NPC Issuance Wiki

NPC SS 21-006: In re: Wefund Lending Corporation (JuanHand) and its Responsible Officers

Issued Order

Order Text

IN RE: WEFUND LENDING CORPORATION (JUANHAND) AND ITS RESPONSIBLE OFFICERS NPC SS 21-006

x----------------------------------------------------x

ORDER

This refers to the Commission’s assessment of JuanHand’s compliance documents, including its simulations of Wefund Lending Corporation’s (JuanHand) test version of the JuanHand online lending application (JuanHand version 4.1.1) and the JuanHand online lending application version 4.2.0 that was made available through a direct download link sent to its users (JuanHand version 4.2.0).

On 12 August 2021, acting on an Application for Temporary Ban filed by the Commission’s Complaints and Investigation Division (CID), the Commission issued against JuanHand an Order to immediately take down its online lending application and stop personal data processing activities:

WHEREFORE, all these premises considered, this Commission GRANTS the Application for Temporary Ban on the processing of personal data filed by the Complaints and Investigation Division (CID) of the National Privacy Commission. A TEMPORARY BAN ON PROCESSING OF PERSONAL DATA is hereby issued against Respondent Wefund Lending Corporation, as the operator of the online lending application, JuanHand.

Further, pursuant to the TEMPORARY BAN, Respondent Wefund Lending Corporation shall:

  1. Immediately take down its online lending application, JuanHand, to ensure that it is no longer available for download, installation or use by data subjects; and

  2. Stop personal data processing activities, including those activities outsourced to third parties, where the processing operations involves use of information from the phonebook, directory, and contact list of data subjects, disclosure of false or unwarranted information, and other unduly intrusive personal data processing methods.

The TEMPORARY BAN ON PROCESSING OF PERSONAL DATA shall remain in effect until the final resolution of the sua sponte investigation against Respondent and its responsible officers.

Let copies of this Order be furnished to the National Telecommunications Commission for their appropriate action, and Google LLC, which operates the Google Play Store for its compliance in accordance with the terms and conditions of its platform.

Furthermore, Respondent Wefund Lending Corporation and its responsible officers are ORDERED, within ten (10) days from receipt of this Order, to file a COMMENT on the allegations in the attached Fact-Finding Report, pursuant to Section 6 of Rule X of NPC Circular No. 2021-01 (2021 NPC Rules of Procedure).

In case of failure by the Respondent and its responsible officers to file a Comment, this case shall be deemed submitted for resolution based on the evidence on record.

The proceedings before the Commission based on the Fact-Finding Report of the CID, which serves as the Complaint against Respondent Wefund Lending Corporation and its responsible officers, will now resume, pursuant to Section 2, Rule IX of the 2021 NPC Rules of Procedure.

SO ORDERED.1

On 02 September 2021, JuanHand submitted to the Commission JuanHand version 4.1.1 together with its Comment to the Order and Temporary Ban dated 12 August 2021 (Comment).2 It also submitted the following documents:

  1. “JuanHand Privacy Policy” with version date August 2021;
  2. “Service Agreement” with version date August 2021;
  3. “Wefund Lending Corporation Personal Privacy Information Management Policy”, which serves as its Privacy Manual (Privacy Manual); and
  4. “Wefund Lending Corporation Information Security Emergency Response Management Directive”, which serves as its Security Incident Management Policy (Security Incident Management Policy).3

On 10 September 2021, JuanHand filed a Supplemental Comment with Motion for Lifting of Temporary Ban dated 10 September 2021 (Supplemental Comment).4

On 17 September 2021, the Enforcement Division (EnD) of the National Privacy Commission (NPC) sent a letter dated 16 September 2021 to JuanHand in relation to the direct download link leading to JuanHand version 4.2.0.5 The letter provided that the Commission received several reports that JuanHand’s Collection Department made various direct download links available to JuanHand users and directed JuanHand to explain the foregoing incident.6

On 27 September 2021, the Commission issued an Order noting JuanHand’s Comment and submissions.7

