5
PRIVACY COMMISSION CHECKS REPORTED GOVERNMENT DATA LEAKS
The National Privacy Commission said on November 6 that it would contact government agencies to verify reports of alleged data leaks that surfaced a day earlier. At the time of its statement, it had received no personal data breach notifications from the agencies concerned.
The commission is checking whether personal information was exposed and whether the agencies must notify affected people. Reports of a leak alone do not establish that a breach occurred or that the Data Privacy Act was violated.
When a breach meets the conditions for mandatory notification, the agency handling the information must notify the commission and affected people within 72 hours of knowing, or reasonably believing, that such a breach occurred. The next questions are which systems were affected, what information was exposed, and who needs to be told.