Data Governance and Personal Data Protection

We are currently in the era of rapid technology advancement, incurring risks on infringement of privacy rights in the process of data collection, data utilization, disclosure of personal data of stakeholders— customers in particular. Therefore, the Bank emphasizes the appropriate management of personal data such as general personal data, financial transaction data, and customer behavior data in terms of the use of products and services. We always realize that winning trust and earning confidence from customers and stakeholders who use our products and services are truly priceless. Also, the storage of customer and stakeholder information in a secure and appropriate manner help boost the Bank’s credibility, reputation, and good image.

In this connection, the management of privacy and security of customer and stakeholder data is considered as compliance with legal requirements and relevant regulations including the Personal Data Protection Act B.E. 2562 (2019) which will go into effect in 2020. Therefore, Krungsri has regularly reviewed the policies and personal data protection measures to protect the rights of data owners as required by laws.

Management Approaches

• Establish the “Policy for Data Governance” adopted as a guideline for managing significant data (including personal data) starting from data input, data collection as needed, data analysis and reporting, data submission in accordance with the rules of the regulatory authorities supervising the commercial banks, and data disposal when no longer necessary. The said policy shall be applicable to the Bank, directors, executives, employees, individuals, and juristic persons performing tasks on behalf of the Bank. In this connection, the policy shall be reviewed annually or upon any significant change.
• Establish the the “Policy for Personal Data Protection” and Personal Data Protection Common Procedure” and “Procedure for Requesting the Consent for Collection, Usage or Disclosure of Data” following objectives:
  • To develop frameworks and/or guidelines for relevant departments of the Bank and stipulate the governance measures regarding “personal data” protection of data subject, retail customers, vendors/suppliers being individuals, personnel of the customers and the Bank’s vendors/suppliers being juristic persons, employees, contact staff, and directors of the Bank as required by laws
  • To provide relevant functions with knowledge sources, references, and operating guidelines regarding the collection, use, disclosure, submission, and transfer of personal data as well as storage and disposal of personal data when no longer needed, as required by laws
• Establish the “Data Committee” responsible for stipulating policies and measures for handling various sets of information of the Bank and companies in the Financial Business Group (Krungsri Group).
• Establish the “Data Stewardship Working Group” responsible for effectively driving policies into practice by promoting a clear understanding of the roles and responsibilities of relevant stakeholders, as well as enhancing the Bank’s data management capabilities in terms of data access, data utilization, and data quality.
• Establish the “Data Governance Department” responsible for communicating the policies and the data management measures to the executives, employees, and relevant stakeholders as well as exercising control to ensure that they strictly comply with the Data Management Governance Policy
• Establish a clear data classification approach to manage the data in the most efficient manner—especially the “Key Data Elements” (KDEs) deemed as key data for customer services, risk and financial reports, and reports submitted to the relevant regulatory
• Establish the roles and responsibilities of relevant persons regarding data management under the concept of “Three Lines of Defense” to ensure that the Bank has systematic data management throughout the organization.
  

  1. First Line of Defense refers to business and supporting functions.
  2. Second Line of Defense refers to the Data Governance Committee and functions assigned by the Data Governance Committee, the Risk Management Group, and the Compliance Group
  3. Third Line of Defense refers to the Internal Audit Group.
• Appropriately stipulate and review security measures through the Data Protection Impact Assessment of personal data processing activities in diverse dimensions, while specifying potential risks and impacts, as well as risk mitigation guidelines for such data processing activities to prevent personal data loss, and unauthorized or unlawful personal data access, use, alteration, modification, or disclosure.
• Prepare the “Privacy Notice” to explain details of the personal data processing to the data subject and boost confidence among the Bank’s customers, executives, and staff that the Bank collects, uses, and discloses the personal data transparently and responsibly in compliance with the Personal Data Protection Act B.E. 2562 (2019). The Privacy Notice will be reviewed twice a year in line with the personal data processing activities according to changing business, economic and social conditions. This included the communication of the Privacy Notice through various channels of the Bank, both in hard-copy and soft-copy formats.
  Summary of Privacy Notice