NPC Issuance Wiki

NPC SS 21-006: In re: Wefund Lending Corporation (JuanHand) and its Responsible Officers

Issued Resolution

Resolution Text

IN RE: WEFUND LENDING CORPORATION (JUANHAND) AND ITS RESPONSIBLE OFFICERS INITIATED AS A SUA SPONTE NPC INVESTIGATION INTO THE POSSIBLE DATA PRIVACY VIOLATIONS COMMITTED BY WEFUND LENDING CORPORATION (JUANHAND)

x-------------------------------------x

AGUIRRE, D.P.C.;

This refers to the Temporary Ban on the processing of personal data issued against Wefund Lending Corporation, the owner and operator of the online lending application, JuanHand, and its responsible officers (JuanHand) in an Order dated 12 August 2021.

Facts

On 12 August 2021, the Commission issued an Order imposing a Temporary Ban on the processing of personal data against JuanHand in relation to its online lending application:

WHEREFORE, all these premises considered, this Commission GRANTS the Application for Temporary Ban on the processing of personal data filed by the Complaints and Investigation Division (CID) of the National Privacy Commission. A TEMPORARY BAN ON PROCESSING OF PERSONAL DATA is hereby issued against Respondent Wefund Lending Corporation, as the operator of the online lending application, JuanHand.

Further, pursuant to the TEMPORARY BAN, Respondent Wefund Lending Corporation shall:

  1. Immediately take down its online lending application, JuanHand, to ensure that it is no longer available for download, installation or use by data subjects; and

  2. Stop personal data processing activities, including those activities outsourced to third parties, where the processing operations involves use of information from the phonebook, directory, and contact list of data subjects, disclosure of false or unwarranted information, and other unduly intrusive personal data processing methods.

The TEMPORARY BAN ON PROCESSING OF PERSONAL DATA shall remain in effect until the final resolution of the sua sponte investigation against Respondent and its responsible officers.

Let copies of this Order be furnished to the National Telecommunications Commission for their appropriate action, and Google LLC, which operates the Google Play Store for its compliance in accordance with the terms and conditions of its platform.

Furthermore, Respondent Wefund Lending Corporation and its responsible officers are ORDERED, within ten (10) days from receipt of this Order, to file a COMMENT on the allegations in the attached Fact-Finding Report, pursuant to Section 6 of Rule X of NPC Circular No. 2021-01 (2021 NPC Rules of Procedure).

In case of failure by the Respondent and its responsible officers to file a Comment, this case shall be deemed submitted for resolution based on the evidence on record.

The proceedings before the Commission based on the Fact-Finding Report of the CID, which serves as the Complaint against Respondent Wefund Lending Corporation and its responsible officers, will now resume, pursuant to Section 2, Rule IX of the 2021 NPC Rules of Procedure.

SO ORDERED.1

On 02 September 2021, JuanHand filed a Comment to the Order and Temporary Ban dated 12 August 2021 (Comment).2 It also submitted a test version of the JuanHand online lending application (JuanHand version 4.1.1) for the Commission’s perusal to ensure the version’s compliance with the Data Privacy Act of 2012 (DPA), its Implementing Rules and Regulations, and the Commission’s orders and regulations.3

On 10 September 2021, JuanHand, through counsel Vasig Abarquez Lumauig Abarquez Puno Law Offices, filed an Entry of Appearance with Motion to Admit [Supplemental Comment with Motion for Lifting of Temporary Ban]4 and a Supplemental Comment with Motion for Lifting of Temporary Ban dated 10 September 2021 (Supplemental Comment).5

On 17 September 2021, the Enforcement Division (EnD) of the National Privacy Commission (NPC) sent a letter to JuanHand, through its counsel on record Atty. LAN.6

On 30 September 2021, Atty. LAN filed by email his Withdrawal of Appearance as JuanHand’s counsel.7

On 08 October 2021, JuanHand, through counsel Vasig Abarquez Lumauig Abarquez Puno Law Offices, responded to the EnD’s letter dated 16 September 2021.8

