NPC Issuance Wiki

NPC BN 18-242: In re: Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.)

Issued Resolution

Resolution Text

IN RE: CONVERGYS PHILIPPINES, INC. (NOW KNOWN AS CONCENTRIX CVG PHILIPPINES, INC.)

x----------------------------------------------------x

RESOLUTION

NAGA, P.C.;

Before the Commission is the Compliance submitted by Convergys Philippines, Inc. (Convergys) dated 26 March 2021.

Facts

On 28 December 2018, Convergys notified the National Privacy Commission (NPC) through a letter regarding a breach incident involving the medical condition of its employee, MAD.1 In its report, Convergys stated that on 27 December 2018, the Human Resources (HR) team of its Clark Site located at SM City Clark IT Park, Angeles City, Pampanga received an email from MAD reporting a possible privacy violation of his immediate supervisor, DA.2

Further, MAD stated that he sent to DA a copy of his medical certificate which indicated his illness and asked him to keep the matter between themselves.3 However, DA shared the medical certificate of MAD to the other managers and noted his illness in the e-Start system of the company which serves as an attendance tool to which other operations supervisors and managers have access.4

Thereafter, the HR team of Convergys consulted its data privacy team regarding the matter.5 Convergys also stated that its system, e-Start, is “limited only to Operations supervisors and managers of the Operations team and only within the team’s reporting hierarchy.”6

Further, Convergys attached in its initial report the complaint letter of MAD wherein the latter stated the response of DA when he approached him about the incident.7 MAD stated that “I [approached] my supervisor about the note in [e-Start] he just told me. [I’m] just doing my job if [you] [want] sue me then go.”8

Convergys also stated that the sensitive personal information involved in the incident is the medical condition of MAD, which has been exposed to unauthorized individuals within its company.9

As to the measures to address the breach, Convergys stated that it deleted the notes in its e-Start system referring to MAD’s medical condition.10 Convergys also stated that DA and the second-level manager were also directed to maintain confidentiality of the medical condition of MAD.11 Further, according to Convergys, its “HR Team is reviewing the incident and will be issuing the necessary Show Cause Notice again consistent with internal policies which include penalties that may be imposed after finding any violation related to data privacy.”12

Moreover, Convergys stated that it will inform MAD of the steps it will take to ensure the protection of his privacy rights.13 Convergys will also issue reminders to its supervisors and managers “with regard to handling medical information of the employees of the Company.”14

On 11 March 2021, the NPC’s Complaints and Investigation Division (CID) issued an Order directing Convergys to submit a Post-Breach Report.15

On 26 March 2021, Convergys submitted its Compliance to the Order dated 11 March 2021.16 In its Compliance, Convergys stated that the root cause of the incident was due to human error committed by DA when the medical certificate was uploaded in the e-Start system.17

Convergys explained that employees are required to submit medical certificates to their supervisors to support their absences.18

“The root cause is the inadvertent human error committed by DA. Employees submit their medical certificates (which may or may not contain an illness) to their respective supervisors to support their absences. These medical certificates are kept confidential, are shared to the second level manager to get an approval to excuse an absence by an employee. It is not standard however, to put in the attendance tool the actual contents of the medical certificate (and illness, if any) of an employee. DA inadvertently captured the medical condition of MAD in the attendance tool.”19

Further, Convergys stated that DA was called out for his negligent act in the incident.20 DA together with the second level manager “were directed to maintain confidentiality of the medical condition of MAD.”21 Thereafter, Convergys alleged that its HR team immediately deleted the medical certificate of MAD in the attendance tool.22

Accordingly, MAD was notified regarding the incident through email.23 A proof and copy of the data subject notification was attached in its compliance.24 In addition, Convergys stated that MAD already knew of the incident considering that he was the one who reported it.25

The email states that the subject medical certificate and notes were deleted in the e-Start system.26

Further, Convergys informed MAD that the involved supervisors were “directed to maintain the confidentiality of the medical condition.”27 Convergys also instructed MAD to contact their data privacy team if there would be any untoward event that would transpire regarding the incident.28

Convergys further asserted that “MAD expressed no subsequent concerns on the matter.”29

Issue

Whether or not Convergys has sufficiently addressed the breach incident pursuant to NPC Circular 16-03 (Personal Data Breach Management).

Discussion

The Commission holds that Convergys has sufficiently addressed the breach incident pursuant to NPC Circular 16-03 (Personal Data Breach Management). As such, the Commission resolves to terminate the investigation and consider the matter closed.

Although the Commission finds that the incident falls under mandatory data subject notification, Convergys has already notified the affected data subject and implemented measures to prevent the recurrence of the incident.

Section 11 of NPC Circular 16-03 provides:

SECTION 11. When notification is required.

Notification shall be required upon knowledge of or when there is reasonable belief by the personal information controller or personal information processor that a personal data breach requiring notification has occurred, under the following conditions:

A. The personal data involves sensitive personal information or any other information that may be used to enable identity fraud. For this purpose, “other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.

B. There is reason to believe that the information may have been acquired by an unauthorized person; and

C. The personal information controller or the Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.

(emphasis supplied)30

As to the first element, the medical certificate that contains the medical condition of MAD is sensitive personal information as contemplated in Rule I, Section 3 (L) (1) of NPC Circular 16-03, to wit:

SECTION 3. Definition of Terms. For the purpose of this Circular, the following terms are defined, as follows:

“Sensitive personal information” refers to personal information:

  1. About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;
  2. About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;
  3. Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and
  4. Specifically established by an executive order or an act of Congress to be kept classified.31 (Emphasis Supplied)

Regarding the second element, there is reason to believe that the information was acquired by an unauthorized person because the other supervisors were able to access the medical certificate of MAD. Further, Convergys admitted that other managers had access to the e-Start system. Thus, it must be emphasized, that these supervisors were never privy to the said document. In this regard, the access of these unauthorized individuals to the medical record of MAD would likely give rise to a real risk of serious harm when combined with MAD’s personal information and used in a manner that could expose him to harassment or discrimination. Thus, the third element is also present.

