Order Text
IN RE: ASIA UNITED BANK CORPORATION NPC BN 22-119
x----------------------------------------------------x
ORDER
Before the Commission is the request for exemption from the notification of affected data subjects filed by Asia United Bank Corporation (AUB) dated 12 August 2022.1
According to AUB, its credit card delivery courier, Entrego, reported that on 05 August 2022, it erroneously emailed to Unionbank the Daily Progressive Report intended for AUB.2 On the same date, Entrego stated that Unionbank called its attention to the erroneous email it sent.3 Entrego then requested Unionbank to immediately delete the Daily Progressive Report in the email.4 AUB further alleged that Unionbank confirmed the deletion of the erroneous email on the same date and provided proof of such deletion.5
AUB reported that the Daily Progressive Report contains information such as the credit cardholder’s name, delivery address, pick-up and delivery dates, delivery recipient name and signature,6 and recipient’s ID type and number.7
Moreover, AUB stated that there are at least one thousand two hundred twenty-nine (1,229) data subjects involved in the alleged breach.8 However, AUB mentioned that if the delivery recipient is not the cardholder himself/herself, then “a maximum of two thousand four hundred fifty-eight (2,458) data subjects are involved.”9
In justifying its request for exemption, AUB stated that Unionbank “has already confirmed deletion of said email and report from its records.”10
On 11 January 2023, the Commission issued a Minute Resolution ordering AUB to submit proof to substantiate its request for exemption to notify the data subjects:
Pursuant to Section 17(D) of NPC Circular No. 16-03 (Personal Data Breach Management), the Commission may require additional information, if necessary, for the proper resolution of the request for Exemption.
WHEREFORE, premises considered, the Commission hereby ORDERS Asia United Bank Corporation to SUBMIT within five (5) days upon receipt of this Minute Resolution proof to substantiate the request for Exemption.
Should Asia United Bank Corporation fail to provide the foregoing, this case shall be submitted for resolution based on the records before the Commission.
SO ORDERED.11
In compliance with the Minute Resolution, AUB submitted its Supplemental Request for Exemption dated 18 January 2023.12
AUB explained in its Supplemental Request that Entrego promptly coordinated with Unionbank regarding the deletion of the Daily Progressive Report “both from the concerned mailbox and trash bin.”13
Additionally, in justifying its request for exemption, AUB stated that the notification is not in the interest of the public or the affected data subjects as it may cause unnecessary worry and anxiety among them, citing In re: Health Delivery System, Inc, NPC BN 20-049.14
AUB also explained that Unionbank’s acquisition and access to the Daily Progressive Report were only for less than six (6) hours and were deleted from its records within the same day.15 AUB reiterated in its request for exemption that Unionbank “confirmed and provided proof that the erroneously emailed Daily Progressive Report has been deleted from its records.”16
Lastly, AUB requested the Commission to allow it to submit the incident report from Entrego and the certification of deletion issued by Unionbank.17
On 20 January 2023, AUB sent to the Commission, via email, Entrego’s incident report dated 06 August 2022.18 The incident report stated that Entrego referred the incident to its Human Resources “for the imposition of disciplinary sanction on the erring employee for his negligence.”19 Entrego also stated that the Progressive Daily Report mistakenly sent to Unionbank was not password protected which violates Entrego’s Information Security Policy and Data Privacy Governance and Management Manual.20
Rule V, Section 18(A) of NPC Circular No. 16-03 (Personal Data Breach Management) states:
A. When should notification be done. The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred. The notification may be made on the basis of available information within the 72-hour period if the personal data breach is likely to give rise to a real risk to the rights and freedoms of data subjects. It shall be undertaken in a manner that would allow data subjects to take the necessary precautions or other measures to protect themselves against the possible effects of the breach. It may be supplemented with additional information at a later stage on the basis of further investigation.21 (Emphasis supplied)
Moreover, a request for exemption from the notification requirement, as determined by the Commission to be meritorious, may be granted if “such notification would not be in the public interest or in the interest of the affected data subjects.”22
In this case, AUB failed to substantiate its request for exemption to notify the affected data subjects since it was not able to show that the notification would not be in the interests of the public or the affected data subjects. Specifically, AUB failed to submit proof that Unionbank actually deleted the erroneous email containing the Daily Progressive Report.
Thus, the Commission deems it proper to deny AUB’s request for exemption from the notification requirement for failure to substantiate its request. It must be emphasized that the notification to the data subjects will allow them to undertake necessary precautions to mitigate the further exposure of their personal information especially if such information involves details regarding their financial capacity or status with the bank.
WHEREFORE, premises considered, this Commission DENIES the request of Asia United Bank Corporation (AUB) for the exemption of notification of the data subjects affected by the breach.
The Commission DIRECTS the Compliance and Monitoring Division (CMD) to issue the appropriate orders necessary to evaluate and monitor the completeness of AUB’s data breach notification and assess its breach management pursuant to NPC Circular No. 16-03 (Personal Data Breach Management).
SO ORDERED.
City of Pasay, Philippines. 26 January 2023.
JOHN HENRY D. NAGA Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
NERISSA N. DE JESUS Deputy Privacy Commissioner
Copy furnished:
EMC Data Protection Officer
COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT
Footnotes
-
In re: Asia United Bank Corporation, NPC BN 22-119, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Date of Notification of Asia United Bank Corporation (12 August 2022). ↩
-
Id., 1.b Chronology of Asia United Bank Corporation (12 August 2022). ↩
-
Id., 1.b Chronology. ↩
-
Id., 1.b Chronology. ↩
-
In re: Asia United Bank Corporation, NPC BN 22-119, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1.b Chronology of Asia United Bank Corporation (12 August 2022). ↩
-
Id., 1.b Chronology. ↩
-
Id., 1.b Chronology. ↩
-
Id., 1.c Number of DS/Records. ↩
-
In re: Asia United Bank Corporation, NPC BN 22-119, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1.c Number of DS/Records of Asia United Bank Corporation (12 August 2022). ↩
-
Id., in Justification for exemption. ↩
-
In re: Asia United Bank Corporation, NPC BN 22-119, Minute Resolution dated 11 January 2023, at p. 1. ↩
-
Supplemental Report for Exemption dated 18 January 2023 of Asia United Bank Corporation. ↩
-
Id., at p. 2. ↩
-
Id., at pp. 2-3. ↩
-
Id., at p. 3. ↩
-
Supplemental Report for Exemption dated 18 January 2023 of Asia United Bank Corporation, at p. 1. ↩
-
Id., at p. 3. ↩
-
Electronic mail dated 20 January 2023 from Asia United Bank Corporation. ↩
-
Incident Report dated 06 August 2022 of Entrego. ↩
-
Electronic Mail dated 20 January 2023 from Asia United Bank. ↩
-
National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, §18(A) (15 December 2016). ↩
-
NPC Circular 16-03, rule V, §18(B). ↩