NPC Issuance Wiki

NPC BN 17-027: In re: Sun Life of Canada (Philippines), Inc.

Issued Resolution

Resolution Text

IN RE: BREACH NOTIFICATION REPORT OF SUN LIFE OF CANADA (PHILIPPINES), INC.

x----------------------------------------------------x

AGUIRRE, D.P.C.;

Before the Commission is the Compliance dated 11 March 2020 submitted by Sun Life of Canada (Philippines), Inc. (Sun Life) in fulfillment of the directive in the Resolution dated 25 July 2019.1

Facts

On 25 July 2019, the Commission issued a Resolution denying Sun Life’s request for exemption from notification of data subject upon finding that notification to a single data subject, who is a client of Sun Life, “would not involve costly and disproportionate effort.”2 The dispositive portion of the Resolution states:

WHEREFORE, this Commission DENIES the request for exemption from the notification requirements, and ORDERS Sun Life of Canada (Philippines) to NOTIFY affected data subject.

Sun Life is further ORDERED to submit a full breach report, including details of notification, thirty (30) days from receipt of this Order.

SO ORDERED.3

On 05 September 2019, Sun Life submitted a letter seeking reconsideration of the Resolution.4 It argued that the notification would only cause “undue alarm” to the data subject considering that the data subject’s accounts have remained intact and that no related complaints have been received since the incident was reported.5 It further claimed that “it is not likely that the information inadvertently disclosed will be used for fraud.”6

On 24 October 2019, the Commission issued a Resolution denying Sun Life’s request for reconsideration since there was no sufficient ground to overturn the Resolution dated 25 July 2019.7

On 18 April 2022, the National Privacy Commission’s Enforcement Division (EnD) sent a letter to Sun Life instructing it to comply with the Resolution dated 15 July 2019 and to submit proof of notification to the affected data subject.8

Sun Life responded to the EnD’s letter and reported that it submitted its compliance on 11 March 2020 after it notified the affected data subject.9 It also submitted a copy of its Compliance dated 11 March 2020 and copies of the email dated 11 March 2020 and the letter dated 09 March 2020 that it sent to the affected data subject.10

The Compliance Report dated 11 March 2020 specified that Sun Life completed all the measures it claimed to have initiated to address the breach.11 These measures included the following:

  • Data fix was done in client portal database to correct the email addresses of the affected clients.
  • Email addresses of both clients were updated in system.
  • The client who was able to access the other client’s policy information was instructed to delete any information he may have copied or downloaded from the portal.
  • Sun Life’s IT department has checked for similar occurrences and none were found.
  • Sun Life’s Client Portal controls were enhanced, such that: 1) a client can only have one username, and 2) improvement of audit logs were made in the new Client portal.12

Further, the Compliance Report dated 11 March 2020 stated that Sun Life notified the affected data subject on 09 March 2020.13

In its letter sent to the affected data subject, Sun Life provided information about the incident and the data subject’s personal information involved in the breach.14 It further assured the data subject that it immediately corrected the error, that the data subject’s account has been secured, and that no unauthorized transaction was made.15 It also provided contact details in case the data subject would need more information or assistance.16

Issue

Whether Sun Life complied with the Resolution dated 25 July 2019.

Discussion

The Commission resolves to close the case upon finding that Sun Life has complied with the Resolution dated 25 July 2019.

The information provided in the Compliance Report dated 11 March 2020 and the attached copies of the email and the letter sent to the affected data subject are deemed sufficient to prove that Sun Life adequately notified the affected data subject of the details of the breach.

Sun Life’s letter dated 09 March 2020 included the information required under NPC Circular 16-03 (Personal Data Breach Management).

Section 18 (C) of NPC Circular 16-03 provides:

Section 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

…

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.17

The letter specified the nature of the breach as it reported the processing error that resulted in the consolidation of the data subject’s policies with another client.18 It further identified the personal information of the data subject that Sun Life sent by mistake to the other client, particularly his name, address, birthdate, policy number, due date, total accumulated dividends, and cash surrender value.19

Sun Life assured the data subject that it has corrected the error and has secured the account of the data subject through its authentication process.20 It also advised the data subject to update his password if it included any of the disclosed personal information.21 It also included its contact details where the data subject can ask for additional information or assistance.22

Given the foregoing, the Commission finds that Sun Life has sufficiently notified the affected data subject of the breach.

In addition to this, the Commission notes the measures Sun Life took to address the breach as enumerated in the Compliance Report dated 11 March 2020.

WHEREFORE, premises considered, Commission resolves that NPC BN 17-027 – In Re: Sun Life of Canada (Philippines), Inc. is hereby CLOSED.

SO ORDERED.

City of Pasay, Philippines.

22 September 2022.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

I CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

Copy furnished:

ATC

Chief Compliance Officer

MJC

Data Protection Officer

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Letter re: Resolutions of the Commission En Banc dated 25 July 2019 and 24 October 2019 (NPC BN No. 17-027 “In Re: Breach Notification Report of Sun Life of Canada (Philippines), Inc.”, 05 May 2022, Annex A, in In Re: Sun Life of Canada (Philippines), Inc., NPC BN 17-027 (NPC 2022). ↩

  2. NPC BN 17-027, 25 July 2019, at 2 (NPC 2019) (unreported). ↩

  3. NPC BN 17-027, 25 July 2019 (NPC 2019) (unreported). ↩

  4. Letter Re: Breach Notification Report of Sun Life of Canada (Philippines), Inc., 05 September 2019, in In Re: Sun Life of Canada (Philippines), Inc., NPC BN 17-027 (NPC 2022). ↩

  5. Id. ↩

  6. Id. ↩

  7. NPC BN 17-027, 24 October 2019, (NPC 2019) (unreported). ↩

  8. Letter Re: Resolutions of the Commission En Banc dated 25 July 2019 and 24 October 2019 (NPC BN 17-027) “In Re: Breach Notification Report of Sun Life of Canada (Philippines), Inc.”, 18 April 2022, in In Re: Sun Life of Canada (Philippines), Inc., NPC BN 17-027 (NPC 2022). ↩

  9. Letter re: Resolutions of the Commission En Banc dated 25 July 2019 and 24 October 2019 (NPC BN No. 17-027 “In Re: Breach Notification Report of Sun Life of Canada (Philippines), Inc.”, 05 May 2022, in In Re: Sun Life of Canada (Philippines), Inc., NPC BN 17-027 (NPC 2022). ↩

  10. Id. Annex A and B. ↩

  11. Letter re: Resolutions of the Commission En Banc dated 25 July 2019 and 24 October 2019 (NPC BN No. 17-027 “In Re: Breach Notification Report of Sun Life of Canada (Philippines), Inc.”, 05 May 2022, Annex A, in In Re: Sun Life of Canada (Philippines), Inc., NPC BN 17-027 (NPC 2022). ↩

  12. Id. ↩

  13. Id. ↩

  14. Id. Annex B. ↩

  15. Id. ↩

  16. Id. ↩

  17. National Privacy Commission, Personal Data Breach Management, Circular No. 3, Series of 2016 [NPC Circ. No. 16-03], §18 (C) (15 December 2016). ↩

  18. Letter re: Resolutions of the Commission En Banc dated 25 July 2019 and 24 October 2019 (NPC BN No. 17-027 “In Re: Breach Notification Report of Sun Life of Canada (Philippines), Inc.”, 05 May 2022, Annex B, in In Re: Sun Life of Canada (Philippines), Inc., NPC BN 17-027 (NPC 2022). ↩

  19. Id. ↩

  20. Id. ↩

  21. Id. ↩

  22. Id. ↩

Backlinks

  • No backlinks found