NPC Issuance Wiki

NPC BN 18-247: In re: Card SME Bank Inc.

Issued Resolution

Source

Source Tags

  • Mandatory Breach Notification, NPC Circular 16-03, Personal Data Breach Management, Bank, Bank Documents

Resolution Text

IN RE: CARD SME BANK INC.

x----------------------------------------------------x

RESOLUTION

BELARMINO, D.P.C.;

Before the Commission En Banc (Commission) is the breach notification of Card SME Bank, Inc. (Card SME Bank/ the Bank) dated 29 November 2018 and breach management in compliance with NPC Circular 16-031 (Personal Data Breach Management).

Facts

On 05 December 2018, the Data Security and Compliance Office (DASCO) of the National Privacy Commission (NPC) received a letter from the Bank, reporting that on 27 November 2018, at around 2:30 PM, the transaction documents of their Ramon Magsaysay, Bago Bantay, Quezon City Branch (Transaction Documents) were left by its employee inside the UV Express vehicle while on the way to Novaliches.2

The Transaction Documents were identified as follows:

  1. Collection Sheet containing the name, loan, and savings balance of its two hundred ninety-eight (298) clients;

  2. Thirty-five (35) withdrawal slips containing the name, account number, and specimen signature of its clients; and

  3. Four (4) loan application documents containing the name, address, age, birthday, and signature of the applicants.3

The Bank stated that the AM and UM of the said unit exerted all efforts to locate the said documents.4 However, the driver of the UV Express vehicle said that he did not notice the said documents, and they might have been taken by other passengers.5 According to them, the AM reported the incident to the barangay where the Unit is situated and conducted an emergency meeting to all clients affected by the lost documents to formally inform them about the incident.6 Further, they said that the accountable staff received verbal warning and was notified that a heavier penalty may be imposed in cases succeeding the incident that occurred.7

In an Order dated 17 November 2021, the NPC’s Complaints and Investigation Division (CID), directed the Bank to submit a full report detailing the incident and supply the lacking information from its initial notification report pursuant to paragraph D, Section 17, Rule V of the NPC Circular on Personal Data Breach Management.8

On 07 December 2021, the Bank submitted its compliance to the Order dated 17 November 2021.9 However, they submitted incorrect documents referring to a different breach incident that occurred in a different branch or unit of the Bank.10 Thus, in its Order (To Submit Post-Breach Report) dated 18 October 2022, the CID clarified that the request pertained to reports on the 27 November 2018 incident that occurred in the Bank’s Ramon Magsaysay, Bago Bantay, Quezon City Branch.11 Further, they directed them to submit a post-breach report which shall include the following:

  • a. Outcome of the breach management, and difficulties encountered;

  • b. Proof and/or documentation of the measures conducted to address the incident and prevent its recurrence; and

  • c. Proof of compliance with notification requirements and assistance provided to affected data subjects.12

The Bank submitted its compliance to the Order (To Submit Post-Breach Report) through its Compliance Letter dated 10 November 2022 (Compliance Letter).13 Card SME Bank clarified that the staff accountable for the lost documents only noticed that the documents were lost when he arrived at Card SME Bank San Jose del Monte Branch.14 Subsequently, they immediately notified their immediate head and requested assistance to have a meeting with the clients to again accomplish new forms and notify them with regard to the incident. A copy of the attendance during the meeting was attached.15

Furthermore, the Bank imposed disciplinary sanctions on the employees responsible for the loss of the Transactional Documents, in accordance with its Code of Discipline.16 Attached to the Compliance Letter are two (2) Notices of Disciplinary Action for lapses committed, addressed to EM and NI.17

To add, the Bank stated that as part of its regular compliance testing, its compliance unit regularly conducts compliance orientation which includes topics on Anti-Money Laundering Act, Data Privacy Act, and basic banking regulations to all officers and staff of the Bank.18

On 16 May 2023, the NPC CID issued an Order requiring Card SME Bank to submit a full report expounding the details of the data breach incident and to attach the necessary documents for further investigation:

  1. Nature of the Breach

    • a. A chronology of the events leading up to the loss of control over personal data, including the description of how the breach occurred;

    • b. Description of the likely consequences of the personal data breach on the institution, data subjects and the public;

    • c. Description of safeguard in place that would minimize harm or mitigate the impact of the personal data breach, such as physical, organizational and technical security measures;

  2. Personal Data Possibly Involved

    • a. List of the sensitive personal information described in the lost documents;

    • b. List of other information involved that may be used to identity fraud;

  3. Remedial Measures Taken Subsequent to Suspected Breach

    • a. Description of the measures taken or proposed to be taken to address the breach, as well as proof of implementation thereof:

      • i. Attach a copy of the Full Investigation Report and updates thereto;

      • ii. Report of the Organization relating to personal data involved;

      • iii. Copy of Report to the local authorities (Barangay Incident Report)

    • b. Actions being taken to secure or recover the personal data that were compromised, including proof of implementation thereof;

      • i. Actions to address confidentiality and availability issues.

