You are on page 1of 2

ORDER

In re: Wendy's
CIDBN no. 18-058
Page 2 of 2
x---------------------------------x

To facilitate the investigation, the Complaints and Investigations Division
also required Wendy's to provide further documentary evidence on earlier
attempts at implementing stronger data protection measures.

WHEREFORE, PREMISES CONSIDERED, this Commission hereby
ORDERS Wenphil Corporation to:

1. NOTIFY all affected data subjects with exposed sensitive personal
information or information that can be used to enable identity fraud,
pursuant to the requirements contained within NPC Circular No. 16-03
within 72 hours from the issuance of this Order;

2. EXPLAIN to this Commission why further action should not be taken
against Wenphil Corporation for their failure to notify the affected data
subjects within the proper period required in NPC Circular No. 16-03.

3. PROVIDE a copy of Server Logs, Network Logs, and Traffic Logs of the
https://wend\'s.com.ph website prior to the breach;

4. SUBMIT the updated version of the applicable Privacy Policy in force
at the time of the data breach, an update of the internal investigation
conducted, and the policy on transaction procedures, and any and all
prior recommendations for information security measures that were not
implemented.

5. CONDUCT a new Privacy Impact Assessment, taking into account the
vulnerabilities exposed in this latest data breach.

SO ORDERED.

2 May 2018, Pasay City, Metro Manila.

For the Commission:

(Sgd.) FRANCIS EUSTON R. ACERO
Division Chief
Complaints and Investigations Division