Following Section 11 of NPC Circular 16-03, the Commission finds that the incident falls under mandatory notification considering that there is sensitive personal information involved, it was acquired by an unauthorized person, and such acquisition is likely to give rise to a real risk of serious harm.

Nonetheless, it bears stressing that Convergys has sufficiently notified the affected data subject. Section 18 (C) of NPC Circular 16-03 provides for the content of data subject notification by the Personal Information Controller (PIC):

SECTION 18. Notification of Data Subjects.

The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.32

In the notification sent by Convergys through email to MAD, the nature of the incident was explained while also informing MAD that the medical certificate was already deleted from the system:

Dear MAD,

We received your below email-report dated December 27, 2018 addressed to the Human Resources (HR) team of our Clark Site.

To our understanding, your request to keep your medical condition private between you and your immediate supervisor, DA, when you submitted to him your medical certificate, may not have been heeded.

Given the information you provided, the HR Team and your OM were immediately directed to delete the notes in E-start referring to your medical condition. As of the time of writing, it has already been confirmed that your medical condition indicated in the medical certificate you refer to in your email-report was already deleted in E-start.

Both DA and LD were also directed to maintain the confidentiality of the medical condition. Rest assured that the Company will provide the same directive to anyone else that may have access to the said information and, more importantly, continuously protect your rights in accordance with applicable rules both as mandated by law and prescribed by our internal policies.

If there are any untoward event, which you believe may have resulted from this incident, please immediately inform the Clark HR team and the data privacy team. If you have any more concern or clarification, do not hesitate to contact our data privacy team through this email or at the email address of our Data Protection Officer at XXX

Kind regards,

Data privacy team33

Moreover, Convergys issued directives to the supervisors involved to keep the confidentiality of the information.34 Finally, Convergys has provided the contact details of its data privacy team whom MAD may contact if there would be untoward incidents that would transpire as a result of the incident.35

As to the notification to the Commission, Convergys sent the same on 28 December 2018, which is within seventy-two (72) hours from their knowledge of the incident on 27 December 2018.36 In its submission, the nature of the breach, the personal data involved, and the measures taken to address the breach were reported.37 Thus, Convergys has sufficiently complied with the reportorial requirements under Section 17 of NPC Circular 16-03.

Considering the foregoing, the Commission finds that Convergys has already complied with its directives and NPC Circular 16-03 (Personal Data Breach Management). Consequently, the Commission deems it proper to close and terminate the case.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-242 “In re: Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.)” is hereby considered CLOSED.

SO ORDERED.

City of Pasay, Philippines. 21 March 2024.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

MM Data Protection Officer CONCENTRIX CVG PHILIPPINES, INC.

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. Letter dated 28 December 2018 “Data Breach dated December 27, 2018” from Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.). ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Letter dated 28 December 2018 “Data Breach dated December 27, 2018” from Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.). ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. Letter dated 28 December 2018 “Data Breach dated December 27, 2018” from Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.). ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Letter dated 28 December 2018 “Data Breach dated December 27, 2018” from Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.). ↩

  14. Id. ↩

  15. Order dated 11 March 2021. ↩

  16. Compliance dated 26 March 2021 “Compliance with Order dated 11 March 2021 in NPCBN No. 18-240 (In re: Convergys Philippines Inc. Convergys Philippines, Inc.) from Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.). ↩

  17. Id. ↩

  18. Id. ↩

  19. Id. ↩

  20. Compliance dated 26 March 2021 “Compliance with Order dated 11 March 2021 in NPCBN No. 18-240 (In re: Convergys Philippines Inc. Convergys Philippines, Inc.) from Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.). ↩

  21. Id. ↩

  22. Id. ↩

  23. Id. ↩

  24. Compliance dated 26 March 2021 “Compliance with Order dated 11 March 2021 in NPCBN No. 18-240 (In re: Convergys Philippines Inc. Convergys Philippines, Inc.) from Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.). ↩

  25. Id. ↩

  26. Id. ↩

  27. Id. ↩

  28. Compliance dated 26 March 2021 “Compliance with Order dated 11 March 2021 in NPCBN No. 18-240 (In re: Convergys Philippines Inc. Convergys Philippines, Inc.) from Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.). ↩

  29. Id. ↩

  30. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, Rule V, §11 (15 December 2016). ↩

  31. NPC Circular 16-03, rule I, § 3(L). ↩

  32. NPC Circular 16-03, rule V, §18 (C). ↩

  33. Compliance dated 26 March 2021 “Compliance with Order dated 11 March 2021 in NPCBN No. 18-240 (In re: Convergys Philippines Inc. Convergys Philippines, Inc.) from Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.). ↩

  34. Id. ↩

  35. Id. ↩

  36. Letter dated 28 December 2018 “Data Breach dated December 27, 2018” from Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.). ↩

  37. Compliance dated 26 March 2021 “Compliance with Order dated 11 March 2021 in NPCBN No. 18-240 (In re: Convergys Philippines Inc. Convergys Philippines, Inc.) from Convergys Philippines, Inc. (now known as Concentrix CVG Philippines, Inc.). ↩

Backlinks

  • No backlinks found