Breach, breach, brace for impact!

(Last of 2 parts)
What businesses need to do in a personal data breach

In our story last week, Lui and other Bank X Platinum cardholders have all become victims of a confidentiality breach that led to their being billed for substantial purchases they did not make. As this incident involves the stealing of personal data that caused financial harm, Bank X must notify the victims and the National Privacy Commission (NPC) of the breach.

Bank X is required to inform, in written or electronic form, the NPC within 72 hours from the time it has known, or reasonably believed that the personal data breach has occurred, based on available information. While the NPC does not expect Bank X to know the full extent of the breach at the time of initial notification, Bank X’s notification must at least address questions about the nature, extent, and impact of the breach, the personal data possibly affected, steps taken by Bank X to address the breach, contact details of the person designated by Bank X to provide additional information about the breach, and any assistance provided to Lui and other victims.

Subsequent to the initial notification to the NPC, Bank X needs to fully investigate the personal data breach. At the end of the fact-finding and full investigation, Bank X must submit to the NPC a detailed written report on the circumstances surrounding the personal data breach (including the systems involved and their vulnerabilities that allowed the breach), the effects of the breach, and the remedial actions taken by Bank X.

Affected data are personal data, but there is no real risk of serious harm.

Now what?

Three key factors must be present in a security incident for notification to the NPC (and affected owners of personal data, also known as data subjects) to become mandatory:

• the incident involves sensitive personal information, or any information that may be used to commit identity fraud;

• information may have been acquired by an unauthorized person or group; and

• the incident is likely to cause risk of serious harm to owners of the personal information involved.

What if, in our hypothetical scenario, Bank X’s technology security controls were able to detect and immediately block the hacking activity, such that only the records of Lui and other cardholders’ first name, marital status, age, and hair color information had been stolen?

Now, picture a person with these features: woman, single, 30-something, black-haired, named Lui. Is this our Lui? Maybe, or maybe not.

Although Lui’s gender (woman), marital status (single), and age (30+) are sensitive personal information that should be kept confidential, stealing such information does not automatically result in mandatory notification of the incident to the NPC and affected data subjects. For security incidents involving personal data that are collectively not enough to ascertain the identity of the owner, identity fraud is least likely to happen and the data owner would most likely remain unharmed. However, the initial assessment of the breach’s likelihood to cause harm must be carefully performed, since the need for mandatory notification depends upon it.

For this scenario, Bank X does not need to notify the NPC and the affected data subjects of the breach; however, it may prepare a written report showing aggregated data about the security incident and still comply with what NPC considers sufficient documentation. At the end of the year, Bank X needs to include the incident in an annual report to the NPC. The deadline for the annual security incident report this year is March 31, 2018, even for a personal information controller (PIC) that is exempt from Phase II registration with the NPC. Annual security incident reports should include both successful and unsuccessful security incidents.

Final push for first-time DPA compliance

As owners of personal data, we are not burdened with the requirements of the Data Privacy Act of 2012 (DPA) and its implementing rules and regulations (IRR).

Yet we are not entirely disinterested — the DPA was put into law for our benefit.

By the end of March 2018, Phase II of the registration process and the filing of the first annual security incident report will have been completed. As a final push for the remaining month, let us enjoin our companies to assess the applicability of these two remaining requirements.

As for Lui, if Bank X is able to address the breach management requirements by implementing satisfactory measures to foil another cyberattack, then she may yet find more time to shop with renewed confidence.

Mark Basa is a Managing Consultant, Advisory Services of P&A Grant Thornton. P&A Grant Thornton is one of the leading Audit, Tax, Advisory, and Outsourcing firms in the Philippines, with 21 Partners and over 850 staff members. We’d like to hear from you! Tweet us: @PAGrantThornton, like us on Facebook: P&A Grant Thornton, and email your comments to mark.basa @ph.gt.com or pagrantthornton.marketscomm@ph.gt.com. For more information, visit our Website: www.grantthornton.com.ph.

As published in The Manila Times, dated on 07 March 2018