Philippines confirms data breaches involving 10 government agencies

Manila: The Philippines’ National Privacy Commission (NPC) has confirmed reports of personal data breaches involving 10 government agencies, including the Department of Justice (DOJ), the Department of Information and Communications Technology (DICT), and the Bureau of Internal Revenue (BIR).

The confirmation, reported by GMA News on Tuesday, November 10, marks a significant development in investigations into alleged data leaks affecting government institutions.

The NPC said it had received breach notifications from the agencies and was reviewing the circumstances of each incident, including the possible impact on individuals whose information may have been affected.

Which government agencies are involved?

The NPC identified the following agencies:

1. Presidential Commission on Good Government (PCGG)

2. Department of Information and Communications Technology (DICT)

3. Department of Labour and Employment (DOLE), through its Bureau of Local Employment

4. Bureau of Internal Revenue (BIR)

5. Philippine Amusement and Gaming Corporation (PAGCOR)

6. Department of Justice (DOJ), through its Office for Alternative Dispute Resolution

7. Securities and Exchange Commission (SEC)

8. Philippine Coast Guard (PCG)

9. Department of Trade and Industry (DTI)

10. Department of Science and Technology, through the Philippine Institute of Volcanology and Seismology (DOST-PHIVOLCS)

The regulator has not provided a consolidated figure for the number of individuals potentially affected or established whether personal information was stolen or publicly exposed in every incident.

Privacy regulator reviewing incidents

NPC Deputy Privacy Commissioner and spokesperson Jose Belarmino II said government agencies must report qualifying personal data breaches under the Data Privacy Act of 2012.

The Commission’s Compliance and Monitoring Division assesses each notification, examining the incident's circumstances, its possible impact on individuals, and the measures taken by the agency concerned.

The division then prepares findings and recommendations for the Commission En Banc, which determines the appropriate action.

Filing a breach notification does not automatically establish that an agency violated data protection laws.

Earlier investigations into alleged leaks

The latest confirmation follows a series of reports involving possible data exposures at Philippine government institutions.

On November 6, the NPC said it had not received breach notifications relating to the government data-leak allegations then under review.

The regulator said it would coordinate with the agencies concerned to establish whether personal information had been compromised.

The BIR subsequently announced an investigation into allegations that data associated with the tax agency had been leaked.

The bureau said it was working with the DICT and law enforcement authorities while strengthening security measures.

Separately, the Securities and Exchange Commission said on November 9 that it was investigating a security incident detected on November 6 that may have exposed individual profile information.

The SEC said its initial assessment found no evidence that company records or passwords were compromised and that its internal databases remained intact.

What remains unknown?

Authorities have not announced a combined total of affected individuals across the 10 agencies.

The NPC has also not established publicly whether the incidents are connected, what types of personal information may have been compromised in each case, or whether the reported breaches resulted in unlawful disclosure.

Further findings are expected as the regulator completes its assessments.