Miss Earth organizer asked to explain data breach

THE National Privacy Commission (NPC) has demanded an explanation from a beauty pageant organizer with regard to the supposed data breach that led to the alleged sexual harassment of three contestants.

The NPC on Tuesday, November 13, sent a letter to Carousel Productions Incorporated, the organizer of Miss Earth, requiring the latter to explain within five days the reported disclosure of the mobile phone numbers of beauty contestants "without consent."

According to the NPC data, Carousel Productions failed to provide record of its Data Protection Officer (DPO) and details of its data processing system.

The NPC said failure to submit such records demonstrated the beauty pageant organizer's "potential non-compliance with the Data Privacy Act" and "possible negligence in adhering to data protection standards set by the commission."

"When personal data is not safeguarded properly, problems would definitely arise and oftentimes escalate out of proportion," Privacy Commissioner Raymund Enriquez Liboro said in a statement.

"And the first step in doing that is to appoint a DPO, as required by law. Every organization has to have someone whose job it is to ensure that the personal information they have been entrusted with remains private and safe from potential misuse," he added.

The NPC's statement came after at least three Miss Earth candidates -- Jaime Vandenberg of Canada, Abbey-Anne Gyles-Brown of England, and Emma Mae Sheedy of Guam -- accused Amado Cruz of sexual harrassment.

Cruz, who has been supporting several pageants through sponsorship since 2000, denied the accusations.

In a letter dated November 11 and addressed to Carousel Productions president Ramon Monzon and executive vice president Lorraine Schuck, the beauty pageant organizer was informed that the legality of its data processing was being reviewed by the NPC.

The NPC noted that the Carousel Productions's records did not appear in the state privacy watchdog's database of registered personal information controllers, and did not have a data protection officer registered with the Commission.

"The compliance of Carousel Productions Inc., as the personal information controller, to Philippine law is not apparent to this Commission," the letter read.

"It is unclear, for instance, if the contestants have consented to the collection of their personal information; whether they have been specifically and adequately informed how said information is processed, including to whom said information will be shared and for what purpose," it added.

To put an end to the controversy, the NPC asked the Carousel Productions to provide the name of its DPO and its registration details from the state privacy watchdog.

The NPC also sought the organizer's explanation of its process surrounding its processing of the data of the contestants’ passports.

It also asked the Carousel Productions to submit a copy of its privacy management program and existing policies and procedures for the collection, use, access, disclosure, storage and disposal of personal data, including organizational, physical and technical security measures.

"Provide the following to this Commission within five days from receipt," the NPC told the Carousel Productions. (SunStar Philippines)