Personal data breach reports filed by 10 gov’t agencies

The National Privacy Commission (NPC) said on Tuesday that it received personal data breach notifications from 10 government agencies, raising concerns about information security and safety.

“Breach notification is only one part of an agency’s responsibility under the Data Privacy Act,” NPC deputy privacy commissioner and spokesperson Jose S. Belarmino II said in a statement.

“Equally important is how the agency responds to the incident, protects the individuals who may be affected, and addresses the vulnerabilities that may have contributed to the breach,” he added.

Agencies that submitted breach reports include the Presidential Commission on Good Government (PCGG), the Department of Information and Communications Technology (DICT), the Department of Labor and Employment (DOLE), the Bureau of Internal Revenue (BIR), and the Philippine Amusement and Gaming Corporation (PAGCOR).

The Department of Justice (DOJ), Securities and Exchange Commission (SEC), Philippine Coast Guard (PCG), Department of Trade and Industry (DTI), and the Department of Science and Technology-Philippine Institute of Volcanology and Seismology (DOST-PHIVOLCS) also flagged similar incidents.

Personal data breach reports from the agencies are essential in the regulatory framework established under the Data Privacy Act of 2012.

Mr. Belarmino said that the breach notifications will be reviewed and assessed by its Compliance and Monitoring Division to determine the nature and circumstances of the case.

NPC will also assess the incident’s potential impact on affected individuals and recommend appropriate measures for the involved agencies.

Agencies are likewise expected to uphold appropriate organizational, physical, and technical security measures to safeguard personal data, in accordance with the Data Privacy Act of 2012.

“The NPC expects government agencies to demonstrate accountability not merely through compliance with notification requirements, but through concrete and effective measures to safeguard personal data and prevent similar incidents from recurring,” Mr. Belarmino said.

While the commission has yet to disclose other details surrounding the breaches, a separate report from advocacy group Deep Web Konek claimed that 23 government agencies, educational institutions, and private organizations have an alleged cybersecurity threat between Nov. 5 and 7.

The group said that the incidents involve data exposures, which may include personal records, taxpayer and corporate documentation, government administrative files, personnel and payroll records, academic information, technical documentation and potentially sensitive institutional materials. — Almira Louise S. Martinez