of personal data which it collected, Datascope stated that “[o]nce the data is due for deletion as per the retention period, the data is deleted, and the external HDD is being re-used for the same purpose which is to store back up of 201 file.” Accordingly, Datascope identified the following threats and their vulnerabilities, as well as the controls it has implemented:

ThreatsVulnerabilitiesExisting controls
Loss of data due to loss of external HDD.Lack of established guidelines in the scanning of 201 files and proper safekeeping of external HDD.1. With written guidelines in the scanning of 201 files and proper safekeeping of external HDD. 2. Defined the access and restrictions of the HR staff with access to confidential information of personnel employment records. 3. Monthly monitoring and inspection of external HDD. 4.Installation of CCTV camera inside the HRD room. 5. Encryption of external HDD with personal data.
Incomplete and inaccurate back up data on the HDD.Operational Staff or User Errors due to lack of trainingOrientation of HR staff.
Loss of external HDD.Lack of Physical Security.HR room is locked when unattended and accessible only to HR personnel.
Loss of data due to loss of external HDD during transfer.Lack of documentation during transferWith gate pass upon transfer (noted by immediate superior and approved by ISMR)
Loss of data due to defective back up hard drive.Lack of testing of back up hard drivesImplementation of back up testing procedures.
Loss of Data/Information Disclosure of sensitive information.Lack of user awareness.Backup procedure.
Disclosure of sensitive information.Theft of external HDD.Storage of external HDD are stored in a secure storage and only authorized personnel has access.
Disclosure of sensitive information.Loss of external HDD.Storage of external HDD are stored in a secure storage and only authorized personnel has access.
Disclosure of sensitive information.Uncontrolled copying of data.Only the HR Analyst is authorized to copy/backup employee’s personal data.

Thus, based on the records, Datascope has been able to conduct an adequate PIA in line with NPC Advisory 17-03, pursuant to the Order of CID dated 14 June 2021.

III. The incident falls under the mandatory breach notification requirement; Datascope sufficiently notified the affected data subjects of the incident

In its initial report, Datascope stated that an external HDD containing scanned copies of personnel employment records went missing when the same was transferred from TARA Facility to MMP Facility.104 Datascope specifically stated that the total number of affected data subjects is 651 broken down into: (1) 384 active employees; (2) 260 resigned employees; (3) 7 employees on leave.105

Datascope also enumerated the personal data contained in the missing external HDD were: (1) full name; (2) date of birth; (3) address; (4) contact information; (5) SSS number; (6) tax identification number; (7) BIR Form 2316; (8) Philhealth number; (9) PAG-Ibig number; (10) education/transcripts/diplomas; (11) performance assessments; (12) disciplinary actions; (13) work history; (14) post-employment information; (15) hiring requirements; and, (16) annual medical records, among others.106

In order to allow the affected data subjects to take “necessary precautions or other measures to protect themselves against the possible effects of the breach,” notification should be made upon them regarding the incident.107 Thus, Rule V, Section 11 of NPC Circular 16-03 (Personal Data Breach Management) provides:

SECTION 11. When notification is required.

Notification shall be required upon knowledge of or when there is reasonable belief by the personal information controller or personal information processor that a personal data breach requiring notification has occurred, under the following conditions:

A. The personal data involves sensitive personal information or any other information that may be used to enable identity fraud. For this purpose, “other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.

B. There is reason to believe that the information may have been acquired by an unauthorized person; and

C. The personal information controller or the Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.108

The first requisite under Section 11 is present in this case considering that the missing external HDD contained scanned copies of personnel employment records which also contain sensitive personal information such as the dates of birth, annual medical records, education/transcripts/diplomas, disciplinary actions, among others.109

Moreover, Section 20(f) of the DPA in relation to Section 11(A) NPC Circular 16-03 states:

SEC. 20. Security of Personal Information. -

…

(f) The personal information controller shall promptly notify the Commission and affected data subjects when sensitive personal information or other information that may, under the circumstances, be used to enable identity fraud are reasonably believed to have been acquired by an unauthorized person, and the personal information controller or the Commission believes that such unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject[.]110 (Emphasis supplied)

