NPC Issuance Wiki

CID BN 17-019: In re: Sun Life of Canada (Philippines), Inc.

Issued Resolution

Resolution Text

IN RE: SUN LIFE OF CANADA (PHILIPPINES), INC.

x-------------------------------------------x

AGUIRRE, D.P.C.:

This Resolution refers to the clarification of Sun Life of Canada (Philippines), Inc. (“Sun Life”) dated 5 September 20191 stating that its Breach Notification Report submitted on 14 October 20172 to the National Privacy Commission (“Commission”) is already its Full Breach Report regarding the data breach incident involving ninety-three (93) policy owners and one hundred twelve (112) policies.

Facts

On 9 October 2017, a Sun Life advisor’s five (5) year old child accidentally spilled milk over an envelope containing a Premium Due List.3 To avoid being reprimanded, the child threw the envelope into the trash bin. The garbage collector collected the bin with the envelope containing the list.4

On 12 October 2017, the advisor learned of the incident and immediately sent an e-mail to Sun Life’s Compliance team.5 However, the advisor was unable to recover the list from the garbage collector.6

On 14 October 2017, Sun Life submitted to the Commission a Breach Notification Report7 narrating the incident. It also provided that the personal data involved in the incident are the following:

  1. Policy Number;
  2. Client Name (Policy Owner/Insured);
  3. Policy Name;
  4. Face Amount;
  5. Premium Due Date;
  6. Premium Amount;
  7. Issue Date; and
  8. Status of the Policy.8

Sun Life has also undertaken the following measures to address the breach:

  1. Monitor the policies for any unusual activity; and
  2. To avoid recurrence of the incident, the advisor agreed to keep her files organized and secured when unattended.9

In view of the foregoing, Sun Life requested to be exempted from notifying its policyholders of the incident based on the following grounds:

  1. The information contained in the policy/premium list does not contain sensitive personal information or information that may be used to enable identity fraud;
  2. It is unlikely that the incident will give rise to a real risk of harm to the rights and freedoms of the policyholders in view of the controls in place in policy amendment, withdrawal or cancellation; and
  3. A notification would not be in the best interest of the affected policyholders and may cause undue alarm.10

On 29 July 2019, the Commission issued a Resolution11 granting the request for exemption from notifying the affected data subjects, and ordering Sun Life to submit a full report on its breach management within thirty (30) days from receipt of the Resolution.

On 5 September 2019, Sun Life submitted a letter12 clarifying to the Commission that the report it submitted on 14 October 2017 was not a preliminary report, but its final breach report. It again furnished the Commission with the report and reiterated the breach management actions it has undertaken. It also informed the Commission that it has not received any concern relating to the incident.

On 10 August 2020, the Enforcement Division issued its findings on the breach report, stating:

Upon assessment of the breach report, this Division found that the measures undertaken and the notification sent complies with R.A. 10173 or the Data Privacy Act, its Implementing Rules and Regulations, and specifically NPC Circular 16-03 on Personal Data Breach Management (Circular).

Taking into consideration the actions taken by Sun Life immediately after the breach and its remedial measures, this Division assessed that Sun Life acted on the breach incident in accordance with the incident response procedure required by the Circular.

Discussion

The Commission hereby finds the Breach Notification Report dated 14 October 2017 of Sun Life sufficient and considers this matter closed.

Section 17(D) of NPC Circular 16-0313 provides that the Notification shall include, but not be limited to:

  1. Nature of the Breach a. description of how the breach occurred and the vulnerability of the data processing system that allowed the breach; b. a chronology of the events leading up to the loss of control over the personal data; c. approximate number of data subjects or records involved; d. description or nature of the personal data breach; e. description of the likely consequences of the personal data breach; and f. name and contact details of the data protection officer or any other accountable persons.

  2. Personal Data Possibly Involved a. description of sensitive personal information involved; and b. description of other information involved that may be used to enable identity fraud.

  3. Measures Taken to Address the Breach a. description of the measures taken or proposed to be taken to address the breach; b. actions being taken to secure or recover the personal data that were compromised; c. actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident; d. action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification; e. the measures being taken to prevent a recurrence of the incident.

The Commission reserves the right to require additional information, if necessary.

In the Breach Notification Report of Sun Life dated 14 October 2017,14 it has already indicated the Nature of the Breach, the Personal Data Involved, and the Measures Taken to Address the Breach. The Commission has also not required additional information from Sun Life.

WHEREFORE, premises considered, the instant case, CID BN 17-019, In Re: Sun Life of Canada (Philippines), Inc., is hereby CLOSED.

SO ORDERED.

Pasay City, Philippines; 20 August 2020

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

RAYMUND ENRIQUEZ LIBORO Privacy Commissioner

JOHN HENRY D. NAGA Deputy Privacy Commissioner

Copy furnished:

JSC Data Protection Officer

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Breach Notification Report of Sun Life Canada (Philippines), Inc. dated 5 September 2019. ↩

  2. Breach Notification (NPC-SLOCPI-2017-02) dated 14 October 2017. ↩

  3. Ibid. ↩

  4. Ibid. ↩

  5. Ibid. ↩

  6. Ibid. ↩

  7. Ibid. ↩

  8. Ibid. ↩

  9. Ibid. ↩

  10. Ibid. ↩

  11. Resolution In Re: Breach Notification Report of Sun Life of Canada (Philippines), Inc. dated 29 July 2019. ↩

  12. Supra note 1. ↩

  13. Personal Data Management Breach dated 15 December 2016. ↩

  14. Supra note 2. ↩

Backlinks

  • No backlinks found