Information Security and Privacy
Privacy Policy
SinoPac Holdings set up a Personal Data Protection and Management Task Force as the highest governing unit responsible for privacy protection. A Vice President-level executive serves as the convener to supervise and take charge of privacy protection and governance, risk supervision and management, improvement of privacy security awareness, and preparing related training programs, and in accordance with Article 15 of the “Regulations Governing the Security Maintenance of Personal Data Files by Non-Government Agencies Designated by the Financial Supervisory Commission” and Article 17 of SinoPac Holdings’ “Personal Data Protection Policy and Archive Maintenance Measures,” in order to continuously improve the security maintenance of personal data, a self-assessment report shall be submitted annually; for any potential non-compliance with laws and regulations identified in the assessment report, improvement and preventive measures shall be planned and implemented, and the results shall be regularly submitted to the Board of Directors for reference.
SinoPac Holdings Personal Data Protection and Management Task Force at least once every six months to discuss the privacy protection of SinoPac Holdings and its first-tier subsidiaries and personal data protection measures. SinoPac Holdings and its subsidiaries have appointed a Data Protection Officer (DPO) or a convener of Personal Data Protection and Management Task Force or a person of equivalent authority and responsibility and assigned a designated department responsible for client data protection. In addition, Bank SinoPac, King’s Town Bank, SinoPac Securities, and SinoPac Leasing organize third-party audits of the Information Security Management Systems (including privacy protection).
SinoPac Holdings uses an integrated corporate risk management framework and three lines of defense model for the personal data risk management. The Company established related risk indicators from risk identification, measurement, response, monitoring, and reporting, risk monitoring points, and early-warning mechanisms. Also set limit management based on the nature of risks and adopted both qualitative and quantitative approaches to evaluate risks at regular intervals for active monitoring and management. The personal data management status is reported semi-annually to the Personal Data Protection and Management Task Force and annually to Board of Directors. Please refer to section 2.3.1 Risk Management Framework for the practices implemented in the three lines of defense of SinoPac Holdings.
Personal Data Notices to Customers
The collection of all personal data of customers by SinoPac Holdings and its domestic subsidiaries is conducted in accordance with the “Financial Holding Company Act”, “Rules Concerning Cross-Selling by Financial Holding Company Subsidiaries”, “Personal Data Protection Act”, and other related laws and regulations. SinoPac Holdings performs its obligations for providing notice to customers regarding the collection of their personal data in the "Customer Personal Data Confidentiality Measures" published on the official website. The items specified in the notice are as follows:
SinoPac Holdings informs customers of the following personal data issues
Nature of information captured
Possibility for customers to decide how private data is collected, used, retained and processed
How the information is protected
Use of the collected information (including basic information, account data, credit information, investment data, and insurance data)
Purpose of using personal data
Recipients of personal data disclosure (including the third-party disclosure policy)
How to request data correction
Opt-out option for joint marketing