Government agencies, schools summoned over data breach

MANILA, Philippines — The National Privacy Commission (NPC) has summoned officials of seven government agencies and academic institutions over their failure to report website attacks that compromised the personal data of some 2,000 Filipinos.

Privacy commissioner Raymund Liboro yesterday said they have issued notices to the management of Bulacan province, the Philippine Carabao Center, the Taguig City University, Republic Central Colleges, Laguna State Polytechnic University and the Department of Education in Bacoor, Cavite and Calamba, Laguna over the breach in their websites last April 1.

The NPC asked the officials to explain why they failed to inform the privacy body about the data subjects of the breach, which resulted in the release of personal data of around 2,000 individual data subjects online.

“Personal information controllers are required to employ organizational, technical, and physical measures to protect personal data,” Liboro said. 

“This includes the duty to inform data subjects and this Commission if there is a serious data breach,” he added.

Under the Data Privacy Law of 2012, agencies and organizations that handle sensitive personal information of the public are required to inform the NPC and the data subjects of an incident of data breach within 72 hours.

The NPC said the seven agencies and academic institutions covered by their summons have not filed a report almost a month after their respective databases were exposed to hackers.

The agency said their digital investigators determined that each of the exposed databases contained sensitive personal information or information that could be used to perpetuate identity fraud.

It noted that the exposure of the data raises a real risk of serious harm to the affected data subjects.

In its initial estimate, the NPC said the combined number of exposed records in the breach reached at least 2,000 individual data subjects, exposing their names, addresses, phone numbers, email addresses and in some cases passwords and school details.