NPC Issuance Wiki

NPC BN 17-020 and BN 17-029: In re: Breach Notification Report of Sun Life of Canada (Philippines)

Issued Resolution

Resolution Text

IN RE: BREACH NOTIFICATION REPORT OF SUN LIFE OF CANADA (PHILIPPINES)

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is the Compliance of Sun Life of Canada (Philippines), Inc. (Sun Life) dated 21 July 2022 (Compliance) in relation to the 22 July 2019 Resolution of the Commission (Resolution).

Facts

On 15 October 2017, Sun Life filed a personal data breach notification, which was docketed as NPC BN 17-020.1 On 10 November 2017, Sun Life filed a consolidated personal data breach notification via e-mail, attaching therein its updated report of its previous notification.2 This updated report was docketed as NPC BN 17-029.3 Sun Life reported that three (3) advisors were able to download production reports of other advisors.4 In another update dated 14 December 2017, Sun Life reported that there were six (6) advisors who were able to download production reports during the period of 11 October to 12 December 2017.5

The production reports contained the following information: insured name, policy number, advisor’s name and contract date, advisor’s submitted and settled application, agency credit, net sales credit, first year premium, and renewal premium income.6 Sun Life claimed that the production reports “[did] not contain sensitive personal information or information that may be used to enable identity fraud.”7 However, Sun Life noted that the “[net sales credit] may be considered an indication of an advisor’s financial or economic situation.”8 It requested the Commission for exemption from notifying its clients and advisors.9

In a Resolution dated 22 July 2019, the Commission granted Sun Life’s request, and further ordered it to submit a full report on its breach management:

WHEREFORE, premises considered, this Commission GRANTS the request for exemption to notify affected data subjects, and ORDERS Sun Life of Canada (Philippines) to submit full report on its breach management within thirty (30) days from receipt of this Order.

SO ORDERED.10

On 09 September 2019, Sun Life submitted a letter as compliance to the Resolution.11 In the letter, Sun Life provided updates on the steps taken to address the breach, and manifested that “from 2017 to date, no similar incidents were reported.”12

Sun Life likewise reported that it had launched a new Advisor’s Home Office to replace the Agent’s Portal, with the new platform addressing the issues encountered in the old platform.13

The Commission, through its Enforcement Division (EnD), issued a letter dated 11 October 2019, reiterating the directive to submit a full report on its breach management consistent with Section 9 of NPC Circular 16-03 (Personal Data Breach Management).14

Subsequently, in a letter dated 13 July 2022, the EnD directed Sun Life to submit its full report on its breach management after finding that Sun Life still had not complied with the Commission’s order.15

On 21 July 2022, Sun Life submitted its Compliance providing details on the description of the personal data breach, its root cause, and circumstances regarding its discovery.16 The Compliance also provided information on the incident response team’s actions and decisions, and outcome of the breach management.17

Issue

Whether Sun Life is compliant with the Resolution dated 22 July 2019 of the Commission.

Discussion

The Commission finds that Sun Life sufficiently complied with the Commission’s Resolution dated 22 July 2019.

To reiterate, Sun Life was ordered to submit a full report on its breach management.18

Rule IV, Section 9 of the NPC Circular No. 16-03 (Personal Data Breach Management) provides:

SECTION 9. Documentation. All actions taken by a personal information controller or personal information processor shall be properly documented. Reports should include:

A. Description of the personal data breach, its root cause and circumstances regarding its discovery; B. Actions and decisions of the incident response team; C. Outcome of the breach management, and difficulties encountered; and D. Compliance with notification requirements and assistance provided to affected data subjects.

A procedure for post-breach review must be established for the purpose of improving the personal data breach management policies and procedures of the personal information controller or personal information processor.19

In its Compliance, Sun Life was able to provide the description of the personal data breach wherein six (6) advisors were able to download the production reports of other advisors in 2017.20 Sun Life also identified that the root cause of the personal data breach was its inadequate software.21 Sun Life further supplied the timeline of events that led to the discovery of the breach, starting on 11 October 2017 up to 12 December 2017, including a timeline of its corresponding actions.22

Sun Life enumerated the actions of its incident response team. First, “all advisors confirmed deletion of production reports that may have been retained during the session.”23 Moreover, Sun Life reported:

[T]he IT team installed a system enhancement which required an advisor who was logged out of a session to log back on with his credentials via the login page. The advisor would not be allowed to continue the session without logging back to ensure that the advisor’s correct credentials were used.24

Further, “the IT team enhanced the process in implementing emergency fixes to avoid the risk of using an improper code base.”25

