NPC Issuance Wiki

NPC BN 18-146: In re: COMELEC, La Paz, Abra

Issued Resolution

Source

Source Tags

  • Personal data breach, Mandatory breach notification
  • NPC Circular 16-03
  • identity fraud
  • security measures
  • loss of control over personal data
  • notification requirements

Resolution Text

IN RE: COMELEC, LA PAZ, ABRA

x----------------------------------------------------x

RESOLUTION

BELARMINO, D.P.C.;

Before the Commission En Banc (Commission) is the breach notification of COMELEC, La Paz, Abra (COMELEC) dated 11 July 2018 and breach management in compliance with NPC Circular 16-03 or the Personal Data Breach Management.1

Facts

On 26 July 2018, the General Records Unit of the National Privacy Commission (NPC) received a Letter issued by the Executive Director and Concurrent Data Protection Officer of COMELEC dated 11 July 2018, reporting that the Election Day Certified Voter’s List (EDCVL) of La Paz, Abra was stolen from the official repository of the documents.2

Pursuant to Section 17 (c), Rule V of NPC Circular 16-03, the Complaints and Investigation Division (CID) of the NPC issued Memorandum Order dated 06 August 2018 requiring COMELEC to submit a full report detailing the incident, within five (5) days from receipt thereof, containing the following:

  1. Nature of the Breach

    • a. Description of how the breach occurred and the vulnerability of the data processing system that allowed the breach;

    • b. A chronology of the events leading up to the loss of control over the personal data;

    • c. Approximate number of data subjects or records involved;

    • d. Description or nature of the personal data breach;

    • e. Description of the likely consequences of the personal data breach; and

    • f. Name and contact details of the data protection officer or any other accountable person.

  2. Personal Data Possibly Involved

    • a. Description of sensitive personal information involved; and

    • b. Description of other information that may be used to enable identity fraud.

  3. Measures Taken to Address the Breach

    • a. Description of the measures taken or proposed to be taken to address the breach;

    • b. Actions being taken to secure or recover the personal data that were compromised;

    • c. Actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident;

    • d. Action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification;

    • e. The measures being taken to prevent recurrence of the incident.3

COMELEC did not comply with the Memorandum Order dated 06 August 2018. Thus, the NPC CID issued an Order dated 28 March 2022, directing COMELEC a period of fifteen (15) calendar days from receipt thereof to submit its compliance.4

On 01 June 2022, COMELEC submitted its Full Breach Report dated 30 May 2022.5 Attached thereto are the following: 1) Memorandum issued by CDV, Election Officer II detailing the nature of the breach, personal data possibly involved, and the remedial measures taken subsequent to the suspected breach; 2) Blotter Certification issued by Philippine National Police (PNP) La Paz dated 27 July 2018; 3) Investigation Report Re. Alleged Stolen Documents by PNP La Paz dated 28 July 2018; and 4) Affidavit of CBT, the Election Assistant II of the Office of the Election Officer La Paz, Abra, and DMB, the Election Casual of the Office of the Election Officer of La Paz Abra. COMELEC stated that the breach involves the loss of the printed copy of EDCVL containing nine thousand eighteen (9,018)6 registered voters’ full name, address, photo, and signature, which was used in the National and Local Elections on 09 May 2016.7

In the Affidavit of CBT, she attested that on 27 May 2016 while arranging their office documents, she found out that the EDCVL was missing and reported the same to the Election Officer.8 The same was also corroborated by DMB in his Affidavit.9 Moreover, in their affidavits, they attested that one LTN requested a copy of the EDCVL.10 DMB stated that he accompanied LTN for the purpose of viewing the EDCVL and subsequently returned the document to the box in which it was stored.11 COMELEC explained that its office is situated within a room of the municipal building, which is concurrently occupied by three other offices.12 As such, COMELEC stated that it cannot exercise exclusive control over the premises where the office is located, and acknowledged that its office is prone to surreptitious access.13

As to the safeguards that would minimize harm or mitigate the impact of the personal data breach, COMELEC stated that upon the discovery of the loss, the individuals involved in the breach and the public were notified the soonest time to preempt the use of the data derived from the document in any unlawful or illegal act.14 The loss was immediately reported to the COMELEC Supervisor and the police.15

To avoid recurrence of the incident, COMELEC stated that better policies are to be implemented on handling and safekeeping of documents.16 Also, COMELEC recognized the need for a secure and safe office.17

On 11 August 2023, the NPC CID issued an Order (To Submit Post Breach Report) dated 10 August 2023, requiring COMELEC to furnish the Commission additional information and/or documentation pursuant to Section 9, Rule IV of NPC Circular 16-03, within ten (10) calendar days from receipt thereof:

  1. Proof that the breach notification to the 9,018 affected data subjects were accordingly sent and received by the latter.

