Ten government agencies have reported personal data breaches to the National Privacy Commission (NPC) as of Nov. 10. These include the Bureau of Internal Revenue (BIR) and the Department of Information and Communications Technology (DICT).
The NPC is checking what happened, how people could be affected, and what the agencies have done in response. Its statement did not disclose the number of people who may be affected or what personal information was involved.
“Breach notification is only one part of an agency’s responsibility under the Data Privacy Act,” said NPC Deputy Privacy Commissioner and Spokesperson Atty. Jose Belarmino II. “Equally important is how the agency responds to the incident, protects the individuals who may be affected, and addresses the vulnerabilities that may have contributed to the breach.”
The agencies that submitted breach reports are:
- Presidential Commission on Good Government (PCGG)
- Department of Information and Communications Technology (DICT)
- Department of Labor and Employment (DOLE), through its Bureau of Local Employment
- Bureau of Internal Revenue (BIR)
- Philippine Amusement and Gaming Corporation (PAGCOR)
- Department of Justice (DOJ), through its Office for Alternative Dispute Resolution
- Securities and Exchange Commission (SEC)
- Philippine Coast Guard (PCG)
- Department of Trade and Industry (DTI)
- Department of Science and Technology – Philippine Institute of Volcanology and Seismology (DOST-PHIVOLCS)
The NPC’s Compliance and Monitoring Division reviews each report and recommends what action to take. The Commission En Banc then decides how to proceed based on the findings.
The NPC said agencies must respond quickly, reduce possible harm to people, and fix security weaknesses to help prevent another breach. They must also inform affected people when required under NPC Circular No. 16-03.
Agencies remain responsible for keeping personal data safe even when they hire outside companies or third-party vendors to handle it. They must ensure that these providers have proper security measures in place, the NPC said.
The commission also warned that scammers may use concerns about the breaches to trick people into sharing personal information. It advised the public to be careful with unexpected messages, unfamiliar links, and attachments.