WSG Article: Philippines: NPC Warns the Public Against Smishing

Philippines: NPC Warns the Public Against Smishing

October, 2021 - Segolene Leffy

The National Privacy Commission (“NPC”) issued on 7 October 2021 NPC PHE Bulletin No. 21 advising the public against smishing and preventive data privacy practices.

Smishing targets victims through mobile text messaging or SMS. Individuals usually receive unsolicited messages that include links that redirect to fraudulent websites which steal personal data, introduce mobile malware, and even facilitate the commission of fraud. This advisory comes after the NPC received reports of smishing allegedly from filling out COVID-19 contact tracing and health declaration forms.

NPC Commissioner Raymond Liboro reminds the public to continuously be vigilant against cyberattacks by not being complacent from text messages that the public receives.

NPC PHE Bulletin No. 21 recognizes that this concern is addressed by data subjects (individuals) and personal information controllers (legal entities) mutually exercising good data privacy practices.

Data Subjects are advised not to click links from services they did not sign up for and exercise caution from clicking shortened links (i.e. tinyurl, bit.ly, etc.). These malicious links usually require data subjects to share personal and financial information. Therefore, all individuals should block and report the unsolicited text messages they receive using the built-in spam feature in their SMS apps.

Companies are likewise reminded to protect and apply security controls on their database of personal information collected either physically or electronically. More specifically, companies should make sure that health declaration forms or log sheets are not in a matrix form where data subjects can see the personal information of each other.

Companies may refer to NPC Advisory No. 2020-03: Guidelines for Workplaces and Establishments processing Personal Data for COVID-19 Response for further guidance.

The information provided here is for information purposes only, and is not intended to constitute legal advice. Legal advice should be obtained from qualified legal counsel for all specific situations.