The National Privacy Commission (NPC) confirmed on Tuesday, November 10, that it has received personal data breach notifications from 10 government agencies, prompting an investigation into the reported incidents.
Among the agencies affected by the government data breaches are the Department of Information and Communications Technology (DICT), the Department of Labor and Employment (DOLE) through its Bureau of Local Employment, the Bureau of Internal Revenue (BIR), and the Philippine Amusement and Gaming Corporation (PAGCOR).
The Department of Justice (DOJ), through its Office for Alternative Dispute Resolution, the Securities and Exchange Commission (SEC), the Department of Trade and Industry (DTI), the Department of Science and Technology–Philippine Institute of Volcanology and Seismology (DOST-PHIVOLCS), the Presidential Commission on Good Government (PCGG), and the Philippine Coast Guard (PCG) also reported data security incidents.
The NPC said it has begun assessing and investigating the reported leaks of personal information involving the concerned agencies.
“Each notification received by the NPC is reviewed and assessed by our Compliance and Monitoring Division, which examines the nature and circumstances of the reported incident, its potential impact on affected individuals, and the measures undertaken by the agency concerned,” NPC Deputy Privacy Commissioner and spokesperson Atty. Jose S. Belarmino II said.
Belarmino stressed that while the commission leads efforts to safeguard sensitive personal information, government agencies remain responsible for ensuring the protection of the data under their control.
He added that agencies must take steps to prevent misuse of personal information and protect affected individuals from potential harm arising from data exposure.
The NPC emphasized that government agencies, as personal information controllers, remain accountable for the security of personal data even when processing activities are outsourced or subcontracted to third-party service providers.
The commission said agencies are obligated to implement appropriate organizational, physical, and technical security measures to prevent unauthorized access, disclosure, or misuse of personal information.
Meanwhile, the NPC advised the public to remain vigilant against phishing attempts, scams, identity theft, and other forms of social engineering that may arise following the reported breaches.
The commission also urged individuals to avoid responding to suspicious messages, clicking unfamiliar website links, downloading unverified attachments, or sharing personal and sensitive information with untrusted sources.
The NPC pledged to continue monitoring reported incidents and enforcing compliance with Republic Act No. 10173, or the Data Privacy Act of 2012, to strengthen the protection of personal information across the government sector.