Lender asked to remove list of borrowers 

The National Privacy Commission (NPC) ordered a small lender to stop processing the personal data of some 6,000 borrowers following complaints of privacy violations, according to a report by Philippine News Agency.

In a statement on Monday, the NPC told Familyhan Credit Corporation to also “immediately take down” its online master database to prevent “more” people from gaining unauthorized access to it.

“The database stores sensitive information of the lender’s customers -- names, passport numbers, email addresses, current addresses of borrowers based in Hong Kong and Singapore, and residential addresses of borrowers in the Philippines,” the NPC said.

Advertisement

The order was initially made through a cease-and-desist order (CDO) the NPC sent on Friday to Familyhan’s headquarters in Lipa City, Batangas.

Based on complaints and an independent investigation, it said there was “sufficient ground” to support that Familyhan violated Section 26 of the Data Privacy Act for unauthorized access to personal and sensitive personal information due to negligence aside from additional penalties for concealment of security breaches.

The NPC’s Complaints and Investigation Division, in a report included in the CDO, found that Familyhan should have known or “had reasonable belief” that a security breach of their borrowers’ personal information occurred and that it has not made the required notification.

In addition, it said there was evidence to support negligence for failure to secure their database and prevent unauthorized access, and that it has not registered with the NPC despite meeting the criteria for mandatory registration.

“As of January 18, the database remained to be accessible online, making the matter all the more urgent to be acted on by the Commission,” the NPC said.

Following their receipt of the CDO, it said Familyhan and its responsible officers have 10 days to respond.

The NPC said Familyhan was not the first lender it took action against based on complaints of its borrowers.

In October 2019, the NPC ordered the takedown of 26 online lending applications used to harvest data and shame delinquent borrowers.