It seems the Philippine government’s IT infrastructure is having a rough week. As of Nov. 10, the National Privacy Commission confirmed that it has received personal data breach notifications from 10 different government agencies.

If you’ve been wondering why your smartphone might be buzzing with more sketchy text messages than usual, these reported breaches could be a contributing factor. The list of affected departments is a veritable who’s-who of the national bureaucracy, ranging from tax collectors to science institutes.

Here is the full list of agencies currently under the NPC’s scrutiny:

1. Presidential Commission on Good Government (PCGG)
2. Department of Information and Communications Technology (DICT)
3. Department of Labor and Employment (DOLE), specifically its Bureau of Local Employment
4. Bureau of Internal Revenue (BIR)
5. Philippine Amusement and Gaming Corporation (PAGCOR)
6. Department of Justice (DOJ), via its Office for Alternative Dispute Resolution
7. Securities and Exchange Commission (SEC)
8. Philippine Coast Guard (PCG)
9. Department of Trade and Industry (DTI)
10. Department of Science and Technology-Philippine Institute of Volcanology and Seismology (DOST-PHIVOLCS)

Reporting is just the first step

Sending a notice to the privacy watchdog doesn’t instantly get these agencies off the hook. According to NPC Deputy Privacy Commissioner and Spokesperson Atty. Jose S. Belarmino II, submitting these notifications is simply a standard regulatory requirement under the Data Privacy Act of 2012 and NPC Circular No. 16-03. The real work for these departments happens next.

Press statement

The NPC’s Compliance and Monitoring Division is currently reviewing each case to determine exactly what happened, how severely everyday Filipinos may have been affected, and what the agencies are doing to address the situation. From there, the division will forward its findings to the Commission En Banc, which will decide on the appropriate regulatory action based on the circumstances.

One crucial detail in the NPC’s statement is its reminder about accountability. Belarmino stressed that filing a breach notification is only one part of an agency’s legal obligations. Agencies are also expected to protect affected individuals and address the vulnerabilities that led to the breach in the first place to prevent similar incidents from happening again.

SEE ALSO: DepEd scores 172,654 MacBook Neos for teachers at ₱43K each, with 5-year warranty

And for government agencies relying on outside tech help? The NPC isn’t making any exceptions. Under Section 21 of the Data Privacy Act, government agencies remain fully accountable for protecting personal information under their control, even when processing has been outsourced to a third-party service provider. Hiring an external IT firm doesn’t absolve them of their responsibility to implement proper security measures.

What you need to do

While the government works on strengthening its digital defenses and the NPC continues its regulatory proceedings, the commission is urging the public to stay vigilant.

Keep your guard up against phishing attempts, identity theft, and social engineering scams that could take advantage of concerns surrounding these reported breaches. If you receive an unsolicited message asking for sensitive information, exercise extreme caution. Don’t click unfamiliar links, download random attachments, or hand over your personal data without verifying who’s asking for it.

---