  2. A copy of the actual Election Day Computerized Voters’ List (EDCVL) involved in this case showing its contents.

  3. Proof of remediation measures or action taken to address the breach and prevent its recurrence.18

In relation to above, COMELEC submitted its compliance, through a Letter dated 13 September 2023.19 Attached thereto is a separate letter from RVB, an Election Officer II, addressed to Atty. TEE and dated 08 September 2023, in which he states that he was not the election officer responsible at the time the EDCVL went missing, but he was the one tasked to send the notices to the nine thousand eighteen (9,018) affected data subjects.20 The notices were sent through postal service sometime in the last quarter of 2018 until the first quarter of 2019.21 A sample copy of the notice was provided as well.22

Further, COMELEC submitted the Certification, signed by the postmaster, attesting the delivery of breach notices to nine thousand eighteen (9,018) affected registered voters of La Paz, Abra.23

Furthermore, COMELEC submitted “certifications from all the twelve (12) Punong Barangays of the twelve (12) barangays of La Paz, Abra, attesting to the fact that such breach notices were received by the subject registered voters”.24 These certifications are from the following barangays:

  1. Barangay Benben;25

  2. Barangay Bulbulala;26

  3. Barangay Buli;27

  4. Barangay Canan;28

  5. Barangay Linguis;29

  6. Barangay Malabbaga;30

  7. Barangay Mudeng;31

  8. Barangay Pidipid;32

  9. Barangay Poblacion;33

  10. Barangay San Gregorio;34 and

  11. Barangay Toon;35

As proof of COMELEC’s remediation measures, it submitted a copy of the Letter dated 04 September 2023 addressed to the municipal mayor of La Paz, Abra.36 The said letter expresses COMELEC’s reiteration of its earlier “request for a safe and secure office space for the protection and safekeeping of documents, equipment, and supplies”.37

The Commission finds that COMELEC only submitted eleven (11) certifications from the punong barangays of La Paz, Abra. The certification from the punong barangay of Barangay Udangan was not included in the Compliance.

As such, in a Minute Resolution dated 03 July 2025, the Commission ordered COMELEC to submit the proof of notice to the members of Barangay Udangan, La Paz, similar to the notices sent to the eleven (11) other barangays, within a period of fifteen (15) calendar days from receipt thereof.38 The Commission further issued a stern warning reiterating the duties and responsibilities pursuant to the Data Privacy Act of 2012, its Implementing Rules and Regulations, and other relevant issuances, in view of the sensitive and confidential nature of the personal data under COMELEC’s custody and processing.39

On 23 September 2025, COMELEC submitted its compliance, through its Letter dated 19 September 202540 attaching thereto the Certification of the punong barangay of Barangay Udangan, La Paz, Abra.41

Issues

  • I. Whether the matter falls under mandatory breach notification under NPC Circular No. 16-03; and

  • II. Whether COMELEC, La Paz, Abra sufficiently notified the affected data subjects and implemented security measures to prevent its recurrence in compliance with NPC Circular 16-03.

Discussion

The Commission finds that the incident falls under mandatory breach notification. Further, COMELEC has sufficiently complied with the notification requirements and has implemented security measures to prevent its recurrence. Hence, the Commission resolves to close the matter.

The incident falls under mandatory breach notification.

Section 11 of NPC Circular 16-03 sets forth the conditions under which a personal data breach requires notification:

SECTION 11. When notification is required. Notification shall be required upon knowledge of or when there is reasonable belief by the personal information controller or personal information processor that a personal data breach requiring notification has occurred, under the following conditions:

  • A. The personal data involves sensitive personal information or any other information that may be used to enable identity fraud.

For this purpose, “other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.