On 08 October 2021, JuanHand responded to the EnD’s letter.8 It informed the EnD that the direct download links were inadvertently sent in an SMS and email as part of an automatic process which transmits repayment reminders to existing JuanHand users.9 It states that “the dissemination of the direct download link through the repayment reminder SMS and emails was done inadvertently, and with no intention to violate the temporary ban” and that it immediately ordered the removal of direct download links from the repayment reminder SMS and emails.10

On 17 December 2021, JuanHand filed a Motion to Resolve the imposition of the Temporary Ban on the processing of personal data in relation to its online lending application.11

On 10 January 2022, JuanHand filed a Supplemental Motion to Resolve the imposition of the Temporary Ban.12 JuanHand also supplemented its response to the EnD with a Supplemental Reply and Explanation to the National Privacy Commission Enforcement Division Letter dated 16 September 2021.13 It reiterated that it “completely disabled and deactivated” the direct download links.14

On 13 January 2022, the Commission issued a Resolution lifting the Temporary Ban on the processing of personal data issued against JuanHand.15

Discussion

The Commission orders JuanHand to address the issues identified by the EnD in relation to JuanHand version 4.1.1, JuanHand version 4.2.0, its Privacy Manual, and its Security Incident Management Policy despite the lifting of the Temporary Ban. The EnD determined that JuanHand should rectify its camera permissions in compliance with NPC Circular No. 20-01 (Guidelines on the Processing of Personal Data for Loan-Related Transactions), and include provisions in its Privacy Manual and Security Incident Management Policy in compliance with the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations, and NPC Circular No. 16-03 (Personal Data Breach Management).

Based on the EnD’s simulation of JuanHand version 4.1.1 and JuanHand version 4.2.0, it ascertained that the online lending application does not comply with NPC Circular No. 20-01, particularly Section 3 (D) (3) on camera permissions.16 Section 3 (D) (3) of NPC Circular No. 20-01 provides:

Section 3. Guidelines. — The processing of personal data for evaluating loan applications, granting loans, collection of loans, and closure of loan accounts shall be subject to the following general guidelines:

…

D. Where online apps are used for loan processing activities, LCs, FCs, and other persons acting as such shall be prohibited from requiring unnecessary permissions that involve personal and sensitive personal information.

…

  1. Where an online app requires access to the borrower’s phone camera to take a photo of the borrower and/or the photo gallery to choose a photo for the exclusive purpose of KYC and preventing fraud at the beginning of the loan application, permission for such access may be allowed at that stage in the loan application process.

Where the photo has already been taken and saved in the application, the application should already turn off such permission by default, or at the very least, prompt the borrowers through appropriate means, i.e. just-in-time, pop-up notices, etc. that they may already turn off or disallow such permission as the same is no longer necessary for the operation of the application. In no way shall the borrower’s photo be used to harass or embarrass the borrower in order to collect a delinquent loan.17

As verified by the EnD, the online lending application requires the user’s permission to access the camera in order to verify the identity of the user during the registration process.18 The EnD, however, determined that the online lending application neither turns off the camera permission nor prompts the users, through appropriate means, that it is no longer necessary for operations after the designated purpose of the camera permission.19 JuanHand’s failure to turn off the camera permission or prompt its user to turn off such permission is a violation of Section 3 (D) (3) of NPC Circular No. 20-01.20

The EnD also assessed JuanHand’s Privacy Manual and Security Incident Management Policy. As stated in its Comment, JuanHand endeavors to establish “a comprehensive corporate data protection policy.”21 While the Commission recognizes JuanHand’s efforts, it notes that the Privacy Manual and Security Incident Management Policy still lacks the necessary information that should be contained in these documents.

A Personal Information Controller (PIC), such as JuanHand, should implement reasonable and appropriate organizational, physical, and technical measures to protect the personal information of its data subjects.22 These measures should be contained in the Privacy Manual and Security Incident Management Policy of the PIC. Section 20 (a) of the DPA provides:

Section 20. Security of Personal Information. – (a) The personal information controller must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.23

Section 25 of the IRR elaborates on the PIC’s obligation to implement these measures:

Section 25. Data Privacy and Security. Personal information controllers and personal information processors shall implement reasonable and appropriate organizational, physical, and technical security measures for the protection of personal data.

