NPC Issuance Wiki

NPC BN 18-203: In re: The Hongkong and Shanghai Banking Corporation Limited (HSBC)

Issued Order

Order Text

IN RE: THE HONGKONG AND SHANGHAI BANKING CORPORATION LIMITED (HSBC) NPC BN 18-203

x----------------------------------------------------x

ORDER

Before the Commission is the Post-Breach Report dated 10 May 2022 (Post-Breach Report) submitted by The Hongkong and Shanghai Banking Corporation Limited (HSBC) in compliance with the Order dated 21 April 2022 (Order) of the Commission, through its Complaints and Investigation Division (CID).1

On 20 October 2018, Information Express Service (INFORMEX), HSBC’s third-party courier company, received a report that its messenger had lost the mail packs assigned to him.2 The messenger clarified that the cause was due to the mail packs falling off his bicycle due to the bad weather at that time since he decided to put a raincoat over the bundle of mail packs that he had tied down to his bicycle.3 This was the reason why the messenger did not notice that the bundle of mail packs had already fallen off his bicycle and got lost. The messenger also stated that he “retraced his route to locate the mail packs without success.”4

On 23 October 2018, HSBC alleged that the messenger filed an official report to the Barangay Hall of Maysilo Malabon on the lost mail packs.5

On 26 October 2018, the messenger informed his superiors in INFORMEX regarding the loss of mail packs.6

On 29 October 2018, HSBC indicated that it only became aware of the incident after it had received a notification from INFORMEX.7 Further, HSBC alleged that they required INFORMEX to supply the details and clarification.8

On 31 October 2018, HSBC notified the Commission regarding the said incident.9

In its Initial Report, HSBC claimed that there were forty-eight (48) individual customers affected by the incident.10 The mail packs that were lost involved fifty (50) credit card statements and three (3) collection letters that contained personal information such as customer name and address.11 HSBC stated that they shall inform the credit card holders in “due course”.12

HSBC claims that “it has the necessary controls in place to manage the said risk brought by the incident.”13 Moreover, HSBC asserts that the control measures are in place to prevent “unauthorized use of affected credit card account” and that their contact center is “ready to attend to any concerns” relating to the incident.14

As to the measures HSBC took to address the incident, they claimed the following:

  1. Review of accounts for unusual transactions from the date of the incident and then monitoring for any unusual transaction until credit card gets blocked.
  2. Blocking and replacement of credit card to be done. This shall prevent unauthorized use of credit card and fraud.
  3. Statement and letters to be reprinted and re-dispatched to ensure that HSBC’s service still gets delivered to the affected customers.
  4. HSBC’s contact center was briefed about the matter and was given the names of the affected customer for proper handling.
  5. Vendor was counseled at length to emphasize importance of safekeeping documents containing customer information. Root cause of the incident to be analyzed and process and controls to be enhanced to avoid recurrence.15

On 08 October 2020, the Complaints and Investigation Division (CID) of the National Privacy Commission issued an Order requiring HSBC to submit its Full Breach Report within fifteen (15) days from receipt.16

On 23 October 2020, HSBC submitted its Compliance to the said Order dated 08 October 2020.17 In HSBC’s Compliance, it claimed that “the information in this particular incident is neither Sensitive Personal Information nor necessarily in the nature that can be used to identity fraud.”18 Furthermore, HSBC added that the detailed personal information involved are the following:

Credit Card Statement i. Name; ii. Address; iii. Credit Card Number/Credit Card Account Number; iv. Transaction History; and v. Amount Due, Minimum Required payment, and other related information.

