Resolution Text
IN RE: LANDBANK OF THE PHILIPPINES
x----------------------------------------------------x
AGUIRRE, D.P.C.:
This resolves a breach notification submitted by Landbank of the Philippines (Landbank) on 06 July 2018 on an incident that allowed an unknown person to open a credit card account using the personal details of a different person.
Facts
On 04 July 2018, MGB submitted a complaint to Landbank for an alleged identity theft.1 According to Mr. MGB, when he applied for an account with another bank, his name appeared in the “negative file” of the Bankers Association of the Philippines (BAP).2 MGB later found out that his name was on the delinquent accounts report because of past credit card dues with Landbank.
In the complaint, MGB alleged that his personal details, including his name, birthdate, gender, and tax identification number, were used in the application for the said credit card without his consent.3
Upon receipt of the complaint, Landbank’s Credit Card Administration Department (CCAD) immediately investigated the incident to validate MGB’s claims.4 Landbank found that there were fictitious information stated in the credit card application. These details include the applicant’s marital status, cellphone number, business, and home addresses, photograph, and signature.5
Thereafter, CCAD requested the deletion of MGB’s name in the list of delinquent accounts with the BAP.6
In a Resolution dated 12 May 2020, the Commission ordered Landbank to submit a full report on the outcomes of the latter’s proposed remedial measures within thirty (30) days from its receipt of the Resolution.
Landbank received the Resolution on 04 February 2021, and on 06 March 2021, submitted a full report on the outcomes of its proposed remedial measures.7
Issue
Whether or not Landbank sufficiently addressed the breach incident and implemented measures to prevent similar incidents in the future.
Discussion
Upon review of Landbank’s full breach report, the Commission finds that the outlined remedial measures of Landbank comply with R.A. 10173 or the Data Privacy Act of 2012, its Implementing Rules and Regulations, and NPC Circular No. 16-03 on Personal Data Breach Management.
Section 17(D) of NPC Circular No. 16-03 provides for the content of the notification to the Commission:
A. Content of Notification. The notification shall include, but not be limited to:
Nature of the Breach
a. description of how the breach occurred and the vulnerability of the data processing system that allowed the breach;
b. a chronology of the events leading up to the loss of control over the personal data;
c. approximate number of data subjects or records involved;
d. description or nature of the personal data breach;
e. description of the likely consequences of the personal data breach; and
f. name and contact details of the data protection officer or any other accountable persons.
Personal Data Possibly Involved
a. description of sensitive personal information involved; and
b. description of other information involved that may be used to enable identity fraud.
Measures Taken to Address the Breach
a. description of the measures taken or proposed to be taken to address the breach;
b. actions being taken to secure or recover the personal data that were compromised;
c. actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident;
d. action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification;
e. the measures being taken to prevent a recurrence of the incident.
The Commission reserves the right to require additional information, if necessary.
In its full breach report, Landbank discussed the actions it had undertaken to mitigate the harm and negative consequences of the reported incident. Aside from the initial investigation by Landbank’s CCAD, its Security Department visited the address presented in the Property Valuation and Credit Information Department’s (PVCID) Credit Information Report. Based on the information gathered from the visit, Landbank concluded that the complainant was indeed a victim of identity theft:
To further investigate the claim of the complainant, SD conducted a visit at [ ] on July 20, 2018, the address appearing in PVCID’s Credit Information Report, and the following information were gathered:
A) No MGB and LG resides in the said address.
B) The male tenant in the said address revealed that in several occasions, various letters from different banks pertaining to Credit Cards and Car Loans were sent to the said address using different names as a recipient.
C) As verified with the President of the Homeowner’s Association, ALE, no MGB nor LG has been registered as member with their association ever since.
D) Upon verification with the Bureau of Internal Revenue (BIR), Petsburgh Company, listed as the alleged employer of MGB in his application form, was not registered in Paranaque but in Bacoor. Also, when the telephone number as indicated in the application form was contacted, the one who answered the phone does not know any “MGB.” As to the mobile number, it can no longer be contacted.
E) Also, the SSS number as indicated in the ID in the Credit Information Report is the number of someone else.
In its report, SD concluded that complainant MGB is a victim of identity theft.8
Landbank also reported the said incident to the PNP-Anti Cybercrime Group in a letter dated 06 July 2018.9
As a form of assistance to MGB, Landbank’s e-Banking Operations Committee (e-BOC) approved the reversal of the outstanding balance of the VISA credit card in Mr. MGB’s name amounting to P122,817.21. It further waived the unbooked charges computed up to the reversal date which amounted to P407,477.05.10
In a letter dated 06 July 2018, Landbank notified MGB of the measures it undertook to address his complaint.11
In the same report, Landbank stated the measures it undertook to prevent the recurrence of the incident:
To address and prevent the recurrence of the said incident, the Branch Banking Sector issued Revised Internal Control Procedures Affecting Branch Operations 2. Section A (3) states:
(f) Credit Card Applications
All prospective applicants to be endorsed by the Branches should be an existing bank depositor to minimize identity fraud.12
The Commission finds that Landbank was able to comply with the requirements of notification when it submitted its full report on 06 March 2021. Moreover, the measures it implemented mitigated the negative consequences of the identity theft incident to the affected data subject. Documents showed that Landbank acted on the breach incident in accordance with the incident response procedure required by NPC Circular No. 16-03.
Lastly, Landbank provided the necessary assistance to the affected data subject when it requested the deletion of MGB’s name in the list of delinquent accounts with the BAP, approved the reversal of the outstanding balance of the VISA credit card in MGB’s name, and waived the unbooked charges computed up to the reversal date.
WHEREFORE, premises considered, this Commission finds that the submission of Landbank of the Philippines in response to the Resolution dated 12 May 2020 is SUFFICIENT. This Commission considers the matter CLOSED.
SO ORDERED.
City of Pasay, Philippines. 29 April 2021.
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
JOHN HENRY D. NAGA Deputy Privacy Commissioner
Copy furnished:
ATTY. RMA
COMPLAINTS AND INVESTIGATION DIVISION
ENFORCEMENT DIVISION
GENERAL RECORDS UNIT