The Securities and Exchange Commission (SEC) faces possible regulatory action over a reported data security incident as the National Privacy Commission (NPC) reviews the corporate regulator’s response and measures to protect potentially exposed personal information.
The NPC confirmed on Tuesday that the SEC was among several government agencies that submitted personal data breach notifications, prompting assessments to determine the extent of the incidents, their impact on affected individuals, and whether adequate safeguards were implemented.
NPC Deputy Privacy Commissioner and spokesperson Jose S. Belarmino II said the submission of breach notifications is a regulatory requirement under the Data Privacy Act of 2012, but stressed that agencies must also demonstrate accountability in addressing security vulnerabilities.
Breach notification is only one part
“Breach notification is only one part of an agency’s responsibility under the Data Privacy Act. Equally important is how the agency responds to the incident, protects the individuals who may be affected, and addresses the vulnerabilities that may have contributed to the breach,” Belarmino said.
He said the NPC’s Compliance and Monitoring Division is reviewing each reported incident, including its nature, potential impact, and the corrective measures undertaken by the agency concerned.
The division will submit its findings and recommendations to the Commission En Banc, which will determine the appropriate regulatory response based on the circumstances of each case.
The NPC has not announced any sanctions against the SEC.
The regulatory review follows the SEC’s disclosure
The regulatory review follows the SEC’s disclosure that it detected a data security incident on November 6, prompting a comprehensive investigation and system-wide audit of its digital platforms and databases.
The SEC maintained that initial findings showed no company records were affected, no passwords were leaked, and no information was modified or altered.
However, the corporate regulator acknowledged that individual profile information may have been exposed, with the origin, scope and validity of the affected records still under verification.
The SEC said it immediately implemented containment measures,
The SEC said it immediately implemented containment measures, including digital forensic examinations, security scans, access control enhancements and additional monitoring across its systems.
Aside from the SEC, the NPC received breach notifications from the Department of Information and Communications Technology, Bureau of Internal Revenue, Department of Trade and Industry, Department of Justice, Philippine Coast Guard, Presidential Commission on Good Government, Philippine Amusement and Gaming Corporation, Department of Labor and Employment through its Bureau of Local Employment, and the Philippine Institute of Volcanology and Seismology.
Belarmino noted that government agencies remain responsible for protecting personal information even when data processing is out
The NPC expects government agencies to demonstrate accountability
“The NPC expects government agencies to demonstrate accountability not merely through compliance with notification requirements, but through concrete and effective measures to safeguard personal data and prevent similar incidents from recurring,” he said.
Under the Data Privacy Act, government agencies must maintain appropriate organizational, physical and technical security measures to protect personal information under their control.
The NPC also warned the public against phishing attempts, fraudulent messages and identity theft that could exploit concerns surrounding the reported breaches.
