NPC Issuance Wiki

NPC SS 20-001: In re: Familyhan Credit Corporation (Compliance Noted Order)

Issued Order

Order Text

IN RE: FAMILYHAN CREDIT CORPORATION NPC SS 20-001

x----------------------------------------------------x

ORDER

This refers to the Compliance submitted by Familyhan Credit Corporation (Familyhan) in response to the Order dated 08 April 2021 and the Resolution dated 01 June 2021.

On 08 April 2021, the Commission conducted a Clarificatory Hearing for this case and issued an Order requiring Familyhan to submit the following documents:

  1. The outsourcing agreement or any similar document between Familyhan Credit Corporation and its database service provider, indicating the terms of agreement between Familyhan Credit Corporation relating to the processing of its client-borrowers’ personal data in a database;
  2. Documentation on the policies or the approvals made for the Loan Disbursement Officers’ access to the database prior to the personal data breach;
  3. Documentation on the database’s restricted download or copy-paste functions;
  4. The system activity logs cited by Familyhan Credit Corporation in relation to its investigation of unauthorized activity on its database as well as other documents in its possession pertinent to such investigation;
  5. Documentation on the new policies and security measures implemented after the personal data breach, including but not limited to the policy granting only the General Manager access to the subject database;
  6. Documentation on the communications made by Familyhan Credit Corporation to its database service provider regarding its security measures following the personal data breach;
  7. A status update on the Estafa case against AYA, KHT and CJ;
  8. A copy of the 2020 Audited Financial Statements; and
  9. A copy of the work permit of former employees AYA, KHT and CJ.

On 26 May 2021, Familyhan filed a Motion to Clarify Order relating to the deadline for the submission of its compliance and prayed that the Commission allow it to submit the documents within fifteen (15) days from its receipt of the Order. On 01 June 2021, the Commission issued a Resolution granting Familyhan a non-extendible period of fifteen (15) days from receipt of the Resolution within which to comply with the aforementioned Order.

On 04 June 2021, Familyhan received a copy of the Resolution.1 On 10 June 2021, Familyhan submitted its Compliance with the following attachments:

  1. Annex A: a copy of the “Data Processing Agreement” between Familyhan and MBTech Solutions dated 1 September 2019;
  2. Annex B: a copy of two (2) Memoranda: (1) Memorandum dated 2 July 2020 on the restriction of access to the system database; and (2) Memorandum dated 2 February 2020 on absenteeism, AWOL, Cash Handling, Use of Phone and Unauthorized Data Transfer.
  3. Annex C: a copy of the access logs of the FCC system from 3 March 2020 to 27 July 2020.
  4. Annex D: a copy of a Memorandum dated 19 January 2021 addressed to all loan officers stating that effective 20 January 2021, only the General Manager has login access on the FCC System and that there was a system update where a client can only open an email link once.
  5. Annex E: screenshots of conversations between Familyhan’s General Manager and MBTech discussing how the URL access works and how MBTech’s “EIN.”
  6. Annex F: a copy of the Subpoena to Complainant and Witnesses dated 29 January 2021 as part of the update on the Estafa case against AYA, KHT and CJ.
  7. Annex G: a copy of the Annual Income Tax Return of Familyhan, Statement of Financial Position, and Statement of Comprehensive Income
  8. Annex H: a copy of the certificates of employment of AYA, KHT and CJ.

On 25 June 2021, Familyhan submitted its Financial Statement as an additional document for its Compliance.

Pursuant to Section 1, Rule VIII of NPC Circular No. 21-01,2 the Commission conducted a clarificatory hearing for this case and the parties already complied with the order to submit additional documents. The Commission notes that Familyhan filed a Motion to Lift CDO dated 21 June 2021. However, as the Cease and Desist Order is considered a separate proceeding pursuant to Section 20 of NPC Circular No. 20-02,3 this case is now submitted for resolution.

WHEREFORE, all premises considered, the Commission hereby NOTES the aforementioned submissions of Familyhan Credit Corporation.

This case is now submitted for resolution.

SO ORDERED.

City of Pasay, Philippines. 25 June 2021.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

JOHN HENRY D. NAGA Deputy Privacy Commissioner

Copy furnished:

JRO Counsel Familyhan Credit Corporation

SMA President Familyhan Credit Corporation

RA Vice President Familyhan Credit Corporation

MRO Treasurer Familyhan Credit Corporation

MJR Corporate Secretary Familyhan Credit Corporation

PPM Director Familyhan Credit Corporation

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Compliance (to Resolution dated 1 June 2021) dated 10 June 2021. ↩

  2. Section 1, Rule VIII of NPC Circular No. 21-01 provides: “Section 1. Action on the recommendations of the Investigating Officer. – The Commission shall review the evidence presented, including the Fact-Finding Report and supporting documents. On the basis of the said review, the Commission may: (1) promulgate a Decision; (2) issue interlocutory orders on matters affecting personal data; or (3) order the conduct of a clarificatory hearing or the submission of additional documents, if in its discretion, additional information is needed to make a Decision. No motion for clarificatory hearing shall be entertained. In case the Commission finds that a clarificatory hearing is necessary, the following shall be observed: a. The parties shall be notified of the scheduled clarificatory hearing at least five (5) calendar days before such schedule; b. The Commission may require additional information and/or compel attendance of any person involved in the complaint; c. The parties shall not directly question the individuals called to testify but may submit their questions to the Commission for their consideration; d. The parties may be required to submit their respective memoranda containing their arguments on the facts and issues for resolution.” ↩

  3. Section 20, Rule IV of NPC Circular No. 20-02: “Section 20. Separate Proceedings. - The investigation by the CID or the compliance check or breach handling by the CMD shall be treated as a separate and distinct proceeding from the CDO proceeding.” ↩

Backlinks

  • No backlinks found