On 17 December 2021, JuanHand filed a Motion to Resolve.9

On 10 January 2022, JuanHand filed a Supplemental Motion to Resolve the matter10 and supplemented its response to the EnD with

a Supplemental Reply and Explanation to the National Privacy Commission Enforcement Division Letter dated 16 September 2021.11

JuanHand explained that it took down the online lending application from Google Play, Apple App Store, and Huawei AppGallery on 25 August 2021, and Vivo Market on 27 August 2021.12 It revised its Service Agreement and Privacy Policy13 and introduced changes in JuanHand Application version 4.1.1 to reflect its compliance with the Commission’s Order dated 12 August 2021.14

Given the measures it took to comply with the 12 August 2021 Order, JuanHand prays that the Commission lift the temporary ban on the processing of personal data issued against Respondents, allow redeployment/reinstatement of the online lending application for availability to the public, and affirm the compliance made by JuanHand and its practices in managing the subject data to be in accordance with the law.15

Discussion

The Commission lifts the Temporary Ban on JuanHand’s processing of personal data.

In the Order dated 12 August 2021, the Commission held that the issuance of the Temporary Ban was warranted due to the undisclosed permissions in the online lending application and JuanHand’s failure

to address the problems discussed by the Complaints and Investigation Division in its Fact-Finding Report (FFR).16 As stated in the FFR:

The capabilities of JuanHand’s system to read the borrower’s calendar events plus confidential information, add or modify calendar events, send email to guests without the owner’s knowledge, read borrower’s contacts, collect data from contacts and pinpoint the borrower’s approximate and precise location through its network and GPS are all unknown to the prospective borrower. The permission information (Annex “B”) is not shown to the users thru prompts or permissions when applying for a loan but was discovered by the CID Technical Team from the Google Play Store and not from the application itself.17

The Commission determined that these undisclosed permissions in the online lending application violated the right of the data subjects to be informed of the data collected from them and the purposes for which they are collected.18

In its efforts to comply with the Order dated 12 August 2021, JuanHand revised its policy on collecting personal data from its data subjects.19 As verified in JuanHand Application version 4.1.1, JuanHand removed the undisclosed permissions identified in the FFR, particularly those allowing access to the data subjects’ calendar, location, contact list, and social networking accounts.20 It also introduced visible pop-up prompts when the online lending application requests the user’s personal data during registration and loan application.21 It established a “What’s New” feature to apprise its data subjects of any changes in the online lending application,

including changes in its Privacy Policy and Service Agreement.22 Finally, it also revised its Service Agreement and prepared a new Privacy Policy to address the concerns raised in the Complaints and Investigation Division’s FFR and the Order dated 12 August 2021.23

Given all these, the Commission finds that JuanHand has sufficiently addressed the reasons for the issuance of the Temporary Ban stated in the 12 August 2021 Order. Rule IX Section 8 of NPC Circular No. 21-01 or the 2021 Rules of Procedure states:

Section 8. Duration of temporary ban. - When issued, the temporary ban on processing of personal data shall remain in effect until the final resolution of the main case, or upon further orders by the Commission or other lawful authority.24

Considering that JuanHand has rectified the issues raised in the FFR and the Order dated 12 August 2021, the Commission finds no reason to continue the temporary ban.

WHEREFORE, premises considered, the Commission LIFTS the Temporary Ban on the processing of personal data issued against Wefund Lending Corporation and its responsible officers.

The lifting of the Temporary Ban on the processing of personal data shall not excuse Wefund Lending Corporation and its responsible officers from any violations of the Data Privacy Act of 2012 and its Implementing Rules and Regulations that may have resulted from their previous actions before and during the time the Temporary Ban was in place.

Let copies of this Resolution be furnished to the National Telecommunications Commission for their appropriate action and Google LLC, which operates Google Play, Apple Inc., which operates the App Store, Huawei Technologies Co., Ltd., which operates AppGallery, for its compliance in accordance with the terms and conditions of its platforms.

SO ORDERED.

City of Pasay, Philippines. 13 January 2022.

I CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

JOHN HENRY D. NAGA Privacy Commissioner

Copy furnished:

VASIG ABARQUEZ LUMAUIG ABARQUEZ PUNO LAW OFFICES Counsel for Wefund Lending Corporation and its Responsible Officers

COMPLAINTS AND INVESTIGATION DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. Order, 12 August 2021, at 17, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  2. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  3. Id. at 1. ↩

  4. Entry of Appearance with Motion to Admit [Supplemental Comment with Motion for Lifting of Temporary Ban], 10 September 2021, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  5. Supplemental Comment with Motion for Lifting of Temporary Ban, 10 September 2021, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  6. Letter from Enforcement Division, National Privacy Commission, Compliance With Order dated 12 August 2021 in NPC SS 21-006 entitled “In re: Wefund Lending Corporation (JuanHand)” to Atty. LAN (16 September 2021). ↩

  7. Email from Atty. LAN, Withdrawal of Appearance to National Privacy Commission (30 September 2021). ↩

  8. Letter from Vasig Abarquez Lumauig Abarquez Puno Law Offices, Reply and Explanation to the National Privacy Commission Enforcement Division Letter dated 16 September 2021, to Enforcement Division, National Privacy Commission (08 October 2021). ↩

  9. Motion to Resolve, 17 December 2021, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  10. Supplemental Motion to Resolve, 10 January 2022, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  11. Letter from Vasig Abarquez Lumauig Abarquez Puno Law Offices, Supplemental Reply and Explanation to the National Privacy Commission Enforcement Division Letter dated 16 September 2021, to Enforcement Division, National Privacy Commission (10 January 2022). ↩

  12. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, at 1, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Motion to Resolve, 17 December 2021, at 4, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  13. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, at 1 - 2, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Comment with Motion for Lifting of Temporary Ban, 10 September 2021, at 11, 15 - 18, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Motion to Resolve, 17 December 2021, at 4 - 5, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Motion to Resolve, 10 January 2022, at 4 - 5, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  14. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, at 2 - 4, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Comment with Motion for Lifting of Temporary Ban, 10 September 2021, at 7 - 8, 11, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Motion to Resolve, 17 December 2021, at 4, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Motion to Resolve, 10 January 2022, at 4, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  15. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, at 7, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Comment with Motion for Lifting of Temporary Ban, 10 September 2021, at 30, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Motion to Resolve, 17 December 2021, at 8, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Motion to Resolve, 10 January 2022, at 8, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  16. Order, 12 August 2021, at 12, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  17. Fact-Finding Report, 9 June 2021, at 5, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  18. Order, 12 August 2021, at 7, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  19. Supplemental Comment with Motion for Lifting of Temporary Ban, 10 September 2021, at 8, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Motion to Resolve, 17 December 2021, at 4, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  20. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, at 3, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Comment with Motion for Lifting of Temporary Ban, 10 September 2021, at 7 - 8, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Motion to Resolve, 17 December 2021, at 4, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Motion to Resolve, 10 January 2022, at 4, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  21. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, at 3, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Comment with Motion for Lifting of Temporary Ban, 10 September 2021, at 11, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Motion to Resolve, 17 December 2021, at 4, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Motion to Resolve, 10 January 2022, at 4, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  22. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, at 4, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Comment with Motion for Lifting of Temporary Ban, 10 September 2021, at 11, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Motion to Resolve, 17 December 2021, at 4, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Motion to Resolve, 10 January 2022, at 4, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  23. Comment to the Order and Temporary Ban dated 01 September 2021, 02 September 2021, at 1 - 2, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Comment with Motion for Lifting of Temporary Ban, 10 September 2021, at 11, 15 - 18, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Motion to Resolve, 17 December 2021, at 4 - 5 in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021); Supplemental Motion to Resolve, 10 January 2022, at 4 - 5, in In re: Wefund Lending Corporation, NPC SS 21-006, (NPC 2021). ↩

  24. National Privacy Commission, 2021 Rules of Procedure, Circular No. 01, Series of 2021 [NPC Circ. No. 21-01], Rule IX § 8 (28 January 2021). Emphasis supplied. ↩

Backlinks

  • No backlinks found