  • B. There is reason to believe that the information may have been acquired by an unauthorized person; and

  • C. The personal information controller or the Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.42

(Emphasis supplied)

Based on the provision above, breach notification becomes mandatory when the following conditions are present:

  1. The personal data involves sensitive personal information, or information that may, under the circumstances, be used to enable identity fraud;

  2. There is reason to believe that the information may have been acquired by an unauthorized person; and

  3. The unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.43

The first condition requires the involvement of sensitive personal information, or information that may, under the circumstances, be used to enable identity fraud.

Section 3 (l) of the DPA explicitly enumerates sensitive personal information:

(l) Sensitive personal information refers to personal information:

  • (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

  • (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

  • (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and

  • (4) Specifically established by an executive order or an act of Congress to be kept classified.44

While “other information that may, under the circumstances, be used to enable identity fraud” is defined under Section 11 (A) of NPC Circular 16-03:

“other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.45

To reiterate, COMELEC reported that the breach involved the hardcopy of EDCVL containing nine thousand eighteen (9,018)46 registered voters’ full name, address, photo, and signature, which was used in the National and Local Elections on 09 May 2016.47

Although the information involved does not fall within the list of sensitive personal information set forth under Section 3 (l) of the DPA, the full name, address, photo, and signature are considered “other information” which, when taken together, may facilitate identity fraud or theft. Such information could enable any person in possession of the information to make decisions affecting the data subjects, including the granting of rights or benefits. Clearly, the breach involves other information that may, under the circumstances, be used to enable identity fraud.

In the case of In re: TravelPeople Ltd., Inc., the Commission explained that the loss of control over personal data held in custody is enough to have reason to believe that the information may have been acquired by an unauthorized person:

It should be noted that a loss of control over personal data held in custody should be enough for a personal information controller to have “reason to believe that the information may have been acquired by an unauthorized person.” An indication of exfiltration of data is not a requirement in Section 11(b).

Absolute certainty of acquisition by an unauthorized person is not required by either the Circular or the Data Privacy Act (“DPA”), considering that the condition only provides for a determination based on the existing circumstances that can give a “reason to believe”.48 (Emphasis supplied)

In the present case, COMELEC stated, in its Full Breach Report, that the loss was immediately reported to the COMELEC Supervisor49 and police authorities.50 The Blotter Certification dated 27 July 2018 indicates that despite the exerted effort to locate the document, it was not recovered.51 Further, COMELEC stated that an appeal was made publicly and to incumbent local officials for the recovery or return of the missing EDCVL.52

Given these circumstances, the Commission finds that COMELEC’s loss of control over the EDCVL in its custody, is sufficient ground to have a reason to believe that the information indicated in the EDCVL may have been acquired by an unauthorized person. Thus, the second condition is likewise present in this case.

As to the third condition, the Commission discussed the determination of whether an unauthorized acquisition of information will give rise to a real risk of serious harm in the case of In re: Easytrip Services Corporation:

To determine whether there is a likelihood that the unauthorized acquisition of information will give rise to a real risk of serious harm, there shall be a relation between the incident and any possible resulting harm to affected data subjects. The risk shall be apparent and not a product of mere speculation.

Consequently, “serious harm” means that the consequences and effects to any affected data subject is significant based on the surrounding circumstances of the breach.

In determining whether the unauthorized acquisition is likely to give rise to a real risk of serious harm, a PIC or the Commission may consider several factors such as: the nature of the information involved in the breach, amount of information of a data subject, period of time lapsed from the breach, purpose of the unauthorized acquisition, security measures implemented on the information, and extent of potential misuse and exposure of information involved in the breach, if any.53 (Emphasis supplied)

In the present case, the lost EDCVL involved information that could facilitate identity fraud. When combined —particularly with the signatures of the affected data subjects —these information could allow an unauthorized person to fabricate an identity, commit fraud or other unlawful acts, or gain financial advantages, thereby posing a serious threat to the rights and interests of the data subjects. Further, considering that the EDCVL was never found, the extent of potential misuse and exposure of information is far-reaching.

As such, the Commission finds that the unauthorized acquisition of the EDCVL will give rise to a real risk of serious harm to any affected data subject.

Based on the foregoing, the presence of all three (3) conditions under Section 11 of NPC Circular 16-03 has been established. Thus, the incident falls under mandatory breach notification.

