Resolution Text
IN RE: QUICKLEND FINANCING COMPANY, INC.
x----------------------------------------------------x
NAGA, P.C.;
Before the Commission is the Compliance dated 11 February 2021 submitted by Quicklend Financing Company, Inc. (Quicklend) in accordance with the Order dated 26 October 2020.
Facts
On 05 November 2018, Quicklend reported to the National Privacy Commission (NPC), through its Complaints and Investigation Division (CID), a possible data breach after receiving an information from one of its clients on 30 October 2018, prompting Quicklend to review their emails.1
Quicklend thereafter discovered an email sent to its clients on 10 October 2018, advising them to maintain a minimum amount based on their monthly dues:
“Greetings from Quicklend, Inc.! This is to kindly remind you to maintain your loan payment amount in your payroll account which is due for Auto-Debit Deduction on October 15, 2018. Please be informed that there will be a daily Php50.00 penalty fee while your Auto-Debit Deduction is unsuccessful due to insufficient funds. Thank you for your due diligence in cooperating with us and helping us avoid possible collection problems and additional finance charges.”2
However, Quicklend stated that through “excusable oversight,” its staff placed around one hundred thirty-five (135) clients’ email addresses on the “TO” section instead of the Blind Carbon Copy (BCC) portion.3 For this reason, clients who received said email would be able to see the email addresses of the other recipients.4
Despite the incident, Quicklend contended that such was not their usual practice because they always place their clients’ email addresses on the BCC portion when sending reminders.5 Quicklend acknowledged that “this mistake was unintentional and was a mere oversight on the part of our employee.”6
To prevent the recurrence of the incident, Quicklend alleged that its Management convened the employees responsible for sending emails and reminded them that aside from being careful, email addresses should be placed in the BCC portion when there are several recipients.7
Also, the Data Protection Officer (DPO) and his team were mandated to review and recommend processes to enhance Quicklend’s data privacy procedure.8 They were allegedly scheduled to report their recommendations to the Management on or before 25 November 2018.9
On 26 October 2020, the CID issued an Order requiring Quicklend to submit its Full Report pursuant to NPC Circular No. 16-03 on Personal Data Breach Management, to wit:
Pursuant to subparagraph C, Section 17, Rule V of the National Privacy Commission Circular No. 16-03 on Personal Data Breach Management, you are hereby required to submit a Full Report detailing the incident containing the following information with emphasis supplied on the lacking information from the initial notification report we received:
- Nature of the Breach
a. Description or nature of the personal data breach;
b. Description of how the breach occurred and the vulnerability of the data processing system that allowed the breach;
- Be specific and detailed as possible.
c. A chronology of the events leading up to the loss of control over personal data;
d. Approximate number of individuals and/or personal records affected;
e. Description of the likely consequences of the personal data breach on the company, data subjects and the public;
f. Description of safeguard in place that would minimize harm or mitigate the impact of the personal data breach;
- Attach a copy of the privacy policy before and after (if applicable or if there are revisions on the policy) the incident.
g. Name and contact details of the data protection officer or any other accountable persons
- Personal Data Possibly Involved
a. List of the sensitive personal information involved;
b. List of other information involved that may be used to identity fraud;
- Remedial Measures Taken Subsequent to Suspected Breach
a. Description of the measures taken or proposed to be taken to address the breach;
b. Actions being taken to secure or recover the personal data that were compromised;
c. Actions performed or proposed to mitigate or limit the possible harm or negative consequences, damage or distress to those affected by the incident;
- Proof of measures taken to avoid the recurrence of the incident.
d. Actions being taken to inform the data subjects affected by the incident or reasons for any delay in the notification;
- Proof of Personal data breach notification to the affected data subjects;
e. The measures being taken to prevent a recurrence of the incident.
- Organizational measures such as training of the employees in relation to personal data security and related policies;
- Rules on the review of policies and protocols regarding personal data security/protection
- Physical security measures
- Technical security measures such as data encryption and password protection.
You are hereby given a period of fifteen (15) days from receipt hereof to submit your compliance through e-mail at complaints@privacy.gov.ph.
SO ORDERED.10
On 03 November 2020, Quicklend sent an inquiry to the CID as to whether a re-submission is necessary as it previously filed the report being asked from them.11 Nonetheless, Quicklend attached its original submissions dated 06 November 2018 and 14 September 2020 which includes: 1) Privacy Manual; 2) Memorandum from its DPO, reporting the data breach incident with his recommendations; and 3) Memorandum from its Management, announcing new protocols to avoid similar data breach incidents in the future.12
On 10 February 2021, the CID responded that the documents presented by Quicklend pertained to a different NPC Case.13 Thus, Quicklend was given another ten (10) days to comply with the Order to Submit Full Report.14
On 15 February 2021, Quicklend submitted its compliance dated 11 February 2021 wherein it clarified that there were one hundred thirty-six (136) affected data subjects whose names and email addresses were exposed to all the recipients of the email blast.15
In addition, Quicklend posited that it already notified the affected data subjects on 07 November 2018 through email and the delay in sending the notification was because of the November 01 and 02 holidays, while November 03 and 04 were weekends.16
To further substantiate its Report, Quicklend submitted the following: 1) Early Payment Reminder; 2) Memorandum to Enforce Procedures; 3) Minutes of the Meeting Regarding the Breach; 4) Notice to Data Subjects; 5) Notice to the NPC Email; and its 6) Data Privacy Security Incident Policy.17
Unfortunately, Quicklend declared that it was unable to recover the data since the leak occurred in an email.18
Issue
I. Whether the incident falls under mandatory breach notification; and
II. Whether Quicklend has sufficiently complied with the Order dated 26 October 2020, including the implementation of reasonable and appropriate security measures.
