Resolution Text
IN RE: HOME CREDIT CONSUMER FINANCE PHILIPPINES, INC.
x----------------------------------------------------x
NAGA, D.P.C.:
This Resolution refers to the Compliance Letter1 that the Commission received dated 27 November 2020 from Home Credit Consumer Finance Philippines, Inc. (Home Credit) in compliance to this Commission’s Resolution dated 22 October 2020 in relation to the security and confidentiality breach resulting from unauthorized disclosure of personal information of one of their employees.
Facts
On 22 October 2020, this Commission issued a Resolution2 with the following dispositive portion:
WHEREFORE, premises considered, Home Credit Consumer Finance Philippines, Inc. is hereby ORDERED to submit the following documents: (1) Copy of the SMS containing the notification letter; and (2) Proof of receipt of the notification letters that were sent to the affected data subjects within ten (10) days upon receipt of this Resolution. The Full Breach Report dated 12 October 2020 submitted by Home Credit Consumer Finance Philippines, Inc. is hereby NOTED, subject to the recommendations of the Compliance and Monitoring Division and further actions of this Commission.
On 18 November 2020, Home Credit received the abovementioned Resolution.
On 27 November 2020, Home Credit submitted a Compliance Letter as proof of compliance to the Commission’s Resolution which includes the copy of the Short Message Service (SMS) notification with the hyperlink that directs the recipient to the notification letter, copy of the notification letter, and updates on the notification to the affected data subjects.
Discussion
The Commission duly notes Home Credit’s submission of the copy of the SMS notification with the hyperlink that directs the recipient to the notification letter and the copy of the notification letter.
On the proof of receipt of the notification, Home Credit stated in its Compliance that they have no knowledge of an IT solution that provides proof of receipt when an SMS is received by the intended recipient. Further, while other messaging service applications such as Viber, WhatsApp, or Telegram has visual indicators once the message is received and read, such applications are not practical as a large-scale Client Relationship Management (CRM) platform. Home Credit stated that their CRM platform is currently not capable of providing any proof that the SMS was received by the data subjects.3
Additionally, Home Credit outlined the communication process they followed and adopted for the data subject notification. Home Credit stated that they opted for SMS as the communication channel since it was the contact information available for both customers and character reference. Home Credit conducted two (2) batches of notification which includes a small pilot and the final batch consisting with the rest of affected data subjects. Home Credit also mentioned that they note the success of their communication through increased engagement and feedback.4
However, upon the evaluation of their system to determine whether they can provide proof of receipt, their data showed a processing error since only around 13,299 messages were sent from the SMS gateway. Home Credit then scheduled a repeat notification to 72,697 data subjects, however, only 72,593 were forwarded by their SMS service provider while the remaining 104 entries cannot be forwarded since it does not meet the required number of characters.
This Commission finds that Home Credit failed to provide sufficient proof of the data subject’s receipt of notification as previously ordered by this Commission. Home Credit only submitted the system log showing that the notification was sent and resent. While Home Credit argues that NPC Circular 16-03 only imposes a general principle when the notification to data subjects is mandatory, the fact still remain that whether written or electronic, Personal Information Controllers (PICs) have the obligation under the said Circular to establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach.5
Moreover, this Commission stresses that a thorough reading of the NPC Circular 16-03 would reveal that the responsibility of the PICs to notify the affected data subjects is not limited to sending the notification to the affected data subjects alone, but comes hand-in-hand with the responsibility of using secure means of communication and providing all reasonable mechanisms to guarantee that the notification reaches the affected data subjects they intend to notify. Such obligation is regarded by this Commission as crucial and necessary for PICs to establish, especially in cases that falls under the mandatory breach notification requirement.
Time and time again, this Commission reminds PICs of the purpose in notifying the affected data subjects, which is to allow them to take the necessary precautions to protect themselves against the possible risk of serious harm resulting from the breach; wherein such purpose and objective is defeated once PICs failed to establish all reasonable mechanisms to ensure that the affected data subjects are informed of the breach.
WHEREFORE, premises considered, Home Credit Consumer Finance Philippines, Inc. is hereby ORDERED to submit, within fifteen (15) days upon receipt of this Resolution, an affidavit stating that the recipients of the SMS notification are active users and that the users’ numbers indicated in Home Credit’s system are all active.
Further, in the event that Home Credit Consumer Finance Philippines, Inc. will determine inactive users, they shall provide the notification to the affected data subjects who are inactive through alternative means as provided in NPC Circular 16-03.
SO ORDERED.
Pasay City, Philippines; 17 December 2020.
JOHN HENRY D. NAGA Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
Copy furnished:
RBS Data Protection Officer
Home Credit Consumer Finance Philippines, Inc.
COMPLIANCE AND MONITORING DIVISION
ENFORCEMENT DIVISION
GENERAL RECORDS UNIT