NPC Issuance Wiki

NPC BN 18-199: In re: HC Consumer Finance Philippines, Inc.

Issued Resolution

Resolution Text

IN RE: HC CONSUMER FINANCE PHILIPPINES, INC.

NPC BN 18-199

x-----------------------------------------------------x

NAGA, P.C.:

This Resolution refers to the Breach Notification dated 23 October 2018 of HC Consumer Finance Philippines, Inc. (HC).

Facts

On 23 October 2018, HC Consumer Finance Philippines, Inc. notified the National Privacy Commission (Commission) through a letter regarding a breach incident involving its sales agent, FM (FM).1 In its report, HC stated that FM processed the loan application of RBB (RBB) at AVR Full Hauz Furniture Inc. – Roxas City which was subsequently approved. On 10 September 2018, FM resigned from HC.2

Thereafter, on 14 September 2018, HC’s Investigation Security Support Team detected a possible identity theft.3 The investigation was prompted by a report filed by RBB regarding the loan collection efforts of HC.4 In its investigation, it showed that RBB did not continue with her approved loan application instead FM had “colluded with another person to continue” the said loan application.5 Accordingly, an “unidentified individual claimed the

commodity subject of the loan” and someone is paying for the installments of the loan amount.6 HC has also concluded that the incident was an identity theft.7

In its report, HC stated that FM was already reported in the Human Resource-Employee Relation and that he is ineligible for rehire.8 It also stated that it is assessing the incident and filing a criminal complaint against FM.9 Further, to address the breach, HC stated that their retailers were being oriented to verify by matching the clients’ faces and names with the documents presented before releasing the commodity of the loan.10 As an additional measure to prevent any fraud, a photo of the client holding the welcome kit and the commodity is being taken.11 Lastly, HC’s Back Office Team was tasked to cross-check the photo with the documents submitted.12

On 26 October 2020, the Commission, through its Complaints and Investigation Division (CID), issued an Order directing HC to submit its “Full Report expounding the details of the incident with emphasis supplied on the lacking information from the initial notification” dated 23 October 2018.13

On 04 November 2020, HC submitted its compliance to the Order dated 26 October 2020.14 In its Updated Report on Identity Theft, HC stated that it called RBB on 14 September 2018 to collect the loan, however, the latter insisted that she does not have any loan and that despite the approval of the loan, RBB backed out of the loan application and paid in full amount in cash for the videoke set she purchased.15

Further, HC stated that based on its internal investigation it “showed that the sales agent continued processing the loan and released the commodity covered by such loan to an unknown person, in clear violation of the client’s authorization and Home Credit policies and procedure.16

HC also stated there is one data subject and the personal information involved in the incident are “name, address, mobile number, marital status, age, educational attainment, National Senior Citizens Card and voter’s ID” which were collected in compliance with the Know-Your-Customer (KYC) rules provided by the Bangko Sentral ng Pilipinas.17

HC also claimed that it already notified the affected data subject, and her contact information was already deleted.18 It also claimed that there was no loss of control over the personal data involved and that there was no disclosure to an unauthorized person.19

On 23 April 2022, the NPC CID issued an Order directing HC to submit a Post-Breach Report.20

On 11 May 2022, HC submitted its compliance to the Order dated 23 April 2022.21 In its submission, HC attached a copy of its Contract Receiving, Registration and Archiving Work Instruction, Data Privacy Manual and Partner Privacy Manual, Access Control Management Manual, Policy on IT Security Management, Policy on IT Acceptable Use, a copy of its 2021 Annual Data Privacy Training, notification issued to the affected data subject, and a screenshot photo to proof that the information of RBB was indeed deleted in HC’s system.22

On 12 July 2022, the NPC CID issued an Order directing HC to submit its Supplemental Post-Breach Report.23

On 01 August 2022, HC submitted its Compliance to the Order dated 12 July 2022.24 HC has submitted its proof of the implementation of the remedial measures it took after the incident such as its retailer’s orientation on verifying the client’s face and its submitted documents, photo of its clients holding the welcome kit and commodity of the loan, and its Back Office Team in cross-checking the documents submitted and the photo of the client holding the commodity.25 Lastly, HC has submitted its proof of sending of data subject notification.26

Issue

Whether HC has sufficiently addressed the breach and implemented appropriate measures pursuant to NPC Circular 16-03 (Personal Data Breach Management).