Demand Letter i. Name; ii. Address; iii. Credit Card Number/Credit Card Account Number iv. Amount Due and other related information19

To add, HSBC claimed that its Customer Contact Centre Team already reached out to the affected data subjects via call-outs and Short Messaging Service (SMS) to inform them on the incident.20 HSBC likewise added that the credit cards were blocked and replaced to mitigate the exposure of any unauthorized transactions that may take place.21 Moreover, HSBC declared that it directed the Contact Centre Team to change the set of questions it uses to verify the identity of the affected customers to prevent identity fraud.22

As to the organizational measures, HSBC stated that it required its service providers to train its employees on the proper handling of information consistent with HSBC’s data protection policies.23 Moreover, HSBC added that it designates a “Third Party Engagement Manager (TPEM)” to manage the bank’s relationship with the service providers.24

On 21 April 2022, the CID issued an Order requiring HSBC to submit its Post-Breach Report within fifteen (15) days from receipt.25

On 10 May 2022, HSBC submitted its Post-Breach Report and its corresponding annexes reiterating their previous discussions and measures undertaken.26 HSBC asserted that its notification involved is voluntary and not a mandatory one because the information involved in this is neither sensitive personal information nor necessarily in the nature that be used to enable identity fraud.27 Moreover, HSBC claimed that “the voluntary notification was done to show its good faith, promote transparency and candor and in the spirit of receiving guidance from this Honorable Commission.”28

In addition, in its Post-Breach Report, HSBC claims that:

Considering the nature of the breach involved does not require mandatory notification to the Commission or the data subjects under this Honorable Commission’s Memorandum Circular 16-03, HSBC carried out communication which among others, informed the affected customers that there may be a possible compromise to their credit card and that it would be best to block and replace the card to protect their account.

In any event, security measures have been implemented and applied since the breach was reasonably believed to have occurred including measures that would prevent use of data by any person not authorized to access it. Moreover, measures have taken to ensure the risk of harm to the affected customers will not materialize. As an added precaution, HSBC informed the customer of the recommended option to carry out the blocking and replacement of credit cards to mitigate risk. A copy of the list of the Consolidated Report of the reach-out’s including information on the block and replacement of cards is hereto attached and made an integral part hereof as Annex “2”. Note that only customer opted not to have his/her card undergo block and replacement given the security in place.29

Upon evaluation of HSBC’s Post-Breach Report, the Commission finds that the PIC has not sufficiently complied with NPC Circular No. 16-03 (Personal Data Breach Management).

In HSBC’s Initial Report, they notified the Commission regarding an incident that an employee of their third party courier, INFORMEX, had lost the mail packs assigned to him.30 In addition, HSBC claimed that there were forty-eight (48) data subjects affected by the incident.

Section 11 of NPC Circular No. 16-03 provides the conditions for mandatory breach notification:

SECTION 11. When notification is required. Notification shall be required upon knowledge of or when there is reasonable belief by the personal information controller or personal information processor that a personal data breach requiring notification has occurred, under the following conditions:

A. The personal data involves sensitive personal information or any other information that may be used to enable identity fraud.

For this purpose, “other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.

B. There is reason to believe that the information may have been acquired by an unauthorized person; and

C. The personal information controller or the Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.31

In HSBC’s Full Breach Report, it stated that the lost mail packs contained the following information:

Credit Card Statement i. Name; ii. Address; iii. Credit Card Number/Credit Card Account Number; iv. Transaction History; and v. Amount Due, Minimum Required payment, and other related information.

Demand Letter i. Name; ii. Address; iii. Credit Card Number/Credit Card Account Number iv. Amount Due and other related information32

In this case, the information involved in the Credit Card Statement and Demand Letter particularly, the Credit Card Number/Credit Card Account Number, Transaction History and Amount Due is categorized within the purview of “sensitive personal information and any other information that, under the circumstances, may be used to enable identity fraud”33 provided by Section 11 (a) of NPC Circular 16-03. The credit card number/credit card account number are attributed under “other information” as specified in second paragraph of Section 11 (a), given that it pertains to the financial and economic situation of the data subject.34 To reiterate, the names and addresses coupled with the credit card number and credit card account numbers involved are considered as information that, under the circumstances, may be used to enable identity fraud. Thus, the first requisite is present in this case.

For the second requisite, HSBC stated that the messenger claimed that he “retraced his route to locate the mail packs without success.”35 Since the mail packs were lost along the route and failed to locate the lost mail packs, there is reason to believe that the Credit Card Statements and Demand Letters contained in the said mail packs may have been acquired by an unauthorized person. Moreover, the incident involves an “availability breach” due to the loss of mail packs by the messenger of INFORMEX.36 Under NPC Circular 16-03, there is an availability breach when “the breach resulted from loss, accidental, or unlawful destruction of personal data.”37

Lastly, since the nature of information involved pertains to the financial information and economic situation of the data subject contained in the Credit Card Statement and Demand Letter of forty-eight (48) affected data subjects, the loss of these likely gives rise to a real risk of serious harm to the affected data subjects.

To add, in HSBC’s Post Breach Report, it claimed that “the information in this particular incident is neither Sensitive Personal Information nor necessarily in the nature that can be used to identity fraud.”38 However, this contradicts the actions done by HSBC, particularly, the blocking and replacement of the cards in order for the affected data subjects to protect their accounts. Through these acts it seems that HSBC believes that the incident may lead to identity fraud.

Given the unwarranted exposure to unauthorized persons due to the loss of mail packs in the streets containing the sensitive personal information and other information that, under the circumstances, may enable identity fraud particularly the financial information of the affected data subjects, there is a belief that the incident likely gives rise to a real risk of serious harm to the affected data subjects. Hence, the third requisite is present.

Since all the requirements were satisfied, the incident falls under mandatory notification to the Commission under Section 11 of NPC Circular No. 16-03.

Therefore, it is the obligation of HSBC, as Personal Information Controller (PIC), to immediately notify the affected data subjects in order for them to take necessary precautions or to protect themselves against the possible effects of the breach.39

It must be noted that HSBC averred that its Customer Contact Centre Team already reached out to the affected data subjects via call-outs and Short Messaging Service (SMS) to inform them of the incident.40 However, the notification done by HSBC does not conform with NPC Circular 16-03.

Section 18 (C) and (D) of NPC Circular No. 16-03 states:

Section 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

…

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.41

The incident only involved forty-eight data subjects affected by the loss of the mail packs and the PIC could have attached their individual notification in their submissions.42 In their Post Breach Report, HSBC stated that “A copy of the list of the Consolidated Report of the reach-out’s including information on the block and replacement of cards is hereto attached and made an integral part hereof as Annex ‘2’.”43 However, upon careful review of the submissions of HSBC, the submitted document does not provide for the required contents which must be included in notifying the affected data subjects nor the means in notifying them provided under Circular No. 16-03.

Thus, the Commission, in order to resolve the matter deems it proper that HSBC to notify all the affected data subjects and to submit its proof of notification.

WHEREFORE, premises considered, the Hongkong and Shanghai Banking Corporation Limited (HSBC) is hereby ORDERED to notify the affected data subjects and to submit proof the same within fifteen (15) days from the receipt of this Order directly to the Compliance and Monitoring Division (CMD).

The Commission DIRECTS the Compliance and Monitoring Division (CMD) to issue the appropriate orders necessary to evaluate and monitor the completeness of the Hongkong and Shanghai Banking Corporation Limited (HSBC) data breach notification and assess its breach management pursuant to NPC Circular 16-03 (Personal Data Breach Management).

SO ORDERED.

City of Pasay, Philippines. 08 February 2024.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

JSS Data Protection Officer The Hongkong Shanghai Bank Corporation Limited

COMPLAINTS AND INVESTIGATION DIVISION COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Post Breach Report of Hongkong and Shanghai Banking Corporation Limited, dated 10 May 2022. ↩

  2. Initial Report (Data Breach Due to Lost Mail Packs dated 29 October 2018) of Hongkong and Shanghai Banking Corporation Limited, dated 31 October 2018, at p. 2. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Full Breach Report (In Compliance with the Order dated 07 October 2020) of Hongkong and Shanghai Banking Corporation Limited, dated 23 October 2020, at p. 1. ↩

  7. Initial Report (Data Breach Due to Lost Mail Packs dated 29 October 2018) of Hongkong and Shanghai Banking Corporation Limited, dated 31 October 2018, at p. 2. ↩