It must be stressed that the “other information that may be used to enable identity fraud” as defined in Section 11(A) of NPC Circular 16-03 is not an exclusive list.111 In this instance, while the employees SSS numbers, tax identification numbers, and PhilHealth numbers are among those specified in Section 11(A) of NPC Circular 16-03, BIR Forms 2316 and Pag-IBIG numbers112 are likewise considered “other information that may be used to enable identity fraud,” under this circumstance which, according to Datascope can result into identity theft of personal data which can be used for blackmailing or extortion, and coercion, as well as access to personal data which can result to “reputation or financial damage or could be sold to telemarketers.”113

Further, there is a reason to believe that these information may have been acquired by an unauthorized person considering that based on the investigation conducted, Datascope “cannot establish whether the external HDD was misplaced or intentionally taken or at worst, stolen.”114 It can be deduced therefore that Datascope has lost control over the external HDD. Datascope also admitted that the personal data breach may result into identity theft and, access of personal data.115 Thus, since Datascope alleged that identity theft and, access thereof may result due to the loss of external HDD, there was already a belief on Datascope that such external HDD was acquired by unauthorized person. Hence, the second requisite is also present.

Consequently, the third requisite is also present, since the unauthorized acquisition of the external HDD containing personnel employment records are likely to give rise to a real risk of serious harm to the affected data subjects. It must be noted that there should exist a nexus between the data breach incident and the consequent real risk of serious harm that may possibly arise. The Commission has stressed that the “risk shall be apparent and not a product of mere speculation,” which means that the “consequences and effects to any affected data subject is significant based on the surrounding circumstances of the breach.”116

In the surrounding circumstances of this case, the risk was apparent to the affected data subjects since according to Datascope, identity theft of the personal data contained in the lost external HDD is a possible negative consequence of the breach incident.117 Considering the nature and sensitivity of the personal data involved in this case, their unauthorized acquisition as well as their possible unauthorized access “can be used for illegal purposes like blackmail or extortion, coercion,” and “may result to reputation or financial damage or could be sold to telemarketer.”118

These being said, Datascope has more sufficient reason to notify the affected data subjects. Thus, given that all the requisites for mandatory notification requirement are present, Datascope, as PIC, has the obligation to notify the affected data subjects to reduce the possible risk arising from the incident and to prevent further unauthorized acquisition of the personal data involved in the breach.119

However, the Commission notes that Datascope sufficiently complied with this obligation. In its Full Report dated 03 November 2020, Datascope submitted proof of notification to the 651 affected data subjects who were its employees-active, resigned, or on leave.120

The notification made by Datascope was in the form of an Internal Memorandum signed by its DPO.121 The said notification contained the list of personal data involved in the incident.122 The Memorandum likewise contained details as to nature of the breach,123 likely consequences of the breach,124 measures taken to address the breach,125 measures taken to secure or recover the compromised personal data,126 measures being taken to prevent recurrence of the incident,127 the actions performed to mitigate possible harm or negative consequences of the incident,128 and the contact information of Datascope’s DPO for assistance.129

As proof of the notification required under Section 18 of NPC Circular No. 16-03, Datascope submitted proof of receipt of the notification given to the affected data subjects.130 The notification receipt contained the names of Datascope employees, together with their company positions and their respective signatures as proof that they were notified by Datascope of the personal data breach incident.

Given the foregoing, the Commission finds that Datascope has sufficiently notified the affected data subject pursuant to NPC Circular 16-03.

WHEREFORE, based on the foregoing, the Commission hereby resolves that the matter of NPC BN 18-140 “In re: Datascope Communications (Philippines), Inc.” is CLOSED.

SO ORDERED.

City of Pasay, Philippines. 18 April 2024.

SGD

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

SGD

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

SGD

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

MPT Data Protection Officer Datascope Communications (Philippines), Inc.

