pdpc_undertakings_version: 48

This data as json

_id _item _version _commit id organisation url timestamp description pdf-url pdf-content _item_full_hash
48 47 1 1007 14 Fujioh International Trading Pte Ltd https://www.pdpc.gov.sg/undertakings/undertaking-by-fujioh-international-trading-pte-ltd 2021-11-11 Background  The Personal Data Protection Commission (the “Commission”) received information on 24 August 2020 that Fujioh International Trading Pte Ltd’s (“Fujioh”) website had been affected by URL manipulation, resulting in its customers’ personal data being exposed on Fujioh’s online warranty system on its website. The attacker gained access to the Organisation’s website by iterating through the customers’ given identifiers that were reflected at the end of the URL, to download the uploaded receipt images. The personal data of 2,771 individuals was affected. The affected datasets comprised the affected individuals’ name, address, email and telephone number.  It was established that Fujioh (a) had application weakness in the receipt submission process of their online warranty system, (b) did not have proper data protection clauses in its contract with its vendor, and (c) had insufficient data protection management.  Remedial Actions After the incident, as part of a remediation plan, Fujioh had:  (a) introduced session tokens in the online warranty system that expires at the end of each receipt;  (b) replaced its online warranty system to fix undetected vulnerabilities;  (c) established a Data Protection Management Programme that consisted of drafting of polices and notices, establishment of procedures, templates, data inventory map, training data protection curriculum for employees; and  (d) established checklists, procedures and templates for 3rd party vendors.  Undertaking  Having considered the circumstances of the case, including the remedial steps taken by Fujioh to improve its personal data protection practices, the Commission accepted an undertaking from Fujioh to improve its compliance with the Personal Data Protection Act 2012. The undertaking was executed on 31 March 2021 (the “Undertaking”).  The Undertaking provided that Fujioh was to complete implementation of its remediation plan by replacing its online warranty system to fix undetected vulnerabilities.  Fujioh has since updated the Commission that implementation of its remediation plan has been completed. The Commission has reviewed the matter and determined that Fujioh has complied with the terms of the Undertaking.  Please click here to view the Undertaking. https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/undertakings/undertaking---fujioh-international-trading-pte-ltd.pdf WRITTEN VOLUNTARY UNDERTAKING (“Undertaking”) TO THE PERSONAL DATA PROTECTION COMMISSION This Undertaking is given to the Personal Data Protection Commission or its delegates pursuant to section 48L(1) of the PDPA, by: Fujioh International Trading Pte Ltd UEN: 199305801D Registered Address: 130 Joo Seng Road, #05-05, Singapore 368357 (hereinafter referred to as the “Organisation”). By signing this Undertaking, the above-named Organisation acknowledges the matters stated herein and undertakes to the Commission in the terms set out herein. 1. DEFINITIONS 1.1 In this Undertaking: (a) “PDPA” means the Personal Data Protection Act 2012 (No. 26 of 2012); and (b) “Relevant Provisions” means the provisions in Parts 3, 4, 5, 6, 6A, 6B and 9, and section 48B(1) of the PDPA. 2. ACKNOWLEDGEMENTS 2.1 The Organisation hereby acknowledges the following matters: (a) The Commission has carried out investigations into certain acts and practices of the Organisation, and has reason to believe that the Organisation has not complied, is not complying, or is likely not to comply with one or more of the Relevant Provisions. The relevant facts and circumstances are summarised at Schedule A. (b) As a result of any non-compliance with the PDPA by an organisation, the Commission has a number of enforcement options under the PDPA, including the option to issue directions under sections 48I or 48J of the PDPA. (c) The Commission recognises that the Organisation has made efforts to address the concerns raised in this case and to improve its personal data protection practices. In addition, the Organisation was cooperative in the course of the investigation and was responsive to requests for information. The Commission further recognises that the Organisation appears ready to implement or is in the midst of implementing the steps set out in Schedule B. (d) Having carefully considered all the relevant facts and circumstances, the Commission takes the view that this is an appropriate case in which an Undertaking may be accepted. 