Substantiated complaints concerning breaches of customer privacy and losses of customer data

TGI’s Integrated Sustainability Report 2025 contains a dedicated GRI 418-1 table that follows the required structure:

complaints received from outside parties and substantiated by the organization;

complaints from regulatory authorities; and

identified leaks, thefts or losses of customer data.

The current card should:

use the substantive GRI 418-1 table on report page 158 as the principal evidence;

present the exact 2025 values for all three required rows;

distinguish current-year values from the comparative figures;

remove the 202 ethics and compliance activities from the GRI 418-1 assessment;

remove Scope 3 Category 4 emissions;

remove flaring, fugitive-emissions, venting and pneumatic-source information;

assess whether the report indicates a substantial connection to preceding-year events; and

classify the disclosure based only on the privacy-complaint and customer-data rows.

The report extract shows the required GRI categories and a non-zero customer-data incident result; unrelated emissions and compliance-activity data do not contribute to Disclosure 418-1.

The official report search extract identifies the outside-party, regulator and customer-data rows.

O-Bank’s report contains information that needs reconciliation.

The GRI content-index section states that no substantiated complaints concerning breaches of customer privacy or losses of customer data were received. Elsewhere, the report discloses two data breaches and states that 100% were personal-data breaches affecting account holders.

The card should:

retain the zero substantiated-complaints statement for Disclosure 418-1(a), subject to verifying both required complaint-source categories;

not treat the zero-complaints statement automatically as zero customer-data incidents;

identify whether the two personal-data breaches were leaks, thefts or losses of customer data under GRI 418-1(b);

reconcile pages 311 and 313;

report the customer-data incident total separately;

retain affected account holders only as supplementary context;

remove the absence of monetary legal losses as a gap; and

classify the disclosure as internally inconsistent or requiring reconciliation until the two breach records are resolved.

The current LRA card itself records both the zero statement and the two personal-data breaches, but focuses incorrectly on monetary losses.

First Financial Holding’s 2024 Sustainability Report provides quantitative information relevant to GRI 418-1.

The report identifies one data breach, indicates that it was a personal-data breach and reports 592 affected account holders. It also contains a GRI 418-1 table with numeric complaint and customer-data values.

The card should:

use report page 232 as the principal source for the GRI 418-1 complaint and customer-data figures;

verify that outside-party and regulatory-body complaints are shown separately;

use pages 218 and 226 only as supporting context for the data breach and affected-account count;

report one identified data incident only if the incident meets the leak, theft or loss definition used for GRI 418-1(b);

retain 592 affected account holders as supplementary context;

remove financial losses from litigation exceeding NT$5 million;

remove whistleblowing-report discussion;

remove supplier-category information; and

classify the report based on the exact GRI 418-1 table and its reconciliation to the reported breach.

The official report source maps information security and privacy protection to GRI 418-1, while the current card introduces unrelated litigation, whistleblowing and supplier information.