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Mandatory Notification and Report dated 31 July 2018 of Datascope Communications (Philippines), Inc., at p. 1. ↩

  2. Id., at p. 2. ↩

  3. Id. ↩

  4. Id. ↩

  5. Mandatory Notification and Report dated 31 July 2018 of Datascope Communications (Philippines), Inc., at pp. 2-3. ↩

  6. Id., at p. 3. ↩

  7. Id. ↩

  8. Id., at p. 4. ↩

  9. Mandatory Notification and Report dated 31 July 2018 of Datascope Communications (Philippines), Inc., at p. 3. ↩

  10. Id., at pp. 3-4. ↩

  11. Id., at p. 3. ↩

  12. Id., at pp. 4-6. ↩

  13. NPC BN 18-140 (unreported), Order dated 19 October 2020 of the National Privacy Commission’s Complaints and Investigation Division. ↩

  14. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc. ↩

  15. Id., at p. 3. ↩

  16. Id., at p. 7. ↩

  17. Id., referred to as Annexes “1” to “21.” ↩

  18. NPC BN 18-140 (unreported), Order dated 14 June 2021 of the National Privacy Commission’s Complaints and Investigation Division. ↩

  19. Additional Documents dated 19 May 2022 of Datascope Communications (Philippines), Inc. ↩

  20. NPC BN 18-140 (unreported), Order dated 19 October 2020 of the National Privacy Commission’s Complaints and Investigation Division. ↩

  21. Id. ↩

  22. Id. ↩

  23. Id. ↩

  24. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 17(D) (15 December 2016) (NPC Circular 16-03). ↩

  25. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc. ↩

  26. Id. ↩

  27. Id., referred to as Annex “1.” ↩

  28. Id. ↩

  29. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc., referred to as Annex “1.” ↩

  30. Id. ↩

  31. Id. ↩

  32. Id. ↩

  33. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc., referred to as Annex “3.” ↩

  34. Id. ↩

  35. Id. ↩

  36. Id., referred to as Annex “2.” ↩

  37. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc., referred to as Annex “4.” ↩

  38. Id., referred to as Annex “2.” ↩

  39. Id. ↩

  40. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc., referred to as Annex “2.” ↩

  41. Id. ↩

  42. Id. ↩

  43. Id., referred to as Annex “3.” ↩

  44. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc., referred to as Annex “4.” ↩

  45. Id. ↩

  46. Id., referred to as Annex “5.” ↩

  47. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc. ↩

  48. Id., referred to as Annex “7.” ↩

  49. Id., referred to as Annex “8.” ↩

  50. Id., referred to as Annex “9.” ↩

  51. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc., referred to as Annex “10.” ↩

  52. Id., referred to as Annex “17.” ↩

  53. Id., referred to as Annex “12.” ↩

  54. Id., referred to as Annex “13.” ↩

  55. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc., referred to as Annex “6.” ↩

  56. Id., referred to as Annex “7.” ↩

  57. Id., referred to as Annex “8.” ↩

  58. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc., referred to as Annex “9.” ↩

  59. Id., referred to as Annex “5.” ↩

  60. Id., at p. 6. ↩

  61. Id. ↩

  62. Id., referred to as Annex “14.” ↩

  63. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc., referred to as Annex “16.” ↩

  64. Id., referred to as Annex “18.” ↩

  65. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc., referred to as Annex “20.” ↩

  66. Id., referred to as Annex “21.” ↩

  67. Id. ↩

  68. NPC BN 18-140 (unreported), Order dated 19 October 2020 of the National Privacy Commission’s Complaints and Investigation Division. See also NPC BN 18-140 (unreported), Order dated 14 June 2021 of the National Privacy Commission’s Complaints and Investigation Division. ↩

  69. NPC BN 18-140 (unreported), Order dated 14 June 2021 of the National Privacy Commission’s Complaints and Investigation Division. ↩

  70. Additional Documents dated 19 May 2022 of Datascope Communications (Philippines), Inc., referred to as Privacy Impact Assessment at pp. 1-5. ↩

  71. National Privacy Commission, Guidelines on Privacy Impact Assessments, NPC Advisory 2017-03, in Definition of Terms (31 July 2017) (NPC Advisory 2017-03). ↩

