MANULIFE (SINGAPORE) PTE. LTD.

Background The Personal Data Protection Commission (the “Commission”) received a data breach notification on 23 March 2020 from Manulife (Singapore) Pte Ltd (“MLS”), informing that a representative who was licensed to provide financial advisory services representing MLS had misplaced an unencrypted thumb drive which contained the personal data of 104 individuals on 19 March 2020. The personal data consisted of NRIC images, passport images, MLS forms used to conduct financial needs analysis for clients, MLS insurance application forms, medical reports, claims documents (current and past claims), insurance summaries for client portfolios. It was found that MLS’ financial representatives were not continuously conveyed and trained on up-to-date requirements on the permissibility of using personal devices for business purposes and the proper use of removable storage media via onboarding and refresher training sessions, circulars and quarterly bulletins. Remedial Actions After the incident, MLS notified all affected individuals of the incident and monitored their insurance policies for unusual requests and/or transactions for a period of six months. A refresher training on privacy and data security was also conducted for MLS representatives. Undertaking The Commission considered the circumstances of the case and accepted an undertaking from MLS to improve its compliance with the Personal Data Protection Act 2012. The undertaking was executed on 15 January 2021 (the “Undertaking”). The Undertaking provides that MLS was to: (a) take all necessary steps to implement its remediation plan, namely, to carry out the actions referred to in Schedule A of the Undertaking; and (b) provide a status report to the Commission at a time requested by the Commission confirming whether MLS has fulfilled each of the specific measures set out in the implementation plan. MLS has since provided t