NPC Issuance Wiki

NPC BN 18-239: In re: Fintechnology, Inc. (FundKo)

Issued Order

Order Text

IN RE: FINTECHNOLOGY, INC. (FUNDKO) NPC BN 18-239

x----------------------------------------------------x

ORDER

Before the Commission is the Post-Breach Report dated 13 July 2022 (Post-Breach Report) submitted by Fintechnology, Inc. (FundKo) in compliance with the Order dated 27 May 2022 (Order) of the Commission, through its Complaints and Investigation Division (CID).1

FundKo is a web-based peer-to-peer lending platform that connects verified borrowers and lenders.2 FundKo submitted its Breach Notification dated 22 December 2018, stating that “one of FundKo’s registered lenders was able to inspect through his browser the ‘source code’ (or HTML code) of the FundKo marketplace site (https://fundko.com/dashboard), which contained the information of the data subjects.”3 Thus, the incident resulted in the exposure of personal and sensitive personal information to any party who would access the site using the same process.

FundKo alleged that as of 19 December 2018, there has been thirty-four loans on the website which are vulnerable as these contain borrower information that is sensitive.4

Moreover, FundKo stated that the information exposed and accessible are composed of the Birthday, City of Residence, Civil Status, E-mail, Full Name, Gender, Mobile Number, Social Security System (SSS) Number, Tax Identification Number, and Address.5

As to the measures to address the breach, FundKo averred that their customer support team immediately forwarded the concern to their Data Protection Officer (DPO) for review.6 Moreover, FundKo stated that “the incident was validated by the DPO that the lender’s concern is verified by viewing multiple loans on the website following the lender’s inspection procedure.”7 Thereafter, the DPO raised the issue to the Technical Team led by JC and further documented the incident via e-mail for the upper management’s reference.8

FundKo declared that one of its developers, DV, informed that they have updated the website and fixed the concern as of 5:49PM of 19 December 2018.9 FundKo claimed that the website has been in existence since October 2016 and was designed and developed by Asiatic Innovation Phils., Inc.10

As per the team lead of the tech team (JC), the issue has been resolved and is an “isolated case.”11 However, FundKo received feedback from JC that the same was not an isolated case as their DPO ran a random check to multiple loans prior to the documentation.12

FundKo alleged that they already informed the clients who were possibly affected by the breach and has issued notifications informing them to take steps for them to ensure that any information which might have leaked be kept secured.13 Further, FundKo stated that the notification was made through email and has also tried to reach the affected clients through their phone numbers.14

Lastly, FundKo averred that its management already raised the concern to Guevent Investments Development Corporation Advisory and Assurance Team as well as its legal counsel.15

On 12 January 2021, the Commission, through the Complaints and Investigation Division (CID), issued an Order requiring FundKo to submit a Full Report.16 In the Order, the Commission stated that the report was insufficient to appreciate and determine the severity and nature of the confidentiality breach and whether FundKo notified the affected data subjects.17 Moreover, FundKo was directed by the Commission to submit proof of personal data breach notification to the affected data subjects.18

On 27 May 2022, the CID issued another Order requiring FundKo to submit its Post Breach Report.19 In the said Order, the Commission directed FundKo to provide a copy of the investigation conducted by its technical team and DPO and reiterating its previous directive to provide proof of data subject notification.20

On 10 June 2022, FundKo’s counsel filed an Entry of Appearance with Motion for Extension of Time dated 09 June 2022, praying that an additional fifteen (15) days be given to submit their Post Breach Report.21

On 16 June 2022, the CID issued a Resolution granting the Motion for Extension of Time to submit the Post Breach Report of FundKo.22

On 28 June 2022, FundKo’s counsel filed an Omnibus Motion for Second Extension of Time to Submit Post Breach Report and To Secure Copies of All Documents in Relation to the Instant Case, praying that another fifteen (15) days be granted and allowing FundKo to secure copies of Breach Notification Report and all other documents relative to the instant case.23

On 29 June 2022, the CID issued a Resolution granting FundKo’s Motion for Extension.24

On 14 July 2022, FundKo submitted its Post Breach Report dated 13 July 2022.25 In their Post Breach Report, they reiterated its previous allegation in their Initial Report, and added their measures taken to address the breach.26 FundKo stated that “among the measures were: 1) updated the platform to prevent unintentional disclosure of the personal and sensitive information of borrowers; 2) notifying all affected data subjects via email and their mobile number; 3) strict monitoring over the updated FundKo platform in order to ensure that all stored information is secured and protected.”27

Further, they stated that since the data was not stolen, efforts for its recovery were not anymore exerted and instead, they strictly monitored the situation to prevent the happening of any other similar glitch.28

As for its Post Breach Measures, FundKo stated that they implemented a new Privacy Policy to promote transparency in data collection and ensure protection of data.29

Moreover, a new FundKo dashboard was deployed and has a “Firebase authentication” where the role of any user is authenticated before they can view the components of the dashboard page.30

FundKo claimed that they no longer heard from the 34 affected data subjects and claimed that this was only an isolated case, and that the website is no longer accessible.31

Upon evaluation of FundKo’s Post-Breach Report, the Commission finds that the PIC has not sufficiently complied with the Order to provide proof of notification to the affected data subjects.

