Privacy commission warns vs processing, sharing leaked PhilHealth data

MANILA, Philippines — The National Privacy Commission warned individuals engaged in processing and disseminating leaked personal data from the Philippine Health Insurance Corp. (PhilHealth) that they could face criminal charges.

In a statement Tuesday, the NPC said that personal data exfiltrated from PhilHealth were “being shared illicitly.”

“We want to emphasize the gravity of this situation and the severe consequences that await anyone involved in processing, downloading, or sharing this data without legitimate purpose or without authorization,” the privacy commission said. 

Under Section 25 of the Data Privacy Act of 2012, individuals found guilty of unauthorized processing of personal information will face imprisonment of up to three years and a fine between P500,000 and P2 million. 

Meanwhile, unauthorized processing of sensitive personal personal information carries even graver penalties: imprisonment for three to six years and a fine ranging from a fine ranging from P500,000 to P4 million. 

“Sharing such leaked data exposes affected individuals to a range of risks, including identity theft, fraud, extortion, blackmail, and other malicious activities,” NPC said. 

The commission urged the public to report the presence of leaked data to authorities, including the NPC and law enforcement agencies.

It also called on personal information controllers and processors to strengthen their data protection measures.

The NPC earlier revealed that a “staggering” amount of files equivalent to around 734 gigabytes of data had been leaked from PhilHealth, including personal and sensitive information. 

The commission launched a proble to ascertain the scope of the breach and identify the responsible officials.

PhilHealth earlier advised the public to take precautionary measures against fraudulent activities, such as changing the passwords of their online accounts and enabling multi-factor authentication. 

According to the state health insurer, the ransomware only affected application servers and the workstations of employees.