Singapore – Personal Data Protection Law Is Enacted

The Singapore Government has passed the Personal Data Protection Act 2012  (PDPA) which provides for the first time in Singapore for the protection of personal data (PD) and the setting up of a Do-Not-Call regime.  After several rounds of extensive public consultation, the PDPA was read in Parliament for the final time on 15 October 2012 and passed. According to the Government, the PDPA is likely to come into effect in early 2013.

The PDPA will govern the collection, use and disclosure of PD by organisations in a manner that recognises both the right of individuals to protect their PD and the need to collect, use or disclose PD for purposes that a reasonable person would consider appropriate. 

One of the main objectives of the PDPA is to position Singapore as a hub for global data management and cloud computing. It is intended that the PDPA should provide a baseline law that operates in tandem with more stringent sectoral regulations. The PDPA is not intended to be burdensome for businesses but will curb excessive and unnecessary collection of an individual’s data by organizations.  The PDPA also establishes a Do-Not-Call registry for individuals who do not wish to receive marketing messages in specified forms.

The PDPA will be administered by the Personal Data Protection Commission (PDPC). The PDPC will enforce the law but will also undertake outreach and educational activities relating to the PDPA.

The PDPA is divided into two parts: (i) data protection and (ii) the Do-Not-Call regime.

Data Protection – Scope of coverage of the PDPA

i. Types of data covered – PDPA applies to data, whether true or not, about an individual who can be identified – (a) from that data, or (b) from that data and other information to which the organization has or is likely to have access. The definition applies to all types of data, whether electronic or not. The PDPA will be consistently applied across all types of PD – including health, employment and financial standing data.

ii. Who the PDPA applies to – The PDPA applies to all private sector organizations, large or small. It also applies to individuals who are using the data other than for domestic or personal use.

iii. Who the PDPA does not apply to – The PDPA will not apply to public agencies or organisations acting on behalf of a public agency in relation to the collection, use or disclosure of PD. The rationale for this exclusion is that the public sector has its own set of rules. The rules on data protection also do not apply to individuals acting in a personal capacity.

iv. Both Singapore-based & overseas organisations covered – The PDPA will apply to organisations in Singapore and those that are engaged in data collection, processing or disclosure of data of individuals within Singapore, even if the organisation is not physically located in Singapore. 

Exclusions

i. General exclusions – The full DP obligations do not apply to:

a. Data intermediaries will only have to comply with the safeguarding and retention obligations under the PDPA.  A data intermediary is an organisation which processes person data on behalf of another organisation, but does not include an employee of that other organisation.  In contrast, data controllers, which are organisations with control of the data, will have to comply with all provisions;

b. Business contact information is excluded. Business contact information is defined as an individual’s name, position name or title, business telephone number, address, e-mail or fax number and other similar information.  

c. PD pertaining to deceased individuals, except provisions on disclosure and protection if the individual has been dead for 10 years or fewer; and

d. PD contained in a record in existence for at least 100 years;

ii. Privacy Officer – Organisations will need to designate at least one individual to be responsible for compliance with the PDPA and to answer queries on DP practices.

iii. Rules on the collection, use and disclosure of PD

a. Collection of PD necessary for supply of products or services – Under the PDPA, organisations are prohibited from requiring an individual to consent to the collection, use or disclosure of PD as a condition of supplying the product or service, beyond what is reasonable to provide that product or service.

b. Consent – An organisation is required to obtain an individual’s consent for the collection, use or disclosure of that individual’s PD. The PDPA does not prescribe the manner in which consent may be given. Organisations seeking consent would need to notify individuals of the purposes for the collection, use or disclosure of PD. These purposes should be purposes that a reasonable person would consider appropriate in the circumstances.  They should not be overly broad. In some cases, consent will be deemed.  An individual is deemed to have given consent if that person voluntarily provides that PD for a purpose and it is reasonable that individual would voluntarily provide the data. If an individual gives, or is deemed to have given consent to the disclosure of PD by one organization to another for a particular purpose, the individual is deemed to consent to the collection, use and disclosure by that other organisation for the same purpose. Individuals have a right to withdraw consent at any time. However, in relation to PD already in an organisation’s possession, withdrawal of consent would only apply to the organisation’s prospective use or disclosure of the PD.

c. Collection, use and disclosure of PD without consent 

The PDPA allows for the collection, use and disclosure of PD without consent in specific circumstances.

