The National Privacy Commission (NPC) is assessing data breach reports from 10 government agencies, including the Bureau of Internal Revenue (BIR) and Securities and Exchange Commission (SEC), as it examines the potential risks to individuals whose personal information may have been compromised.
As of November 10, the agencies that notified the commission were the Presidential Commission on Good Government; Department of Information and Communications Technology; Department of Labor and Employment, through its Bureau of Local Employment; BIR; Philippine Amusement and Gaming Corp.; Department of Justice, through its Office for Alternative Dispute Resolution; SEC; Philippine Coast Guard; Department of Trade and Industry; and DOST-Philippine Institute of Volcanology and Seismology.
The NPC has yet to disclose how many individuals were affected, what types of personal information were involved, or whether the incidents were related.
Deputy Privacy Commissioner and spokesperson Jose Belarmino II said each notification is being reviewed to establish the circumstances surrounding the breach, assess potential harm, and evaluate the agency’s response. Findings and recommendations will be submitted to the commission en banc for appropriate action.
Belarmino stressed that notifying the NPC is only one part of an agency’s obligations under the Data Privacy Act. Government offices must also contain breaches, fix security vulnerabilities, mitigate potential harm, and inform affected individuals when required.
The commission also emphasized that agencies remain accountable for personal information under their control even when data processing is outsourced to third-party service providers.
Beyond the reported incidents, the NPC warned of possible follow-on threats, including phishing, fraudulent messages, and identity theft that could exploit public concern over government data security.
It urged the public to be wary of unsolicited communications, unfamiliar links and attachments, and requests for personal information, particularly those claiming to provide updates or assistance related to the reported breaches.
