NPC probing reports of alleged gov’t data leaks

Raphael Reyes/Rappler

The National Privacy Commission is coordinating with various agencies to verify the alleged incidents and determine if personal data were compromised before requiring data breach notifications

AT A GLANCE

• The National Privacy Commission is investigating reports of data leaks from various government agencies.
• The NPC will coordinate with the identified agencies to verify incidents and determine if personal data has been compromised.
• Reports of data leaks alone do not confirm a personal data breach, and agencies are required to notify the NPC within 72 hours if they believe a breach has occurred.

This is AI-generated. Read the article for full context. Report any errors.

MANILA, Philippines – The National Privacy Commission (NPC) said it was aware of reports of data leaks of various government agencies, but was coordinating with the government agencies themselves to verify the reports before requiring data breach notification submissions to be sent.

In a statement on Friday, November 6, NPC spokesperson and Deputy Privacy Commissioner Jose Belarmino II said “the Commission has not received personal data breach notifications from the concerned government agencies in relation to the reported incidents.”

The NPC said it will coordinate directly with any identified government agencies to “verify the alleged incidents, ascertain the circumstances surrounding them, and determine whether personal data have been compromised.”

“Where warranted, the Commission will require the concerned agencies to submit the necessary reports and comply with their obligations under the Data Privacy Act of 2012 and applicable NPC issuances,” the NPC added.

Agencies reportedly hacked

Cybersecurity monitoring group Deep Web Konek and the civic action group BetterGov.PH listed the following government organizations and systems as among those reportedly being hacked or having data leaked:

• Department of Information and Communications Technology
• Presidential Commission on Good Government
• Vice President’s scheduling system
• Department of Labor and Employment Public Employment Service Office
• Philippine Air Force’s clearance system
• Bataan’s internal government website

Also reportedly affected were a number of other systems, such as Eastern Visayas State University, as well as nongovernment entities such as the Philippine Nurses Association, Alliance Graduate School, and Luzviminda Construction and Development Corporation.

The reports coincide with the November 5 Million Mask March event, a worldwide day of protest against political corruption and other issues that is commonly preceded by cybersecurity incidents like data leaks, hacks, and website defacements.

The NPC added in its statement that “reports of alleged data leaks do not, by themselves, establish that a personal data breach has occurred or that the provisions of the Data Privacy Act of 2012 have been violated.”

That said, the NPC’s Circular No. 16-03 requires personal information controllers to notify the commission and affected data subjects within 72 hours when there is knowledge of or reasonable belief that a personal data breach requiring notifications of this sort has occurred. – Rappler.com