As a result of the foregoing actions made, Sun Life assured that there were no similar incidents reported for the Agent’s Portal until the Advisor Home Office was launched by the end of 2019.26 Sun Life stated that the new system addressed the issues encountered in the Agent’s Portal and that the controls were tested prior its deployment to avoid any recurrence.27

With regard to the notification requirements, it should be noted that the Commission, in its Resolution, granted Sun Life’s request for exemption from notifying the affected data subjects.28

Lastly, Sun Life expressed that its “advisors are bound by strict contract rules and Market Conduct regulations that require them to protect client data and treat the same with the utmost confidentiality.”29

After scrutinizing the information provided by Sun Life, the Commission finds that these are compliant with the EnD’s Compliance letter dated 13 July 2022 requiring Sun Life to submit its full report in consonance with Rule IV, Section 9 of NPC Circular No. 16-03. There was sufficient information on the description of the personal data breach, with its root cause and discovery; the incident response team’s actions and decisions; and the outcome of the breach management.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 17-020 and BN 17-029 “In re: Sun Life of Canada (Philippines), Inc.” is hereby considered CLOSED.

SO ORDERED.

City of Pasay, Philippines. 22 September 2022.

JOHN HENRY D. NAGA Privacy Commissioner

I CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

Copy furnished:

JSC Data Protection Officer Sun Life of Canada (Philippines), Inc.

ATC Chief Compliance Officer Sun Life of Canada (Philippines), Inc.

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. See In re: Breach Notification Report of Sun Life of Canada (Philippines), NPC BN 17-020 and 17-029, Resolution dated 22 July 2019, at p. 1. ↩

  2. Electronic mail dated 10 November 2017 from Sun Life of Canada (Philippines), Inc. ↩

  3. See In re: Breach Notification Report of Sun Life of Canada (Philippines), NPC BN 17-020 and 17-029, Resolution dated 22 July 2019, at p. 1. ↩

  4. Breach Notification Report dated 10 November 2017 of Sun Life of Canada (Philippines), Inc., at pp. 2–3. ↩

  5. See Compliance dated 21 July 2022 of Sun Life of Canada (Philippines), Inc. in Description of the personal data breach, at p. 2; 2nd Update to Breach Notification, at pp. 8–12. ↩

  6. Breach Notification Report dated 10 November 2017 of Sun Life of Canada (Philippines), Inc., at p. 4. ↩

  7. Id. ↩

  8. Id. ↩

  9. Id., at p. 5. ↩

  10. In re: Breach Notification Report of Sun Life of Canada (Philippines), NPC BN 17-020 and 17-029, Resolution dated 22 July 2019, at p. 1. ↩

  11. Breach Notification Report dated 05 September 2019 of Sun Life of Canada (Philippines), Inc. ↩

  12. Id., ¶¶ 1–2. ↩

  13. Id., ¶ 3. ↩

  14. Compliance Letter dated 11 October 2019 of Enforcement Division, at p. 2. ↩

  15. Compliance Letter dated 13 July 2022 of Enforcement Division, at p. 2. ↩

  16. Compliance Letter dated 21 July 2022 of Sun Life of Canada (Philippines), Inc., at pp. 2–4. ↩

  17. Id., at pp. 4–5. ↩

  18. In re: Breach Notification Report of Sun Life of Canada (Philippines), NPC BN 17-020 and 17-029, Resolution dated 22 July 2019, at p. 1. ↩

  19. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule IV, § 9 (15 December 2016). ↩

  20. Compliance dated 21 July 2022 of Sun Life of Canada (Philippines), Inc. in Description of the personal data breach, its root cause and circumstances regarding its discovery, at p. 2. ↩

  21. Id., at p. 3. ↩

  22. Id., at pp. 3–4. ↩

  23. Id., in Actions and decisions of the incident response team, at pp. 4–5. ↩

  24. Compliance dated 21 July 2022 of Sun Life of Canada (Philippines), Inc., at p. 5. ↩

  25. Id. ↩

  26. Id., in Outcome of the breach management, and difficulties encountered, at p. 5. ↩

  27. Id., at p. 5. ↩

  28. In Re: Breach Notification Report of Sun Life of Canada (Philippines), Inc., NPC BN 17-020 and BN 17-029, Resolution dated 22 July 2019, at p. 1. ↩

  29. Compliance dated 21 July 2022 of Sun Life of Canada (Philippines) Inc. in Outcome of the breach management, and difficulties encountered, at p. 5. ↩

Backlinks

  • No backlinks found