    • c. Actions performed or proposed to mitigate or limit the possible harm or negative consequences, damage or distress to those affected by the incident, as well as proof of implementation thereof;

    • d. The measures being taken to prevent a recurrence of the incident, as well as proof of implementation thereof.19

On 17 May 2023, Card SME Bank, in compliance with the above order, merely resubmitted the same documents previously attached to its Compliance Letter dated 10 November 2022.20 These included an attendance sheet from a Special Meeting for Loss of Documents held on 27 November 2018 (Special Meeting) and a record of disciplinary action.21

In a Minute Resolution dated 03 July 2025, the Commission directed Card SME Bank to submit the following proof of notification and proof of compliance within fifteen (15) calendar days from its receipt:

  • a. Measures undertaken for the data subjects who were absent and not notified during the special meeting dated 27 November 2018 regarding the personal data breach;

  • b. Organizational, physical, and technical measures implemented to prevent the recurrence of personal data breaches within the bank;

  • c. Proof of the conduct of data privacy training provided to all bank personnel, including the erring bank personnel; and

  • d. Proof of the barangay incident report filed by the AM covering the unit/area concerned.22

In response to the above, Card SME Bank submitted a Compliance Letter dated 30 September 2025, along with proof of notification and compliance, and resubmitted the same with complete attachments on 28 October 2025.23

Issues

  • I. Whether the matter falls under mandatory breach notification under NPC Circular No. 16-03; and

  • II. Whether Card SME Bank sufficiently complied with the Minute Resolution dated 03 July 2025 by submitting proof of notification and proof of compliance, and by demonstrating that it addressed the breach and implemented security measures to prevent its recurrence.

Discussion

The Commission finds that the incident falls under mandatory breach notification. Further, Card SME Bank has sufficiently complied with the notification requirements and has implemented appropriate security measures to prevent its recurrence, as evidenced by its submission in compliance with the Minute Resolution dated 03 July 2025. Hence, the Commission resolves to close the matter.

The incident falls under mandatory breach notification.

Section 11 of the Personal Data Breach Management sets forth the conditions under which a personal data breach requires notification:

SECTION 11. When notification is required. Notification shall be required upon knowledge of or when there is reasonable belief by the personal information controller or personal information processor that a personal data breach requiring notification has occurred, under the following conditions:

  • A. The personal data involves sensitive personal information or any other information that may be used to enable identity fraud.

For this purpose, “other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.

  • B. There is reason to believe that the information may have been acquired by an unauthorized person; and

  • C. The personal information controller or the Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.24

(Emphasis supplied)

Thus, breach notification to the Commission becomes mandatory with the concurrence of the following conditions:

  1. The breach involves sensitive personal information, or other information that may, under the circumstances, be used to enable identity fraud;

  2. There is reason to believe that the information may have been acquired by an unauthorized person; and

  3. The unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.25

For emphasis the following are the personal data contained in the lost Transaction Documents of Card SME Bank:

  1. Collection Sheet containing the name, loan, and savings balance of its two hundred ninety eight (298) clients;

  2. Thirty-five (35) withdrawal slips containing name, client number, and specimen signature of its clients; and

  3. Four (4) loan application documents containing the name, address, age, birthday, and signature of the applicants.

In sum, the incident involves the name, loan details, savings balance, client number, specimen signature, address, age, and date of birth of the data subjects.

First, the breach in the present case satisfies the first condition, as it involves the ages of the data subjects, which constitute sensitive personal information explicitly enumerated under Section 3 (l):

(l) Sensitive personal information refers to personal information:

  • (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

  • (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

  • (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and

  • (4) Specifically established by an executive order or an act of Congress to be kept classified.26

Further, it contains the complete dates of birth of the data subjects. And although date of birth is not among the sensitive personal information expressly listed above, it is naturally considered sensitive personal information since anyone holding it can readily deduce the age of the individuals involved in the breach.