COMELEC, La Paz, Abra sufficiently notified the affected data subjects and implemented security measures to prevent its recurrence in compliance with NPC Circular 16-03.

The Commission finds that the COMELEC sufficiently notified the affected data subjects and implemented reasonable and appropriate security measures to prevent its recurrence in compliance with NPC Circular 16-03.

Section 18 (C) and (D) of the NPC Circular 16-03 provide for the manner of notification to the data subjects:

  • C. Content of Notification. The notification shall include, but not be limited to:

  1. Nature of the breach;

  2. Personal data possibly involved;

  3. Measures taken to address the breach;

  4. Measures taken to reduce the harm or negative consequences of the breach;

  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and

  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.

  • D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data.

The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.

In COMELEC’s compliance letter, it provided a copy of the notice that was provided to the affected data subjects.54 The notice contained the following information: 1) The circumstances surrounding the loss of the EDCVL; 2) The personal data involved; 3) Actions taken after the discovery of the loss; 4) How the data subjects may be affected; 5) The measures they have taken to help the data subjects or to reduce the harm or negative consequences of the breach; and 6) The contact details of its Assistant Regional Election Director and Acting Provincial Election Supervisor II from whom the data subject can obtain additional information regarding the breach.

Further, COMELEC reported that the notices were sent through postal service, evidenced by the Certification signed by the postmaster, attesting the delivery of breach notices to nine thousand eighteen (9,018) affected registered voters of La Paz, Abra55 and twelve (12) Punong Barangays of the twelve (12) barangays of La Paz, Abra, attesting to the fact that such breach notices were received by its affected registered voters.56

Furthermore, the Commission finds that COMELEC took appropriate measures to address the incident and prevent its recurrence.

Upon discovery of the loss of EDCVL, it was immediately escalated to the COMELEC supervisor and reported to the police authorities. COMELEC maintained its coordination with the police authority to investigate the incident and retrieve the EDCVL. COMELEC also notified the affected data subjects, along with the potential risks of the exposure of the information and provided its contact details to accommodate concerns.

To avoid recurrence of the incident, COMELEC stated that better policies are to be implemented on handling and safekeeping of documents. Also, COMELEC recognized the need for a secure and safe office.

COMELEC issued a Memorandum to all Regional Election Directors designating Regional Compliance Officers and disseminating its Security Measures and Controls on Data Privacy.57 Further, COMELEC issued its Field Office Systems and Data Policy.58 For monitoring purposes, the COMELEC’s DPO required all field offices to accomplish a checklist on their compliance with the Field Office Systems and Data Policy.59 Also, COMELEC, through its DPO, released a memorandum to all Director IV and Heads of Offices regarding the issuance of security clearance to personnel who were authorized to access records and databases containing personal information.60 Other issuances by COMELEC are the Data Privacy Quick Guide and Compliance Checklist,61 the Non-Disclosure Agreement and Security Clearance,62 and Handbook for Data Privacy Policies for the Commission.63

All Compliance Officers are required to submit an Evaluation report on Access to Personal Data to evaluate and determine appropriate security measures to be implemented in their offices.64

To ensure the integrity of all documents, hardware, software, database, security files, as well as the underlying network infrastructure being used by the Provincial Election Supervisors/Election Officers, COMELEC required an Annual Inventory of all Hardware and Software.65

Upon review of the submissions, the Commission finds that COMELEC has complied with the mandatory notification and implemented reasonable and appropriate security measures to prevent its recurrence in compliance with NPC Circular 16-03.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-146 “In re: COMELEC, La Paz, Abra.” is hereby CLOSED.

SO ORDERED.

Quezon City, Philippines.

