The National Privacy Commission (NPC) explained that the reports of alleged data breaches do not necessarily equate to its occurrence nor an automatic violation of the Data Privacy Act of 2012, following numerous reports of data breaches of government agencies from a cybersecurity advocacy group since yesterday.
NPC Spokesperson Jose Belarmino II said in a press release on Nov. 6 that the Commission has not received data breach notification from any government agencies and added that concerned agencies are required to report a data breach upon confirmation that an incident meets the requirements for a notification.
“Under NPC Circular No. 16-03, personal information controllers (PICs) are required to notify the Commission and affected data subjects within 72 hours upon knowledge of, or reasonable belief that, a personal data breach requiring mandatory notification has occurred,” the document wrote.
According to the same circular, the reasons that PICs –which in this case are the government agencies – would be mandated to notify the NPC are when the data obtained includes personal information that could enable identity fraud; there is a reasonable belief that an unauthorized person obtained the data; and the affected data subjects from the breach are at serious risk of harm.
Other reasons PICs should consider notifying the NPC are when the leaked information would likely affect national security, public safety, public order, or public health; when at least 100 individuals were affected by the breach; the information acquired is required by applicable laws or rules to be confidential; or personal data of vulnerable groups were obtained.
The press release came after cybersecurity advocacy group Deep Web Konek reported alleged data breaches of numerous government and private institutions that started on Nov. 5, with no less than 11 reports concerning government institutions as of Friday, Nov. 6.
READ: Gov’t institutions named in Nov. 5 data breach claims
According to Deep Web Konek, the series of leaks and defacements may be attributed to the annual Million Mask March or “Operation Vendetta,” a worldwide hacking protest held on Nov. 5 originally attributed to hacking group “Anonymous.”