Discussion

The Commission deems it proper to close and terminate the case.

HC complied with the directives of the Commission. It has implemented sufficient security measures to address the incident and notified the affected data subject.

As to the security measures it implemented, HC’s agents were reoriented to verify the client’s face by matching the submitted documents before releasing the subject commodity of approved loans. The photos of the clients holding the welcome kit and the

commodity were also taken as additional measures to prevent any other fraudulent schemes.27

Further, HC has notified the affected data subject following Rule V, Section 18 (C) and (D) NPC Circular 16-03.

SECTION 18. Notification of Data Subjects.

The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.

D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.28

(Emphasis Supplied)

In its data subject notification sent through a letter via the registered mailing address of the affected data subject, HC informed RBB of the incident as a precautionary measure.29 It also stated in its notification that the latter’s data such as “date of birth, home address, permanent address, email, landline, mobile number, and identity contact numbers” were involved in the incident.30

Furthermore, HC has deleted the contact information of RBB to prevent any further notification regarding the loan. To mitigate any potential harm that might arise from the incident, HC also reminded RBB to take necessary precautions in addition to the measures it will implement.31

Additionally, HC provided its Customer Service Hotline and an email address to report any unauthorized or suspicious activity involving the personal data of RBB.32 However, HC stated in its Supplemental Post Breach Report dated 01 August 2022, that it did not receive any inquiries or responses from RBB.33

As to the notification to the Commission, HC submitted its full breach report dated 04 November 2020. Rule V, Section 17 (D) of the NPC Circular 16-03 provides:

D. Content of Notification. The notification shall include, but not be limited to:

  1. Nature of the Breach

a. description of how the breach occurred and the vulnerability of the data processing system that allowed the breach; b. a chronology of the events leading up to the loss of control over the personal data; c. approximate number of data subjects or records involved; d. description or nature of the personal data breach; e. description of the likely consequences of the personal data breach; and f. name and contact details of the data protection officer or any other accountable persons.

  1. Personal Data Possibly Involved

a. description of sensitive personal information involved; and b. description of other information involved that may be used to enable identity fraud.

  1. Measures Taken to Address the Breach

a. description of the measures taken or proposed to be taken to address the breach; b. actions being taken to secure or recover the personal data that were compromised; c. actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident; d. action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification; e. the measures being taken to prevent a recurrence of the incident.

The Commission reserves the right to require additional information, if necessary.34

In the submitted Full Breach Report dated 04 November 2020, HC classified the incident as a personal data breach arising from a violation of its policies and procedures.35 It also reiterated the chronological event of the incident and stating on how the breach transpired and claimed that only RBB was affected by the incident.36

HC asserted that there is no indication of loss of control over the personal data and disclosure to an unauthorized person.37 It stated that it has also “absorbed the financial impact of the fraud by cancelling collections activities and writing off the debt” as a result of the unauthorized processing of the loan.38

In addition, HC also provided in its report the measures it took to address the breach, including the conduct of orientation on verifying the identities of its clients with its submitted documents before releasing the commodity.39 It also stated that it provided data subject assistance by notifying RBB of the incident, deleting the contact information to prevent any further notification regarding the loan, and to report any suspicious activity which may involve her personal data.40

Subsequently, HC also submitted its Supplemental Post-Breach Report dated 01 August 2022.41 It provided the proof of implemented measures it undertook after the incident including orientation on its employees in verifying the identities of its clients, proof of data subject and notification, and other related documents in addressing the breach incident.42 HC also submitted the presentation of trainings it provided to its employees in verifying the identity of its customers and manual of procedures on reporting data breach incidents.43

Moreover, HC stated that there was a same investigation report from their Anti-Fraud Department and Compliance Department.44 It further stated that it treated the incident as a case of internal fraud, considering that there is similar finding with its Investigation Security Support.45

Thus, HC has sufficiently complied with the notification requirements pursuant to NPC Circular No. 16-03 in compliance with the directives of the Commission as indicated in its Orders dated 26 October 2020, 23 April 2022, and 12 July 2022.