30 October 2025.

JOSE AMELITO SUTTON BELARMINO II
Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA
Privacy Commissioner

NERISSA N. DE JESUS
Deputy Privacy Commissioner

Copy furnished:

ATTY. TEE

Executive Director and Data Protection Officer

COMMISSION ON ELECTIONS

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

National Privacy Commission

Footnotes

Footnotes

  1. NPC Circular No. 16-03 dated 15 December 2016 or the Personal Data Breach Management. ↩

  2. Letter from COMELEC dated 11 July 2018. ↩

  3. Complaints and Investigation Division’s Memorandum Order on Breach Notification dated 11 July 2018 regarding Stolen Election Day Voter’s List of La Paz Abra, 06 August 2018. ↩

  4. Complaints and Investigation Division’s Order dated 28 March 2022. ↩

  5. Full Breach Report dated 30 May 2022. ↩

  6. Id., Memorandum dated 25 May 2022, at p. 2. ↩

  7. Id., Memorandum dated 25 May 2022, at p. 1. ↩

  8. Id., Affidavit of CBT dated 30 May 2016. ↩

  9. Id., Affidavit of DMB dated 30 May 2016. ↩

  10. Id., Affidavit of CBT dated 30 May 2016; Affidavit of DMB dated 30 May 2016. ↩

  11. Id., Affidavit of DMB dated 30 May 2016. ↩

  12. Id., Memorandum dated 25 May 2022, at p. 1. ↩

  13. Id., Memorandum dated 25 May 2022, at p. 1. ↩

  14. Id., Memorandum dated 25 May 2022, at p. 2. ↩

  15. Id., Investigation Report regarding Alleged Stolen Documents dated 28 July 2018; Blotter Certification dated 27 July 2018. ↩

  16. Id. ↩

  17. Id. ↩

  18. NPC CID Order (To Submit Post Breach Report) dated 10 August 2023. ↩

  19. Letter from COMELEC dated 13 September 2023 in compliance with the Order dated 10 August 2023. ↩

  20. Id., Letter of Explanation of RVB dated 08 September 2023. ↩

  21. Id., Letter of Explanation of RVB dated 08 September 2023. ↩

  22. Id., Letter of Explanation of RVB dated 08 September 2023, Annex A. ↩

  23. Id., Annex B. ↩

  24. Id. ↩

  25. Id., Annex C-1. ↩

  26. Id., Annex C-2. ↩

  27. Id., Annex C-3. ↩

  28. Id., Annex C-4. ↩

  29. Id., Annex C-5. ↩

  30. Id., Annex C-6. ↩

  31. Id., Annex C-7. ↩

  32. Id., Annex C-8. ↩

  33. Id., Annex C-9. ↩

  34. Id., Annex C-10. ↩

  35. Id., Annex C-11. ↩

  36. Id., Annex D. ↩

  37. Id. ↩

  38. Minute Resolution dated 03 July 2025. ↩

  39. Id. ↩

  40. Electronic mail received from COMELEC (dpo@comelec.gov.ph) at 4:43pm. ↩

  41. COMELEC Letter dated 19 September 2025. ↩

  42. NPC Circular No. 16-03 or the Personal Data Breach Management dated 15 December 2016, Section 11. ↩

  43. NPC BN 18-106, In re: Klook Travel Technology Limited, 08 May 2025, at p.11. ↩

  44. Republic Act No. 10173 also known as Data Privacy Act of 2012, Section 3 (l). ↩

  45. NPC Circular No. 16-03 dated 15 December 2016 or the Personal Data Breach Management. ↩

  46. Full Breach Report dated 30 May 2022, Memorandum dated 25 May 2022. ↩

  47. Id. ↩

  48. NPC BN 20-170, In re: TravelPeople Ltd., Inc, 21 September 2020. ↩

  49. Full Breach Report dated 30 May 2022, Affidavit of CHT dated 30 May 2016. ↩

  50. Id., Memorandum dated 25 May 2022, at p. 2. ↩

  51. Blotter Certification dated 27 July 2018. ↩

  52. Id., Memorandum dated 25 May 2022. ↩

  53. NPC BN 17-028 and NPCBN 18-180, In re: Easytrip Services Corporation, 11 May 2023 at p. 8. ↩

  54. Letter from COMELEC dated 13 September 2023 in compliance with the Order dated 10 August 2023. ↩

  55. Id., Annex B. ↩

  56. Id., Annexes C-1 to C12. ↩

  57. Memorandum dated 17 August 2023, Annex J. ↩

  58. Id., Annex K. ↩

  59. Id., Annex L. ↩

  60. Id., Annex M. ↩

  61. Id., Annex O. ↩

  62. Id., Annex R. ↩

  63. Id., Annex S. ↩

  64. Id., Annex P. ↩

  65. Id., Annex Q. ↩

Backlinks

  • No backlinks found