Lisensya.info, a website involved in a data breach that the Land Transportation Office reported to the National Privacy Commission (NPC), still continues to operate pending some procedural protocols.
NPC said it is still conducting a probe of lisenysa.info to determine possible breach of personal information of LTO-registered motorists but it cannot yet block the site because its team is “following a procedure and guidelines re the blocking.” It added that the website will be taken down today or tomorrow, at the latest.
The LTO Data Protection Officer of the agency filed its initial breach notification report with the NPC Tuesday, November 10, 2020. The NPC also said that a privacy notice is also subject to compliance and does not automatically prompt a stop processing/shutdown.
The site lisensya.info, which claims to be a motor vehicle authenticator, remained accessible while the LTO-run website “lto.net.ph,” which provides the status of the availability of license plates, is down or unavailable. A total of 12.725 million vehicles were registered with the LTO in 2019.
“The NPC shall verify the incident and look into the extent of possible harm on LTO’s data subjects to determine how to best resolve the situation,” Privacy Commissioner Raymund E. Liboro said.
“NPC is coordinating with the Data Protection Officer (DPO) of the LTO for us to be provided with more details of the incident,” he added.
Last week, the LTO issued a statement assailing lisensya.info for using the LTO logo on its website to establish a false connection with the agency.
The questionable website provided a “Motor Vehicle Authenticator” which, through the mere input of the motor vehicle file number by anyone, would show sensitive information, such as the make, plate number, engine number, chassis number, registration expiry date, and name of the owner.
Netizens claimed the data the site provided were accurate, raising suspicions of a leak in LTO’s database as these are the types of information the LTO collects from motorists for registration.
Based on results of NPC’s initial investigation, lisenysa.info has neither a privacy notice nor any contact details of its owner.