Section 18 (D) of NPC Circular No. 16-03 or the Personal Data Breach Management states:

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data.

The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach[.]32

Based on FundKo’s submission, they repeatedly claimed that they already informed and notified the affected data subjects of the incident.33 As early as in their Initial Notification dated 22 December 2018, FundKo claimed that the notification was made through email and has also tried to reach the affected clients through their phone numbers.34 In their Post Breach Report, they reiterated that they already informed the thirty-four (34) affected data subjects and claimed that they no longer heard from them.35 However, no proof to the same was provided by FundKo.

Thus, the Commission, in order to holistically resolve the matter deems it proper that FundKo, as Personal Information Controller (PIC), shall submit proof of notification sent to the affected data subjects. FundKo is sternly reminded of its obligation to comply with the orders of the Commission.

WHEREFORE, premises considered, Respondent Fintechnology, Inc. (FundKo) is hereby ORDERED to submit proof of notification to the affected data subjects within fifteen (15) days from the receipt of this Order directly to the Compliance and Monitoring Division (CMD).

The Commission DIRECTS the Compliance and Monitoring Division (CMD) to issue the appropriate orders necessary to evaluate and monitor the completeness of Fintechnology, Inc.’s (FundKo) data breach notification and assess its breach management pursuant to NPC Circular 16-03 (Personal Data Breach Management).

SO ORDERED.

City of Pasay, Philippines. 13 November 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

BU Data Protection Officer

ECQ Counsel for Fintechnology, Inc.

COMPLAINTS AND INVESTIGATION DIVISION COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Post Breach Report dated 13 July 2022 of Fintechnology, Inc. (FundKo). ↩

  2. Notification of a Privacy Breach Incident dated 22 December 2018 of Fintechnology, Inc. (FundKo). ↩

  3. Notification of a Privacy Breach Incident dated 22 December 2018 of Fintechnology, Inc. (FundKo), at p. 1. ↩

  4. Id. ↩

  5. Notification of a Privacy Breach Incident dated 22 December 2018 of Fintechnology, Inc. (FundKo), at p. 1-2. ↩

  6. Notification of a Privacy Breach Incident dated 22 December 2018 of Fintechnology, Inc. (FundKo), at p. 2. ↩

  7. Id. ↩

  8. Id. ↩

  9. Id. ↩

  10. Notification of a Privacy Breach Incident dated 22 December 2018 of Fintechnology, Inc. (FundKo), at p. 2. ↩

  11. Id. ↩

  12. Id. ↩

  13. Id. ↩

  14. Notification of a Privacy Breach Incident dated 22 December 2018 of Fintechnology, Inc. (FundKo), at p. 2. ↩

  15. Notification of a Privacy Breach Incident dated 22 December 2018 of Fintechnology, Inc. (FundKo), at p. 2. ↩

  16. In re: Fintechnology, Inc. (FundKo), NPC BN 18-239, Order (To Submit Full Breach) dated 12 January 2021. ↩

  17. Id. ↩

  18. Id. ↩

  19. In re: Fintechnology, Inc. (FundKo), NPC BN 18-239, Order (To Submit Post Breach Report) dated 27 May 2022. ↩

  20. Id. ↩

  21. Entry of Appearance with Motion For Extension of Time (to Submit Post-Breach Report) dated 08 June 2022 of Fintechnology, Inc. (FundKo). ↩

  22. In re: Fintechnology, Inc. (FundKo), NPC BN 18-239, Resolution (Granting the Motion for Extension) dated 16 June 2022. ↩

  23. Omnibus Motion for Second Extension of Time to Submit Post Breach Report and to Secure Copies of All Documents in Relation to the Instant Case dated 28 June 2022 of Fintechnology, Inc. (FundKo). ↩

  24. In re: Fintechnology, Inc. (FundKo), NPC BN 18-239, Resolution (Granting the Omnibus Motion for Extension with Request to Secure Case Files) dated 29 June 2022. ↩

  25. Post Breach Report dated 13 July 2022 of Fintechnology, Inc. (FundKo). ↩

  26. Id. ↩

  27. Id., at p. 2-3. ↩

  28. Id., at p. 3. ↩

  29. Post Breach Report dated 13 July 2022 of Fintechnology, Inc. (FundKo), at p. 3. ↩

  30. Id., at p. 4. ↩

  31. Id., at p. 4. ↩

  32. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18 (D) (15 December 2016) (NPC Circular 16-03). ↩

  33. Notification of a Privacy Breach Incident dated 22 December 2018 of Fintechnology, Inc. (FundKo); Post Breach Report dated 13 July 2022 of Fintechnology, Inc. (FundKo). ↩

  34. Notification of a Privacy Breach Incident dated 22 December 2018 of Fintechnology, Inc. (FundKo), at p. 2. ↩

  35. Post Breach Report dated 13 July 2022 of Fintechnology, Inc. (FundKo), at p. 4. ↩

Backlinks

  • No backlinks found