  72. Id., at pp. 31-40. ↩

  73. Id., at pp. 41-45. ↩

  74. Id., at pp. 46-60. ↩

  75. Additional Documents dated 19 May 2022 of Datascope Communications (Philippines), Inc., referred to as Privacy Impact Assessment at pp. 1-5. ↩

  76. Id. ↩

  77. Id. ↩

  78. Additional Documents dated 19 May 2022 of Datascope Communications (Philippines), Inc., referred to as Privacy Impact Assessment at pp. 6-10. ↩

  79. Id. ↩

  80. Id. ↩

  81. Id., at pp. 11-15. ↩

  82. Additional Documents dated 19 May 2022 of Datascope Communications (Philippines), Inc., referred to as Privacy Impact Assessment at pp. 11-15. ↩

  83. Id. ↩

  84. Id., at pp. 16-20. ↩

  85. Id. ↩

  86. Id., at pp. 16-20. ↩

  87. Additional Documents dated 19 May 2022 of Datascope Communications (Philippines), Inc., referred to as Privacy Impact Assessment at pp. 21-25. ↩

  88. Id. ↩

  89. Id., at pp. 26-30. ↩

  90. Additional Documents dated 19 May 2022 of Datascope Communications (Philippines), Inc., referred to as Privacy Impact Assessment at pp. 31-35. ↩

  91. Id. ↩

  92. Id., at pp. 31-35. ↩

  93. Additional Documents dated 19 May 2022 of Datascope Communications (Philippines), Inc., referred to as Privacy Impact Assessment at pp. 31-35. ↩

  94. Id. ↩

  95. Id., at pp. 36-40. ↩

  96. Id. ↩

  97. Additional Documents dated 19 May 2022 of Datascope Communications (Philippines), Inc., referred to as Privacy Impact Assessment at pp. 36-40. ↩

  98. Id. ↩

  99. Id., at pp. 41-45. ↩

  100. Additional Documents dated 19 May 2022 of Datascope Communications (Philippines), Inc., referred to as Privacy Impact Assessment at pp. 46-50. ↩

  101. Id. ↩

  102. Id., at pp. 51-55. ↩

  103. Id., at pp. 56-60. ↩

  104. Additional Documents dated 19 May 2022 of Datascope Communications (Philippines), Inc., referred to as Privacy Impact Assessment at pp. 61-65. ↩ ↩2

  105. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc. ↩

  106. Mandatory Notification and Report dated 31 July 2018 of Datascope Communications (Philippines), Inc. ↩

  107. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 11. ↩

  108. NPC Circular 16-03, rule V, § 11. ↩

  109. Mandatory Notification and Report dated 31 July 2018 of Datascope Communications (Philippines), Inc. ↩

  110. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter V, § 20(f) (2012). ↩

  111. NPC Circular 16-03, rule V, § 11(A). ↩

  112. Mandatory Notification and Report dated 31 July 2018 of Datascope Communications (Philippines), Inc., at p. 4. ↩

  113. Id., at pp. 3-4. ↩

  114. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc., at p. 3. ↩

  115. Mandatory Notification and Report dated 31 July 2018 of Datascope Communications (Philippines), Inc., at pp. 3-4. ↩

  116. In re: EasyTrip Services Corporation, NPC BN 17-028 & NPC BN 18-180, Resolution dated 11 May 2023. ↩

  117. Mandatory Notification and Report dated 31 July 2018 of Datascope Communications (Philippines), Inc., at p. 3. ↩

  118. Id. ↩

  119. NPC Circular 16-03, rule V, § 18(A). ↩

  120. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc. ↩

  121. Id., also referred to as Annex “15.” ↩

  122. Id., also referred to as Annex “15,” at p. 1. ↩

  123. Id., also referred to as Annex “15,” at pp. 1-2. ↩

  124. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc. ↩

  125. Id. ↩

  126. Id., also referred to as Annex “15,” at pp. 2-3. ↩

  127. Id., also referred to as Annex “15,” at p. 3. ↩

  128. Full Report on the Personal Data Breach dated 03 November 2020 of Datascope Communications (Philippines), Inc. ↩

  129. Id., at p. 4. ↩

  130. Id., also referred to as Annex “15.” ↩

Backlinks

  • No backlinks found