Resolution Text
IN RE: LAND BANK OF THE PHILIPPINES
CID BN 18-105
x----------------------------------------------x
On 06 July 2018, the Commission received a letter1 from the Data Protection Officer of Land Bank of the Philippines (“Landbank”) regarding an identity theft incident.
In their letter, Landbank relayed an individual’s complaint on an alleged identity theft. According to the complaint, someone used his information or identification documents to get money, credit, loans, goods or services without his knowledge or authorization. This individual only found out about the account with Landbank when he applied for an account with another bank and his name appeared in the negative file of the Banker’s Association of the Philippines (“BAP”) for a past due credit card with Landbank.
In their letter, Landbank narrated the personal data possibly involved:
[The individual] alleged that his personal details were copied from his records such as the name, birthdate, gender and Tax Identification Number (TIN). However, there are fictitious or inaccurate information that is stated in the credit card application like his marital status, cellphone number, business and home address, photograph, and signature.
Landbank stated that they undertook the following measures to address the alleged identity theft:
Credit Card Administration Department (CCAD) had immediately asked for investigation with the concerned bank units (Administrative Legal Department and Physical Security Office) to validate the claim of [the individual].
CCAD requested for the deletion of the name of [the individual] in the reporting of delinquent accounts with the BAP.
Notably, Landbank does not state the results of such actions and has not made manifestations on further findings despite the lapse of almost two (2) years since the initial letter.
Under NPC Circular 16-03,2 the Commission requires Landbank to submit a full report of the incident that indicates the outcomes of their above-stated remedial measures and the policies adopted to avoid such incidents in the future.
This is pursuant to Section 17 (d)(3) of the same Circular which states that the personal information controller shall notify the Commission of the “actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident” as well as the “the measures being taken to prevent a recurrence of the incident.”
WHEREFORE, all premises considered, Landbank is hereby ordered to submit a full report on the outcomes from their stated measures to address the alleged identity theft, with Section 17(d)(3) of NPC Circular 16-03 as guidance, within thirty (30) days from receipt of this resolution.
Pasay City, 12 May 2020.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY DU NAGA Deputy Privacy Commissioner
Copy furnished:
JTA Data Protection Officer
COMPLAINTS AND INVESTIGATION DIVISION; ENFORCEMENT DIVISION; GENERAL RECORDS UNIT National Privacy Commission
Footnotes
-
Records, pp. 3-4, Letter dated 6 July 2018. ↩
-
NPC Circular 16-03, “Data Breach Management”. Dated 15 December 2016. ↩