The National Privacy Commission (NPC) is taking down the website lisensya.info which is feared to have exposed the personal information of millions of motorists registered with the Land Transportation Office (LTO).
Even while NPC is conducting a probe, the agency said it was set to take down the website yesterday, at the latest today after the LTO denied any connection with the “ questionable website.”
The Commission is processing the cease and desist order against the website after due process.
The website provided a “Motor Vehicle Authenticator” which, through the mere input of the motor vehicle file number by anyone, would show sensitive information, such as the make, plate number, engine number, chassis number, registration expiry date, and name of the owner.
A total of 12.725 million vehicles were registered with the LTO in 2019.
“The NPC shall verify the incident and look into the extent of possible harm on LTO’s data subjects to determine how to best resolve the situation,” privacy commissioner Raymund Liboro said.
“NPC is coordinating with the Data Protection Officer (DPO) of the LTO for us to be provided with more details of the incident,” he added, noting the DPO of the agency has just filed its initial breach notification report with the NPC on Nov. 10, 2020.
Last week, the LTO issued a statement assailing lisensya.info for using the LTO logo on its website to establish a false connection with the agency.
But netizens claimed the data the site provided were accurate, raising suspicions of a leak in LTO’s database as these are the types of information the LTO collects from motorists for registration.
Based on results of NPC’s initial investigation, lisenysa.info has neither a privacy notice nor any contact details of its owner.
NPC said LTO will be required to inform their data subjects regarding the possible breach, unless they request for an exemption or delay of notification, subject to approval of the Commission.
NPC can temporarily block access to the website, subject to proper procedure.
NPC advised the public not to disclose their personal data to said suspicious website.
