NPC sounds alarm as 10 gov’t agencies report leaks
MANILA, Philippines – The National Privacy Commission (NPC) announced on Tuesday, November 10, that 10 government agencies had submitted breach notifications following reports of potential data leaks.
In a statement released on Tuesday, the NPC confirmed receiving personal data breach notifications from the following offices:
- Presidential Commission on Good Government
- Department of Information and Communications Technology (DICT)
- Department of Labor and Employment, through its Bureau of Local Employment
- Bureau of Internal Revenue (BIR)
- Philippine Amusement and Gaming Corporation
- Department of Justice, through its Office for Alternative Dispute Resolution
- Securities and Exchange Commission (SEC)
- Philippine Coast Guard
- Department of Trade and Industry
- Department of Science and Technology-Philippine Institute of Volcanology and Seismology
NPC spokesperson and Deputy Privacy Commissioner Jose Belarmino II said the notifications comply with Republic Act No. 10173 or the Data Privacy Act of 2012, and NPC Circular 16-03.
“Each notification received by the NPC is reviewed and assessed by our Compliance and Monitoring Division, which examines the nature and circumstances of the reported incident…. Following its assessment, the Division prepares a report containing its findings and recommendations for submission to the Commission En Banc,” Belarmino explained.
The announcement comes a week after the commission said it was coordinating with government agencies to verify reports of suspected government data leaks.
Citizens notified of breach
Under Section 20 of the Data Privacy Act, personal information controllers like government agencies are required to “promptly inform” the NPC and affected individuals if any sensitive personal data has been compromised.
The SEC notified users of its online platforms on Monday, November 9. In an email notice sent to registered users, the commission attributed the leak to “malware infection or unauthorized access by a third-party threat actor” targeting users’ devices.
The SEC warned users that exposed records may have included their full names, usernames, email addresses, mobile numbers, birth dates, genders, addresses, and Taxpayer Identification Numbers. But it maintained that “no data was altered, no internal corporate record was involved, and no passwords” were exposed.
According to a statement, the commission detected the breach on November 6 and reported it to the NPC three days later on November 9.
The BIR also issued an advisory on November 9 stating that it was addressing potential breaches in coordination with the Cybercrime Investigation and Coordinating Center and the DICT-National Computer Emergency Response Team.
Both the SEC and BIR expressed that they had taken security measures after the cybersecurity breaches.
As of this posting, the other eight government agencies have yet to release official statements about the reported data leaks.
Government agencies remain liable
Section 21 of the Data Privacy Act holds personal information controllers accountable for personal information under their custody, including records processed by third parties.
Belarmino emphasized that submitting a breach notification does not exempt government agencies from their responsibility in protecting personal data.
“The NPC expects government agencies to demonstrate accountability not merely through compliance with notification requirements, but through concrete and effective measures to safeguard personal data and prevent similar incidents from recurring,” he said.
The NPC added that it continues to monitor the reported security incidents across several government agencies and urged the public to stay alert against potential security threats. – Rappler.com
