Order Text
IN RE: THE MANUFACTURERS LIFE INSURANCE CO. (PHILS), INC. CID BN 19-097
x----------------------------------------------------x
ORDER
On 23 January 2020, the Commission issued a Resolution containing the following dispositive portion:
WHEREFORE, all premises considered, the Request for Reconsideration of the Resolution dated 6 September 2019 is hereby DENIED and Manulife is hereby ordered to NOTIFY the data subjects without further delay. Manulife shall SUBMIT an Affidavit of Compliance including details of notification and assistance provided to data subjects, to be submitted within fifteen (15) days from receipt of this Resolution.
On 13 March 2020, they submitted a sworn Affidavit of Compliance from their Chief Operations Officer, stating the following:
I certify that on 13 March 2020, the Corporation completed the preparation of the Notification Letters and have delivered such letters to the messengerial personnel of the Corporation for mailing to the data subjects affected by CID BN 19-097. A copy of the letter is attached herewith as Annex “A”.
I further certify that as stated in the Notification Letter, the Corporation reviewed the data subjects/affected clients’ policy transactions to identify any possible instance of fraud or account takeover. This was done as the Client List inadvertently disclosed contains policy information only.
Based on the Corporation’s review, there appears to be no suspicious activity that has taken place involving the data subjects/affected clients’ policies. Nevertheless, the Corporation continues to regularly monitor the said policies as part of its assistance to the data subjects/affected clients.
In addition, follow-up inquiries or request for additional information by the data subjects/affected clients are actively responded to by the Corporation. xxx
On 3 April 2020, the Enforcement Division issued its findings on the compliance report. Its assessment stated thus:
Upon reviewing the Compliance Report and Affidavit of Compliance submitted by Manulife on 13 March 2020, as well as its breach notification report submitted on 13 June 2019, we found that the measures undertaken by Manulife Phils. comply with R.A. 10173 or the Data Privacy Act, its Implementing Rules and Regulations, and NPC Circular 16-03 on Personal Data Breach Management.
The affidavit of compliance contained a certification as to the notification of affected data subjects as well as assistance provided to them. Moreover, Manulife implemented several measures subsequent to the breach. xxx
WHEREFORE, all premises considered, the Commission resolves that the matter of CID BN 19-097 (“In Re: The Manufacturers Life Insurance Co. (Phils), Inc.”) be considered CLOSED.
SO ORDERED.
Pasay City, 18 June 2020.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY DU NAGA Deputy Privacy Commissioner
Copy furnished:
JFJ Data Protection Officer Manulife Philippines
ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission