The National Privacy Commission (NPC) will verify reports of data leaks involving Philippine government agencies to find out what happened and whether personal information was exposed. The reports surfaced on Nov. 5.
As of Nov. 6, the agencies involved had not submitted personal data breach notifications to the NPC, according to Atty. Jose Belarmino II, spokesperson and deputy privacy commissioner, NPC. These notifications formally inform the commission of a breach involving personal information.
“The Commission will coordinate directly with the government agencies identified in these reports to verify the alleged incidents, ascertain the circumstances surrounding them, and determine whether personal data have been compromised,” the NPC said in a media statement sent on Nov. 6.
The commission said it would ask agencies to submit reports when needed. It will review each incident to determine whether personal information was exposed and whether any rules under the Data Privacy Act of 2012 were broken.
The NPC stressed that reports of data leaks alone do not prove that a breach happened or that the law was violated. Each claim must first be checked.
Under NPC Circular No. 16-03, organizations responsible for personal information must inform the commission and affected people within 72 hours of learning of, or having reasonable grounds to believe, that a breach requiring notification has occurred.
The NPC said this requirement would apply if the reported incidents are confirmed and meet the conditions for mandatory reporting.
The statement came after online claims involving several government systems. A Philippine News Agency report cited claims involving the Department of Transportation’s Human Resource Information System, which holds employee records, and information linked to the Philippine Coast Guard.
The claimed transportation department leak reportedly involved about 4,534 employees. The information allegedly included employee details, salary records, attendance logs, account information, biometric identifiers, and code used to build the application.
The separate Coast Guard claim involved personnel information, rescue records, photographs, and location data. Cybersecurity advocacy group Deep Web Konek documented both claims, according to the report.
Neither claim had been independently verified. Neither agency had confirmed that the information being offered online came from its systems, the report said.
The commission said it would continue checking developments and take action when needed to protect personal information and people’s rights. It will release further details as they become available.