Transport network vehicle service provider Uber may face administrative and criminal liabilities for data breach concealment, the National Privacy Commission said Tuesday.
NPC commissioner Raymund Liboro asked Uber Philippines its full cooperation to probe the data breach case involving Filipino users.
“Under the Privacy Law, the minimum penalty for concealment of breach is about 1 1/2 to 5 years imprisonment and at least P1 million in fine,” Liboro said in news a briefing Tuesday.
Uber kept its data breach case for a year before coming out in the open, saying the breach involved several nationalities including Filipinos.
Despite the ongoing investigation, Uber failed to release more information about the 2016 breach incident that affected 600,000 drivers in the US and some personal information of 57 million Uber users around the world.
The information included names, email-addresses and mobile phone numbers.
“Unfortunately, Uber failed to provide the level of detail that we expect from personal information controllers about data breach notifications, such as the actual number of Filipinos affected and the scope of their exposure,” the commission said.
The commission said it had jurisdiction over the data breach, if the incident involved Filipino citizens.
The Philippines is coordinating with the US, Australia and Singapore for data exchange involving the breach.
Cases similar to Uber were the main topic in a two-day conference on data policy held at Sofitel Philippine Plaza Hotel in Manila.