While the remaining data elements such as name, address, and signature are considered personal information as the “the identity of an individual is apparent or can be reasonably and directly ascertained by the entity holding the information, or when put together with other information would directly and certainly identify an individual”.27

Section 11 (A) of Personal Data Breach Management defines “other information” that may, under the circumstances, be used to enable identity fraud as follows:

For this purpose, “other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.28 (Emphasis supplied)

Based on the foregoing, address, signature, loan details, savings balance, and client number of a data subject, when combined or taken together with a personal information such as a name are considered “other information”, which may facilitate identity fraud or theft. Such combination of data could enable any person in possession thereof to make decisions affecting the data subjects, including the granting of rights or benefits.

Clearly, the breach involves sensitive personal information, personal information, and other information that may, under the circumstances, be used to] enable identity fraud. Thus, the first condition is present.

As to the second condition, Card SME Bank has reason to believe that the information may have been acquired by an unauthorized person, considering that the AM of Card SME Bank has exerted all efforts to locate the missing documents, and the driver of the UV Express where the Transaction Documents were left affirmed that he did not notice said documents and suggested that they might have been taken by other passengers.29

In the case of In re: TravelPeople Ltd., Inc., the Commission explained that the loss of control over personal data held in custody is enough to have reason to believe that the information may have been acquired by an unauthorized person:

It should be noted that a loss of control over personal data held in custody should be enough for a personal information controller to have “reason to believe that the information may have been acquired by an unauthorized person.” An indication of exfiltration of data is not a requirement in Section 11(b).

Absolute certainty of acquisition by an unauthorized person is not required by either the Circular or the Data Privacy Act (“DPA”), considering that the condition only provides for a determination based on the existing circumstances that can give a “reason to believe.30 (Emphasis supplied)

Considering that SME Bank Card has lost control over the Transaction Documents despite the efforts to retrieve the same, the Commission finds that there is a reason to believe that the information within the Transaction Documents have been acquired by unauthorized person. Hence, the second condition is present.

Lastly, the third condition is also present. In the case of In re: Easytrip Services Corporation, the Commission En Banc discussed the determination of whether an unauthorized acquisition of information will give rise to a real risk of serious harm:

To determine whether there is a likelihood that the unauthorized acquisition of information will give rise to a real risk of serious harm, there shall be a relation between the incident and any possible resulting harm to affected data subjects. The risk shall be apparent and not a product of mere speculation.

Consequently, “serious harm” means that the consequences and effects to any affected data subject is significant based on the surrounding circumstances of the breach.

In determining whether the unauthorized acquisition is likely to give rise to a real risk of serious harm, a PIC or the Commission may consider several factors such as: the nature of the information involved in the breach, amount of information of a data subject, period of time lapsed from the breach, purpose of the unauthorized acquisition, security measures implemented on the information, and extent of potential misuse and exposure of information involved in the breach, if any.31

The Commission finds that the unauthorized acquisition of the Transaction Documents will give rise to a real risk of serious harm to any affected data subject. A PIC or the Commission, itself, may consider several factors, such as: the nature of the information involved in the breach, amount of information of a data subject, period of time lapsed from the breach, purpose of the unauthorized acquisition, security measures implemented on the information, and extent of potential misuse and exposure of information involved in the breach, if any.

In the present case, the Transaction Documents, which were identified as collection sheet, withdrawal slips, and loan application documents, contain the following information: name, date of birth, address, loan details, savings balance, account number and signature. The nature of these information are personal information, sensitive personal information, and other information that may, under the circumstances, be used to enable identity fraud are involved in the incident. To add, such information, when compromised, may facilitate discrimination, financial loss, identity theft, financial fraud, and other privacy risks.

Further, a significant number of data subjects, totaling two hundred ninety-eight (298), were affected. The Transaction Documents containing affected data subjects’ personal data were left in a manner that allowed any individual to freely and insecurely obtain and use such data, thereby significantly increasing the extent of its potential misuse and exposure. The potential for misuse of the information is substantial, considering that, in addition to personal data, the documents include specimen signatures and financial information such as loan and savings information which are considered high-risk information. When combined, these data elements could enable identity theft, financial fraud, or other malicious activities, posing a serious threat to the rights and interests of the affected data subjects. Thus, real risk of serious harm is evident in this case.

Based on the foregoing, the Commission finds that all the foregoing conditions are present in this case. Thus, the incident falls under mandatory breach notification.

Card SME Bank sufficiently complied with the Minute Resolution dated 03 July 2025 and addressed the breach and implemented security measures to prevent its recurrence.