Considering the foregoing, the Commission finds that since HC has already complied with the directives of the Commission and has already complied with NPC Circular 16-03 (Personal Data Breach Management), it deems it proper to close and terminate the case.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-199 “In re: HC Consumer Finance Philippines, Inc. is hereby considered CLOSED.

SO ORDERED.

Pasay City, Philippines.

17 August 2023.

JOHN HENRY D. NAGA

Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy Furnished:

RBP

Data Protection Officer

HC CONSUMER FINANCE PHILIPPINES, INC.

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Letter dated 23 October 2018 “Identity Theft dated May 01, 2018 of Data Breach Notification No. 2018-003” from HC Consumer Finance Philippines, Inc. ↩

  2. Id. ↩

  3. Id. ↩

  4. Id. ↩

  5. Letter dated 23 October 2018 “Identity Theft dated May 01, 2018 of Data Breach Notification No. 2018-003” from HC Consumer Finance Philippines, Inc. ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. Letter dated 23 October 2018 “Identity Theft dated May 01, 2018 of Data Breach Notification No. 2018-003” from HC Consumer Finance Philippines, Inc. ↩

  10. Id. ↩

  11. Id. ↩

  12. Id. ↩

  13. Order dated 26 October 2020 ↩

  14. Letter dated 04 November 2020 “Updated Report on Identity Theft (NPC BN-199)” from HC Consumer Finance Philippines, Inc. ↩

  15. Id. ↩

  16. Id. ↩

  17. Id. ↩

  18. Letter dated 04 November 2020 “Updated Report on Identity Theft (NPC BN-199)” from HC Consumer Finance Philippines, Inc. ↩

  19. Id. ↩

  20. Order dated 23 April 2022 ↩

  21. Electronic Mail from HC Consumer Finance Philippines, Inc. dated 11 May 2022 ↩

  22. Id. ↩

  23. Order dated 12 July 2022 ↩

  24. Letter dated 01 August 2022 “Supplemental Post-Breach Report on NPC BN 18-199” from HC Consumer Finance Philippines, Inc. ↩

  25. Id. ↩

  26. Id. ↩

  27. Id. ↩

  28. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18 (C) (D) (15 December 2016) (NPC Circular 16-03). ↩

  29. Letter dated 23 October 2018, from HC Consumer Finance Philippines, Inc. (Data Subject Notification) Annex (I) ↩

  30. Id. ↩

  31. Id. ↩

  32. Id. ↩

  33. Letter dated 01 August 2022 “Supplemental Post-Breach Report on NPC BN 18-199” from HC Consumer Finance Philippines, Inc. ↩

  34. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 17(D) (15 December 2016) (NPC Circular 16-03). ↩

  35. Letter dated 04 November 2020 “Updated Report on Identity Theft (NPC BN-199)” from HC Consumer Finance Philippines, Inc. ↩

  36. Id. ↩

  37. Id. ↩

  38. Id. ↩

  39. Letter dated 04 November 2020 “Updated Report on Identity Theft (NPC BN-199)” from HC Consumer Finance Philippines, Inc. ↩

  40. Id. ↩

  41. Letter dated 01 August 2022 “Supplemental Post-Breach Report on NPC BN 18-199” from HC Consumer Finance Philippines, Inc. ↩

  42. Id. (Annex A and Annex H) ↩

  43. Id. (Annex A and Annex H) ↩

  44. Id. ↩

  45. Letter dated 01 August 2022 “Supplemental Post-Breach Report on NPC BN 18-199” from HC Consumer Finance Philippines, Inc. ↩

Backlinks

  • No backlinks found