Discussion
The Commission finds that the incident does not fall under mandatory breach notification and Quicklend has sufficiently complied with the Order dated 26 October 2020, including the implementation of reasonable and appropriate security measures. As such, the Commission resolves to close the matter.
I. The matter does not fall under mandatory breach notification.
Section 11, NPC Circular 16-03 provides when notification is required:
SECTION 11. When notification is required.
Notification shall be required upon knowledge of or when there is reasonable belief by the personal information controller or personal information processor that a personal data breach requiring notification has occurred, under the following conditions:
A. The personal data involves sensitive personal information or any other information that may be used to enable identity fraud. For this purpose, “other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.
B. There is reason to believe that the information may have been acquired by an unauthorized person; and
C. The personal information controller or the Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.19
In this case, the first element of mandatory breach notification is present because names and email addresses may be used to enable identity fraud. Unauthorized acquisition of these information could expose the affected data subjects to harassment, discrimination, or other risks of real and serious harm such as phishing attacks which involve emails containing links to a fake website intended to steal the recipient’s personal data.
The second element is also apparent because there is reason to believe that the information may have been acquired by an unauthorized person as the names and email addresses of the other clients were exposed to parties not privy to their correspondence with Quicklend, after all the other email addresses were inadvertently placed in the “TO” field.
However, the third element is absent because the unauthorized acquisition is not likely to give rise to a real risk of serious harm to any affected data subject. The Commission has previously held:
To determine whether there is a likelihood that the unauthorized acquisition of information will give rise to a real risk of serious harm, there shall be a relation between the incident and any possible resulting harm to affected data subjects. The risk shall be apparent and not a product of mere speculation. Consequently, “serious harm” means that the consequences and effects to any affected data subject is significant based on the surrounding circumstances of the breach.20
To recall, the breach occurred by reason of the “clinical error” by one of Quicklend’s employees which resulted in the exposure of the names and email addresses of one hundred thirty-six (136) clients to the other email recipients.21
On the same day, Quicklend was immediately alerted by one of its clients who received the email regarding a possible breach.22 This only shows that said client was adamant in protecting her personal information and consequently that of the other clients as well.
After receiving the report from one of its clients, Quicklend reviewed its emails and thereafter learned of the breach incident.23 Said discovery caused Quicklend to notify the Commission on 05 November 2018 and subsequently the affected data subjects on 07 November 2018.24
These actions, coupled by the fact that the nature and amount of information involved was limited to the names and email addresses of Quicklend’s clients and the security measures it has employed, mitigated the extent of potential misuse and exposure of information involved in the breach.
Thus, notwithstanding that the emails contained information that may enable identity fraud, such unauthorized acquisition did not give rise to a real risk of serious harm to any of them.
II. Quicklend has implemented sufficient, reasonable, and appropriate measures to address the incident.
Section 20 (a) and (b) of the Data Privacy Act of 2012 (DPA) provides:
Sec. 20. Security of Personal Information.
(a) The personal information controller must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.
(b) The personal information controller shall implement reasonable and appropriate measures to protect personal information against natural dangers such as accidental loss or destruction, and human dangers such as unlawful access, fraudulent misuse, unlawful destruction, alteration and contamination.25
A perusal of Quicklend’s Data Breach Report shows that it has indeed implemented reasonable and appropriate security measures to prevent and mitigate the consequences of the breach, namely:
-
On 5 November 2018, management called for a meeting to discuss the data breach with the staff and to reiterate the importance of data privacy and the measures and procedures that the company has in place (attachment: Minutes Regarding Breach).
-
On the same day, management issued a memo reminding staff to be vigilant handling batches of email addresses. Furthermore, an additional protocol was added calling for a peer review of emails before they are sent out (attachment: Memo to Enforce Procedures).26
It also bears stressing that on 07 November 2018, Quicklend sent an email, notifying the one hundred thirty-six (136) data subjects about the breach.27 Said email reads:
Dear Sir/Madam,
We are writing to inform you of a recent incident that may affect the security of your personal information. We are providing this notice to ensure that you are aware of the incident so that you may take steps to protect your information should you feel it is appropriate to do so.
On October 10, 2018 one of our staff, mistakenly placed around one hundred thirty-six (136) email addresses on the “TO:” section of the Email instead of placing the email addresses of our clients in the Blind Carbon Copy (Bcc) portion of the Email.