The personal information controller and personal information processor shall take steps to ensure that any natural person acting under their authority and who has access to personal data, does not process them except upon their instructions, or as required by law.

The security measures shall aim to maintain the availability, integrity, and confidentiality of personal data and are intended for the protection of personal data against any accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing. These measures shall be implemented to protect personal data against natural dangers such as accidental loss or destruction, and human dangers such as unlawful access, fraudulent misuse, unlawful destruction, alteration and contamination.24

Based on the EnD’s assessment, JuanHand’s Privacy Manual does not discuss organizational, physical, and technical security measures that it implements in the processing of personal information.25 JuanHand’s Privacy Manual does not include provisions on the following organizational security measures: a procedure for appointing of a Data Protection Officer (DPO) and Compliance Officers and their respective functions, the conduct of privacy trainings or seminars for its personnel, conduct of a Privacy Impact Assessment, recording and documentation of activities carried out by the DPO or the organization itself, and mechanisms for review of data protection policies.26

It also does not discuss the following physical security measures: storage type and location, monitoring and limitation of access to room or facility, design of office space/ work station, and modes of transfer of personal data within the organization or to third parties.27 It also does not delve into the following technical security measures: safeguards on the computer network, including encryption and authentication processes that control access to personal information.28 As such, the Commission directs JuanHand to Sections 26 to 28 of the IRR for the guidelines for organizational, physical, and technical security measures.29

In addition, JuanHand’s Privacy Manual does not discuss the mechanisms in determining the basis for lawful processing of personal data pursuant to Sections 12 and 13 of the DPA and upholding the rights of the data subjects in accordance with Section 16 of the DPA.30

JuanHand’s Security Incident Management Policy does not fully comply with Section 4 of NPC Circular No. 16-03, which states:

Section 4. Security Incident Management Policy. A personal information controller or personal information processor shall implement policies and procedures for the purpose of managing security incidents, including personal data breach. These policies and procedures must ensure:

  1. Creation of a data breach response team, with members that have clearly defined responsibilities, to ensure timely action in the event of a security incident or personal data breach;
  2. Implementation of organizational, physical and technical security measures and personal data privacy policies intended to prevent or minimize the occurrence of a personal data breach and assure the timely discovery of a security incident;
  3. Implementation of an incident response procedure intended to contain a security incident or personal data breach and restore integrity to the information and communications system;
  4. Mitigation of possible harm and negative consequences to a data subject in the event of a personal data breach; and
  5. Compliance with the Act, its IRR, and all related issuances by the Commission pertaining to personal data breach notification.31

JuanHand’s Security Incident Management Policy does not provide for policies and procedures on the implementation of organizational, physical, and technical security measures, and personal data privacy policies intended to prevent or minimize the occurrence of a personal data breach and assure the timely discovery of a security incident. It also does not provide for an incident response procedure intended to contain a security incident or personal data breach and restore integrity to the information and communications system, and mitigation of possible harm and negative consequences to a data subject in the event of a personal data breach.32

The Security Incident Management Policy also does not comply with Section 8 of NPC Circular No. 16-03. Section 8 of NPC Circular No. 16-03 provides:

Section 8. Policies and Procedures. The personal information controller or personal information processor shall implement policies and procedures for guidance of its data breach response team and other personnel in the event of a security incident.33

Further, the Security Incident Management Policy does not discuss any procedure to comply with the requirements of personal breach notification.34

In its Comment, JuanHand represented that it respects its users’ personal privacy and that it strives to ensure that its users’ personal information is protected.35 As such, the Commission enjoins JuanHand to address the issues raised in this Order despite the lifting of the Temporary Ban. JuanHand must remedy JuanHand version 4.1.1, JuanHand version 4.2.0, its Privacy Manual, and its Security Incident Management Policy to fully comply with the DPA, its IRR, and issuances of the Commission.