  8. Id. ↩

  9. Id. ↩

  10. Id. ↩

  11. Initial Report (Data Breach Due to Lost Mail Packs dated 29 October 2018) of Hongkong and Shanghai Banking Corporation Limited, dated 31 October 2018, at p. 2. ↩

  12. Id. ↩

  13. Id. ↩

  14. Id. ↩

  15. Initial Report (Data Breach Due to Lost Mail Packs dated 29 October 2018) of Hongkong and Shanghai Banking Corporation Limited, dated 31 October 2018, at p. 2-3. ↩

  16. In re: The Hongkong and Shanghai Banking Corporation Limited (HSBC), NPC BN 18-203, Order, 08 October 2020. ↩

  17. Full Breach Report (In Compliance with the Order dated 07 October 2020) of Hongkong and Shanghai Banking Corporation Limited, dated 23 October 2020. ↩

  18. Full Breach Report (In Compliance with the Order dated 07 October 2020) of Hongkong and Shanghai Banking Corporation Limited, dated 23 October 2020, at p. 3. ↩

  19. Id. ↩

  20. Full Breach Report (In Compliance with the Order dated 07 October 2020) of Hongkong and Shanghai Banking Corporation Limited, dated 23 October 2020, at p. 3. ↩

  21. Id. ↩

  22. Id. ↩

  23. Full Breach Report (In Compliance with the Order dated 07 October 2020) of Hongkong and Shanghai Banking Corporation Limited, dated 23 October 2020, at p. 5. ↩

  24. Id. ↩

  25. In re: The Hongkong and Shanghai Banking Corporation Limited (HSBC), NPC BN 18-203, Order (To submit Post-Breach Report), dated 21 April 2022. ↩

  26. Post Breach Report of Hongkong and Shanghai Banking Corporation Limited, dated 10 May 2022. ↩

  27. Post Breach Report of Hongkong and Shanghai Banking Corporation Limited, dated 10 May 2022, at p. 1. ↩

  28. Id. ↩

  29. Post Breach Report of Hongkong and Shanghai Banking Corporation Limited, dated 10 May 2022, at p. 3. ↩

  30. Initial Report (Data Breach Due to Lost Mail Packs dated 29 October 2018) of Hongkong and Shanghai Banking Corporation Limited, dated 31 October 2018, at p. 2. ↩

  31. National Privacy Commission, Personal Data Breach Management, NPC Circular No. 16-03, rule V, § 11. ↩

  32. Full Breach Report (In Compliance with the Order dated 07 October 2020) of Hongkong and Shanghai Banking Corporation Limited, dated 23 October 2020, at p. 3. ↩

  33. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter V, § 20 (f) (2012). ↩

  34. National Privacy Commission, Personal Data Breach Management, NPC Circular No. 16-03, rule V, § 11 (a). ↩

  35. Initial Report (Data Breach Due to Lost Mail Packs dated 29 October 2018) of Hongkong and Shanghai Banking Corporation Limited, dated 31 October 2018, at p. 2. ↩

  36. Initial Report (Data Breach Due to Lost Mail Packs dated 29 October 2018) of Hongkong and Shanghai Banking Corporation Limited, dated 31 October 2018, at p. 2. ↩

  37. National Privacy Commission, Personal Data Breach Management, NPC Circular No. 16-03, rule I, § 3 (F). ↩

  38. Post Breach Report of Hongkong and Shanghai Banking Corporation Limited, dated 10 May 2022. ↩

  39. National Privacy Commission, Personal Data Breach Management, NPC Circular No. 16-03, rule V, § 18 (A). ↩

  40. Full Breach Report (In Compliance with the Order dated 07 October 2020) of Hongkong and Shanghai Banking Corporation Limited, dated 23 October 2020, at p. 3. ↩

  41. National Privacy Commission, Personal Data Breach Management, NPC Circular No. 16-03, rule V, § 18 (C) and (D). ↩

  42. Post Breach Report of Hongkong and Shanghai Banking Corporation Limited, dated 10 May 2022. ↩

  43. Post Breach Report of Hongkong and Shanghai Banking Corporation Limited, dated 10 May 2022. See: Annex 2. ↩

Backlinks

  • No backlinks found