On 30 September 2025, Card SME Bank submitted its Formal Compliance Report dated 30 September 2025 (Compliance Report) in compliance with the Minute Resolution dated 03 July 2025.32

In its Compliance Report, Card SME Bank addressed all four (4) items of proof of notification and compliance as ordered in the Minute Resolution dated 03 July 2025.33

First, with respect to the data subjects who were absent and therefore not duly notified during the Special Meeting, Card SME Bank kept in its custody the Attendance Log Sheet for said meeting, which indicates the names of those who were not in attendance.34 Card SME Bank stated that the document was preserved as part of their breach management records for audit and compliance purposes.35 A Sinumpaang Salaysay executed by EM, the BH of Card SME Bank, was likewise submitted.36 The statement of EM details the circumstances surrounding the loss of the Transaction Documents, including the manner of their loss, and affirms that EM, together with his staff, undertook house-to-house visits to personally notify the affected data subjects who were unable to attend the Special Meeting.37 Card SME Bank also indicated that its account officers were “tasked to give regular updates during weekly center meetings regarding the status of the investigation and remedial actions taken”.38

In sum, Card SME Bank claimed to have notified the data subjects through a Special Meeting held on 27 November 201839 and house-to-house visits to personally notify the affected data subjects who were unable to attend the Special Meeting.40

Second, Card SME Bank stated that it implemented organizational, physical, and technical measures to prevent the recurrence of personal data beached within the Bank. The physical security measures include requiring plastic envelopes and zippered bags for the secure transport of documents containing personal or sensitive personal information and hard copies of critical records are stored in locked, access-restricted areas, while the digitalization or records is ongoing.

Further, the organizational measures implemented by Card SME Bank include regular data privacy training for its personnel and deployment of Data Protection Officer (DPO) and Compliance Unit to ensure continuous adherence to data protection laws. Regular audits are carried out by its Compliance Unit to ensure adherence and address any lapses promptly. To show proof of these organization measures, Card SME Bank submitted photos of the data privacy training attended by its employees,41 data privacy training during its mid-year planning,42 compliance orientation,43 minutes of its data privacy committee meetings.44

In addition, due to the loss of physical Transactional Documents, Card SME Bank commenced the digitalization of its critical records as part of its technical security measures.45 The electronic files are stored in secure, encrypted databases to significantly reduce reliance on physical papers and enhance technical safeguards.46

Third, as to the proof of the conduct of data privacy training provided to all bank personnel, including the erring bank personnel, Card SME Bank submitted their Data Privacy Training Attendance which includes the names of the employees responsible for the loss of Transactional Documents, namely EM and NI.47 Also, a copy of the Notice regarding “Disciplinary Action for Lapses Committed” dated 27 November 2018 addressed to EM and NI.48

Fourth, a Certification from the Office of the Punong Barangay of Barangay Ramon Magsaysay, Quezon City was, likewise, submitted by Card SME Bank to show proof that the UM, EM, formally filed an incident report with the relevant barangay.49

In addition to the required proof of notification and compliance, Card SME Bank submitted other supporting documentation demonstrating compliance with the DPA, its Implementing Rules and Regulations, and other issuances, to wit:

  1. NPC Certificate of Registration;50

  2. Seal of Registration;51

  3. Data Privacy Related Memoranda;52

  4. Card SME Bank Privacy Manual;53

  5. Privacy Impact Assessment;54 and

  6. Privacy Management Plan55

Finally, Card SME Bank reaffirms its commitment to safeguarding the personal data of its clients, employees, and stakeholders and remains diligent in its efforts to maintain compliance with the Data Privacy Act of 2012.56

Upon review of the submissions of Card SME Bank, the Commission finds that it has complied with the requested proof of notification and proof of compliance to the Minute Resolution dated 03 July 2025. Card SME Bank has sufficiently addressed the breach and implemented reasonable and appropriate security measures to prevent its recurrence.

Notwithstanding the foregoing, the Commission notes that the NPC Adjudication Secretariat electronically served to Card SME Bank the Minute Resolution dated 03 July 2025, granting Card SME Bank a period of fifteen (15) calendar days from receipt thereof to comply with its directives. Card SME Bank claims to have received the said minute resolution only on 16 September 2025 or more than two (2) months after electronic service. Even assuming that Card SME Bank received the said minute resolution via electronic mail on 16 September 2025, Card SME Bank did not submit the required documents until 28 October 2025, which is well beyond the prescribed period and is therefore belatedly submitted.

