Resolution Text
IN RE: SUN LIFE GREPA FINANCIAL, INC.
x-----------------------------------------------------x
NAGA, D.P.C.:
This refers to the submission of Sun Life Grepa Financial, Inc. (SLGFI) of the copy of notification letter that was sent to the affected data subject in compliance with the Order of this Commission dated 15 October 2020.
Facts
On 15 October 2020, the Commission issued a Resolution disposing, thus:
WHEREFORE, premises considered, this Commission ORDERS Sun Life Grepa Financial, Inc. to SUBMIT a copy of the notification letter that was sent to the affected data subject within five (5) days from receipt of this Order.
The Full Breach Report dated 12 October 2020 submitted by Sun Life Grepa Financial, Inc. is hereby NOTED, subject to the recommendations of the Compliance and Monitoring Division and further action of this Commission.
On 19 November 2020, this Commission received SLGFI’s submission of the copy of notification letter dated 12 October 2020 that was sent to the affected data subject. The letter was divided in three major parts, namely: description of the incident, measures that SLGFI had taken to address the breach, and the assistance that SLGFI can provide to the affected data subjects.
Discussion
Evaluating the current submission of SLGFI, together with the Compliance letter dated 12 October 2020 and the Supplemental Report dated 13 October 2020, this Commission finds the totality of SLGFI’s submission to be compliant with the requirements of NPC Circular 16-03.
In the 15 October 2020 Order of the Commission, we noted that SLGFI’s submission to be incomplete due to the non-attachment of the notification letter that was sent to the affected data subjects. Upon review of the submitted notification, this Commission now finds the contents to satisfy the requirements of Section 18 (C) of NPC Circular 16-031.
WHEREFORE, premises considered, this Commission finds SLGFI’s notification letter dated 12 October 2020 to be COMPLIANT with the requirements of NPC Circular 16-03.
Pending the review of this Commission’s Compliance and Monitoring Division (CMD) on the full breach report of SLGFI, the matter on data subject notification is hereby considered to be a closed matter.
SO ORDERED.
Pasay City, Philippines; 26 November 2020.
JOHN HENRY D. NAGA Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
Copy furnished:
JSC Data Protection Officer
COMPLIANCE AND MONITORING DIVISION GENERAL RECORDS UNIT
Footnotes
-
Content of Notification. The notification shall include, but not be limited to: 1. nature of the breach; 2. personal data possibly involved; 3. measures taken to address the breach; 4. measures taken to reduce the harm or negative consequences of the breach; 5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and 6. any assistance to be provided to the affected data subjects. Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay. ↩