2.2 The Organisation also acknowledges and agrees that the Commission may publish and make publicly available this Undertaking, and without limitation to the foregoing, the Commission may issue public statements referring to this Undertaking and/or its contents in whole or in part. 3. UNDERTAKINGS 3.1 The Organisation undertakes that it has taken, or will take all necessary steps, to carry out the actions or refrain from carrying out the actions referred to in Schedule B, and where applicable, in accordance with the stipulated timelines. 4. COMMENCEMENT 4.1 This Undertaking shall take effect upon the acceptance by the Commission of the Organisation’s duly executed Undertaking. 5. THE COMMISSION’S STATUTORY POWERS 5.1 In order to provide the Organisation with an opportunity to complete all necessary steps to implement its undertakings set out in clause 3 above, the Commission will exercise its powers under section 50(3)(ca) of the PDPA to suspend the investigations referred to in clause 2 on the date the Undertaking takes effect as set out in clause 4.1. 5.2 The Organisation acknowledges that the Commission will verify the Organisation’s compliance with its undertakings set out in clause 3 above, and if necessary, will exercise its powers under the Ninth Schedule of the PDPA to do so. 5.3 Clause 5.1 above shall be without prejudice to the Commission’s statutory powers to conduct or resume, at any time, the investigations referred to in clause 2 above if it thinks fit, including but not limited to the situation where the Organisation fails to comply with this Undertaking or part thereof in relation to any matter. 5.4 Nothing in this Undertaking, including the Commission’s acceptance of the Undertaking, is intended to, or shall, fetter or constrain the Commission’s rights and statutory powers (including but not limited to those under sections 48I, 48J, 48L(4) and 50 of the PDPA) in any manner. Neither shall be construed as creating any anticipation or expectation that the Commission will take or not take any particular course of action in the future (whether in the present case or in respect of any other case concerning a breach or suspected breach of the PDPA). The acceptance of this Undertaking is strictly confined to the particular facts of the present case, and is made on the basis of the representations and information provided by the Organisation. The acceptance of an Undertaking in this case shall not be construed as establishing any precedent. 6. VARIATION 6.1 This Undertaking may be varied only with the express written agreement of the Commission. This document has been electronically signed. The Parties hereby affirm that the electronic signatures have been affixed with the due authorisation of each Party and that Parties intend for the electronic signatures to carry the same weight, effect and meaning as hand-signed wet-ink signatures. SIGNED, for and on behalf of ) Fujioh International Trading Pte Ltd ) By the following: ) Name: ______________________________________ ) Designation: _________________________________ ) Date: _______________________________________ ) ACCEPTED by ) ) Name: ___Yeong Zee Kin_______________________ ) Designation: Deputy Commissioner / Commissioner Personal Data Protection ) Date: _______________________________________ ) SCHEDULE A SUMMARY OF FACTS 1. On 24 August 2020, the Organisation’s website was subject to URL manipulation resulting in its customers’ personal data being exposed via uploaded receipt images. The attacker gained access to the Organisation’s website by iterating through the customers’ given identifiers that were reflected at the end of the URL, to download the uploaded receipt images. 2. As a result of the attack, the personal data of the Organisation’s approximately 2,771 users including their name, residential address, email address and telephone number were affected. SCHEDULE B Causes of Incident Remediation Plan 1 Application weakness in the receipt submission process of their online warranty system Introduced session tokens in the online warranty system that expires at the end of each receipt submission 2 Application weakness in the receipt submission process of their online warranty system Replacement of current online warranty system to fix undetected vulnerabilities Target completion by 30 Sep 2021 3 Insufficient data protection management Establish DPMP Completed on 28 Feb 2020 a. Draft policies and notices Target Completion Completed on 25 Aug 2020 b. Establish procedures and templates c. Establish data inventory map d. Establish training data protection curriculum for employees 3 Not having proper data protection clauses in its contract with vendor Establish checklists, procedures and templates for 3rd party vendors: i. Checklists for IT vendors providing IT solutions to FIT ii. Checklists for vendors processing FIT’s personal data; iii. SOPs for 3rd parties handling FIT’s personal data. Completed on 28 Feb 2020 30c5672277e50039e1bc87c7ff242b31b39bf687

Links from other tables