777JILI Data Breach: What a Company Must Tell You and When

A data breach is the event that turns the personal information you typed into a sign-up form into someone else’s property. The rules for it sit in NPC Circular 16-03, dated 15 December 2016, which the National Privacy Commission issued under RA 10173. What counts as personal information in the first place decides whether the circular reaches a leak at all.

What the circular calls a personal data breach

NPC Circular 16-03 §3(F) defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data. It sorts breaches into three kinds, and the table puts a plain example beside each.

When the controller must tell you

Section 11 makes notification required on knowledge or reasonable belief that a breach has occurred, under three conditions together. The data involves sensitive personal information or other information usable for identity fraud; there is reason to believe an unauthorized person acquired it; and the controller or the Commission believes a real risk of serious harm to the data subject is likely. The circular names “usernames, passwords and other login data”, biometric data and copies of identification documents as examples of the other information.

Section 17(A) gives the Commission seventy-two (72) hours, and §18(A) gives data subjects the same seventy-two (72) hours. RA 10173 §20(f) is the statute behind both, and §30 punishes concealment with imprisonment of one year and six months to five years and a fine of not less than Php500,000 but not more than Php1,000,000.

The six items a notice must carry

Section 18(C) lists what the notification to you includes, and the numbers below follow its order. Use them as a checklist when a message arrives.

1. The nature of the breach.
2. The personal data possibly involved.
3. The measures taken to address the breach.
4. The measures taken to reduce the harm or negative consequences.
5. A representative of the controller, with contact details, from whom you can get more information.
6. Any assistance to be provided to affected data subjects.

Section 18(D) adds that notification is to be done individually, using secure means of communication, and that the controller takes steps to ensure the proper identity of the person being notified. The circular allows the details to arrive in phases without undue delay.

Your first hour

The circular tells the controller what to send and is silent on what you do, so these steps are reading habits drawn from the six items, not legal advice.

1. Open the message from the address you already know for that service, not from a link inside the message. NPC Bulletin No. 21 says not to click links of services you did not sign up for.
2. Match the message against the six items and write down which are missing.
3. Take a screenshot with the time showing, so you hold your own record of when the message reached you.
4. If it says login data was involved, change that password on the service and on any other place you reused it.
5. Save the contact person named under item 5 and write to them in plain words.

If the notice never comes or says too little

Section 20 of Circular 16-03 says failure to notify is presumed if the Commission receives no notification within five (5) days from knowledge or reasonable belief of the breach. For a complaint, the NPC’s 2021 Rules of Procedure ask you to inform the entity in writing first. Work through these in order:

1. Reread the privacy notice items you were given at sign-up, which show what was supposed to be stored and for how long.
2. Reread the consent form checks for what you agreed to share.
3. Write to the entity and wait fifteen (15) calendar days, the period in the NPC’s 2021 Rules of Procedure, Rule II §2.
4. Prepare a complaint if there is still no response; the NPC may waive the wait for a serious breach.