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-247 “In re: Card SME Bank, Inc.” is hereby CLOSED due to satisfactory compliance.

Finally, the Commission hereby ISSUES a stern warning to Card SME Bank, Inc. in view of its belated submission and failure to provide an adequate explanation for such delay. This warning shall be taken into account in the determination of any penalties or fines that may be imposed for any future violations of the Data Privacy Act of 2012, its Implementing Rules and Regulations, and other issuances.

SO ORDERED.

Quezon City, Philippines.

30 October 2025.

JOSE AMELITO SUTTON BELARMINO II
Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA
Privacy Commissioner

NERISSA N. DE JESUS
Deputy Privacy Commissioner

Copy furnished:

JCH

Data Protection Officer

CID, END, GRU

National Privacy Commission

Footnotes

Footnotes

  1. NPC Circular No. 16-03 dated 15 December 2016 or the Personal Data Breach Management. ↩

  2. Letter of CARD SME Bank, Inc. dated 29 November 2018. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Id. ↩

  8. NPC CID Order dated 17 November 2021. ↩

  9. Email screenshot dated 07 December 2021. ↩

  10. Letter dated 06 December 2021. ↩

  11. Order dated 18 October 2022. ↩

  12. Id. ↩

  13. Compliance of Card SME Bank, Inc dated 10 November 2022 in compliance to the Order (To Submit Post-Breach Report) dated 18 October 2022. ↩

  14. Id. ↩

  15. Id. ↩

  16. Id. ↩

  17. Id. at Annex A. ↩

  18. Id. ↩

  19. NPC CID Order dated 16 May 2023. ↩

  20. Email from Card SME Bank Inc, **********@*******.com, 17 May 2023, at 4:09 PM. ↩

  21. Compliance of Card SME Bank, Inc dated 10 November 2022 in compliance to the Order (To Submit Post-Breach Report) dated 18 October 2022, Annex A. ↩

  22. Minute Resolution dated 03 July 2025. ↩

  23. Email from Card SME Bank, Inc., **********@*******.com, 30 September 2025 and 28 October 2025. ↩

    ↩

  25. NPC BN 18-106, In re: Klook Travel Technology Limited, 08 May 2025, at p.11. ↩

  26. Republic Act No. 10173 also known as Data Privacy Act of 2012, Section 3 (I). ↩

  27. Republic Act No. 10173 also known as Data Privacy Act of 2012, Section 3 (g). ↩

  28. NPC Circular No. 16-03 or the Personal Data Breach Management dated 15 December 2016, Section 11 (A). ↩

  29. Letter of CARD SME Bank, Inc. dated 29 November 2018. [Breach notification, CIDBN No 18 – ↩

  30. NPC BN 20-170, In re: TravelPeople Ltd., Inc, 21 September 2020. ↩

  31. NPC BN 17-028 and NPCBN 18-180, In re: Easytrip Services Corporation, 11 May 2023 at p. 8. ↩

  32. Email from Card SME Bank, Inc., **********@*******.com, 30 September 2025 at 4:51PM. ↩

  33. Formal Compliance Report from Card SME Bank dated 30 September 2025. ↩

  34. Id., Annex A. ↩

  35. Id. at p. 1. ↩

  36. Id., Annex B. ↩

  37. Id. ↩

  38. Id., at p. 2. ↩

  39. Compliance of Card SME Bank, Inc dated 10 November 2022 in compliance to the Order (To Submit Post-Breach Report). ↩

  40. Formal Compliance Report from Card SME Bank dated 30 September 2025. ↩

  41. Id., Annex D (Data Protection Training - Novice Level); Annex E (Photos of Participation in Data Privacy Roadshow of NPC on 20 November 2023); Annex F (Certificate of Recognition from UA&P); Annex J (Extensive Training Records for Key Departments). ↩

  42. Id., Annex G (Executive Training during Mid-Year Planning). ↩

  43. Id., Annex H (Compliance Orientation Records). ↩

  44. Id., Annex I (Minutes of Data Privacy Committee Meetings). ↩

  45. Id., at p. 3. Annex K. ↩

  46. Id. ↩

  47. Id., Annex L. ↩

  48. Id., Annex M. ↩

  49. Id., Annex N. ↩

  50. Id., Annex O. ↩

  51. Id., Annex P. ↩

  52. Id., Annex Q. ↩

  53. Id., Annex R. ↩

  54. Id., Annex S. ↩

  55. Id., Annex T. ↩

  56. Id., at p. 4. ↩

Backlinks

  • No backlinks found