WHEREFORE, premises considered, the Commission ORDERS Wefund Lending Corporation and its responsible officers within fifteen (15) days from the receipt of this Order to:

  1. RECTIFY the test version of the JuanHand online lending application (JuanHand version 4.1.1), the APK file of JuanHand online lending application version 4.2.0 (JuanHand version 4.2.0), “Wefund Lending Corporation Personal Privacy Information Management Policy”, which serves as its Privacy Manual (Privacy Manual), and “Wefund Lending Corporation Information Security Emergency Response Management Directive”, which serves as its Security Incident Management Policy (Security Incident Management Policy); and

  2. SUBMIT proof of compliance to the Commission.

Further, the Commission orders Wefund Lending Corporation and its responsible officers and the Complaints and Investigation Division of the National Privacy Commission to SUBMIT within ten (10) days from the submission of Wefund Lending Corporation’s proof of compliance their respective Memoranda on their respective arguments on the facts and issues for the resolution of this Commission.

Compliance with this Order shall not excuse Wefund Lending Corporation and its responsible officers from any violations of the Data Privacy Act of 2012 and its Implementing Rules and Regulations that may have resulted from their previous actions before and during the time the Temporary Ban was in place.

SO ORDERED.

City of Pasay, Philippines. 13 January 2022.

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA Deputy Privacy Commissioner

Copy furnished:

VASIG ABARQUEZ LUMAUIG ABARQUEZ PUNO LAW OFFICES Counsel for Respondents

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Order, 12 August 2021, at 17, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  2. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  3. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  4. Supplemental Comment with Motion for Lifting of Temporary Ban, 10 September 2021, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  5. Letter from Enforcement Division, National Privacy Commission, Compliance With Order dated 12 August 2021 in NPC SS 21-006 entitled “In re: Wefund Lending Corporation (JuanHand)” to Atty. LAN (16 September 2021). ↩

  6. Letter from Enforcement Division, National Privacy Commission, Compliance With Order dated 12 August 2021 in NPC SS 21-006 entitled “In re: Wefund Lending Corporation (JuanHand)” to Atty. LAN (16 September 2021). ↩

  7. Order, 27 September 2021, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  8. Letter from Vasig Abarquez Lumauig Abarquez Puno Law Offices, Reply and Explanation to the National Privacy Commission (08 October 2021). ↩

  9. Id. at 3. ↩

  10. Id. at 4. ↩

  11. Motion to Resolve, 17 December 2021, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  12. Supplemental Motion to Resolve, 10 January 2022, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  13. Letter from Vasig Abarquez Lumauig Abarquez Puno Law Offices, Supplemental Reply and Explanation to the National Privacy Commission Enforcement Division Letter dated 16 September 2021, to Enforcement Division, National Privacy Commission (10 January 2022). ↩

  14. Id. at 4. ↩

  15. Resolution, 13 January 2022, at 6-7, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2022) (pending). ↩

  16. Enforcement Division Memorandum, 03 December 2021, at 7, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  17. National Privacy Commission, Guidelines on the Processing of Personal Data for Loan-Related Transactions, Circular No. 01, Series of 2020 [NPC Circ. No. 20-01], § 3 (D) (3) (14 September 2020). ↩

  18. Enforcement Division Memorandum, 03 December 2021, at 7, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  19. Id. ↩

  20. Id. ↩

  21. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, at 5, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006 (NPC 2021) (pending). ↩

  22. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 § 20 (2012). ↩

  23. Id. ↩

  24. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule VI, § 25. ↩

  25. Enforcement Division Memorandum, 03 December 2021, at 8, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  26. Id. ↩

  27. Id. ↩

  28. Id. ↩

  29. National Privacy Commission, Rules and Regulations Implementing the Data Privacy Act of 2012, Republic Act No. 10173, rule VI, § 26-28. ↩

  30. Enforcement Division Memorandum, 03 December 2021, at 9, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  31. National Privacy Commission, Personal Data Breach Management, NPC Circular No. 16-03, § 4 (15 December 2016). ↩

  32. Enforcement Division Memorandum, 03 December 2021, at 9, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  33. NPC Circ. No. 16-03, § 8. ↩

  34. Enforcement Division Memorandum, 03 December 2021, at 9, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006, (NPC 2021) (pending). ↩

  35. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, at 5, in In re: Wefund Lending Corporation and its Responsible Officers, NPC SS 21-006 (NPC 2021) (pending). ↩

Backlinks

  • No backlinks found