The information breached contained the email address of some of our clients. No other information was released.
We take the security of your personal information very seriously, including the reporting of the aforementioned incident with the National Privacy Commission. Please be assured that we have taken necessary steps to address the incident and that we will continue to take any additional steps that may be required to ensure your personal information is protected.
We sincerely apologize for any inconvenience this may cause you and very much regret that this situation occurred. Your confidence in our ability to safeguard your personal information is very important to us.
Sincerely,
Quicklend Financing Co., Inc.28
As proof of notification, Quicklend attached in its compliance a screenshot of the email it sent to the affected data subjects and showing that the other recipients were properly placed in the BCC field.29
Quicklend also assured its clients that they would be willing to lend assistance regarding any inconveniences that may have arisen from the personal data breach.30
In line with this, Rule V, Sections 18 (A) and (D) of NPC Circular 16-03 (Personal Data Breach Management) state:
SECTION 18. Notification of Data Subjects.
The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:
A. When should notification be done. The data subjects shall be notified within seventy-two (72) hours upon knowledge of or reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred.
The notification may be made on the basis of available information within the 72-hour period if the personal data breach is likely to give rise to a real risk to the rights and freedoms of data subjects. It shall be undertaken in a manner that would allow data subjects to take the necessary precautions or other measures to protect themselves against the possible effects of the breach. It may be supplemented with additional information at a later stage on the basis of further investigation.
xxx
D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data. The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternative means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.31
Aside from notifying the affected data subjects, Quicklend also incorporated its notification procedures in their Data Privacy Security Incident Policy which governs its monitoring, mitigation, investigation, response, containment, reporting, and resolution of Security Incidents and Personal Data Breaches.32
These actions undertaken by Quicklend are in consonance with the purpose of notification to the affected data subjects, which is to allow them to take the necessary precautions or other measures to protect themselves against the possible effects of the breach.33
Hence, Quicklend was able to mitigate the risks caused by the incident through its existing and subsequent security measures and its notification to the Commission and the affected data subjects.
In view of the foregoing, the Commission finds that the matter does not fall under mandatory breach notification and the measures undertaken by Quicklend have sufficiently addressed the breach to prevent a recurrence of the same.
WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-208 “In re Quicklend Financing Company, Inc.” is hereby CLOSED.
SO ORDERED.
City of Pasay, Philippines.
05 June 2024.
JOHN HENRY D. NAGA Privacy Commissioner
WE CONCUR:
LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner
NERISSA N. DE JESUS Deputy Privacy Commissioner
Copy furnished:
JNB
Data Protection Officer
Quicklend Financing Company, Inc.
COMPLAINTS AND INVESTIGATION DIVISION
ENFORCEMENT DIVISION
GENERAL RECORDS UNIT
National Privacy Commission
Footnotes
-
Breach Notification dated 05 November 2018 of Quicklend Financing Company, Inc. ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
Breach Notification dated 05 November 2018 of Quicklend Financing Company, Inc. ↩
-
Id. ↩
-
Id. ↩
-
Id. ↩
-
Breach Notification dated 05 November 2018 of Quicklend Financing Company, Inc. ↩
-
In Re: Quicklend Financing Company, Inc., NPC BN 18-208, Order dated 26 October 2020, at pp. 1-2. ↩
-
Reply to Email dated 03 November 2020 of Quicklend Financing Company, Inc. ↩
-
Id. ↩
-
In Re: Quicklend Financing Company, Inc., NPC BN 18-208, Order dated 10 February 2021. ↩
-
Id. ↩
-
Data Breach Report dated 11 February 2021 of Quicklend Financing Company, Inc., at p. 1. ↩
-
Id, at p. 3. ↩
-
Id. ↩
-
Id, at p. 3. ↩
-
National Privacy Commission, Personal Data Breach Management, NPC Circular 2016-03, rule V, § 11 (15 December 2016) (NPC Circular 16-03). ↩
-
NPC BN 17-028 and NPC BN 18-180 (Unreported), Resolution dated 11 May 2023. ↩
-
Data Breach Report dated 11 February 2021 of Quicklend Financing Company, Inc., at p. 2. ↩
-
Id. ↩
-
Breach Notification dated 05 November 2018 of Quicklend Financing Company, Inc. ↩
-
Data Breach Report dated 11 February 2021 of Quicklend Financing Company, Inc. ↩
-
An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter V, § 20 (a)(b) (2012). ↩
-
Data Breach Report dated 11 February 2021 of Quicklend Financing Company, Inc., at p. 3. ↩
-
Notice to Data Subjects dated 07 November 2018 of Quicklend Financing Company, Inc. ↩
-
Id. ↩
-
Data Breach Report dated 11 February 2021 of Quicklend Financing Company, Inc. ↩
-
Id, at p. 3. ↩
-
NPC Circular 16-03, rule V, § 18 (A)(D). ↩
-
Data Privacy Security Incident Policy of Quicklend Financing Company, Inc., at p.1. ↩
-
NPC Circular 16-03, rule V, § 18 (A). ↩