Legal watchdog dares Comelec to name people behind data breach

Human rights legal group CenterLaw Philippines on Monday demanded that the Commission on Elections (Comelec) name within 24 hours the people responsible for allowing the leak of the personal information of some 55 million registered voters.

“Credible information technology (IT) security and news websites, such as TrendMicro and Wired.com, have reported that voters' data—ranging from birthdates to passport numbers and even fingerprints—has been dumped into the internet, compromising the security of millions of Filipino voters,” the demand letter said.

Atty. Romel Bagares, executive director of CenterLaw Philippines, cited Republic Act 10173 or the Data Privacy Act of 2012 requiring the Comelec to notify the Data Privacy Commission on the nature of the leak and the actions taken.

Under Section 20 (f) of the law, Comelec “has the legal obligation to notify the Data Provacy Commission and affected data subjects. The notice shall at least describe the nature of the break, the sensitive personal information possibly involved, and the measures taken by the entity to address the breach.”

Section 21 (b), meanwhile, obligates Comelec “to designate who are the officials accountable for its compliance with the provisions” of the law.

Centerlaw, writing in behalf of its client Dr. Jose Ramon Albert, said it is holding Comelec Chairman Andres Bautista accountable for the information leak dubbed as “Comeleak” since he heads the constitutional body.

Bagares said, under Section 30 of the Data Privacy Act, Comelec can face penalties ranging from one year and six months to five years imprisonment and a fine of no less than P500,000 to a maximum of P1 million.

“Given the urgency of the matter—considering that as it has been nearly a month since the massive breach happened—we ask the Comelec to take immediate steps to do so, within 24 hours from receipt of this letter,” the demand letter said. — TJD, GMA News