These circumstances include, but are not limited to, collection, use and disclosure of PD:

(a) that is publicly available;

(b) for any necessary purpose that is clearly in the interest of the individual;

(c) for beneficiaries of insurance policies and trusts, and for investigative purposes;

(d) for a business asset transaction;

(e) for artistic or literary purposes;

(f) for news activities;

(g) for research purposes;

(h) for evaluative purposes; and

(i) for creating a credit report, if the collection is done by a credit bureau or bank.

The exclusion of publicly available information is likely to assist organizations that glean PD from such sources and to not limit activities performed in public, such as the taking of photographs in public places.

d. Purpose – The collection of PD must be for reasonable purposes and fulfill the purposes that the organization discloses. Although it is good practice for organisations to explain why it is reasonable to collect PD and specify details of how it will be shared, this is not mandatory.

Organisations are required to seek fresh consent if the PD is used for different purposes.

e. Specific types of data – The PDPA is a baseline regulation, and sectoral agencies that determine how to deal with specific types of data, such as children’s PD, medical data and financial data will be able to put into place stronger protection. These sectoral laws will continue to apply.

f. Transfers of data out of Singapore – For transfers of PD outside Singapore, an organisation can only make such transfers if it ensures that organisations overseas maintain a standard of protection comparable to the protection under the PDPA.  It is likely that this can be fulfilled in a number of ways, including contractual arrangements and binding corporate rules.

iv. Rules on access and correction

Access – Generally, upon the request of an individual, the organisation should take steps to assist the individual in obtaining his PD, provide the individual with information about the ways in which the PD has been used and provide the individual with the names of the individuals and organisations to whom the PD has been disclosed.

Correction – Organisations should take steps to correct any inaccurate data at the request of the individual, if the data is in the possession of the organisation or under its control. Such corrected data should also be sent to any other organisations to which the PD was disclosed within a year before the date the correction was made.

Organisations will be allowed to charge a reasonable fee to recover any costs incurred in allowing individuals to access and correct data on a cost recovery basis.

There are circumstances where organisations would not be required to provide individuals access to certain PD:

- where the PD would reveal confidential commercial information, which could harm the competitive position of an organisation;

- PD subject to legal professional privilege; and

- PD collected or created by a mediator or arbitrator

Organisations can also refuse requests for PD where the requests would unreasonably interfere with operations because of repetitious or systematic requests, or which are frivolous or vexatious.

v. Rules on accuracy, protection and retention of PD

Accuracy – Organisations will be required to make a reasonable effort to ensure that PD collected by or on behalf of the organisation is reasonably accurate and complete, if the PD is likely to be used by the organisation to make a decision that affects the individual to whom the PD relates, or is likely to be disclosed by the organisation to another organisation.

Protection – Organisations will be required to protect PD in its possession or under its control, by making reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or other similar risks. This obligation will apply to data intermediaries as well.

Retention – An organisation must not retain PD or remove means by which the PD can be associated with particular individuals, as soon as it is reasonable to assume that (a) the purpose for collecting the data is no longer being served by retention and (b) retention is no longer necessary for legal or business reasons. This obligation will also apply to data intermediaries.

Enforcement

The PDPA adopts a complaints-based approach to enforcement. The PDPC will review the actions of organizations brought to its attention and issue decisions for compliance.  Financial penalties of up to S$1 million may be imposed.  There is however no breach notification requirement under the PDPA.

There is also a private right of action available under the PDPA for individuals who have suffered damages as a result of a breach.

Do Not Call (DNC) Registry

Introduction – The DNC Registry will allow individuals to register to opt-out of receiving marketing messages in the form of voice calls, text messages, including SMS and MMS, and fax messages. Email and post are not included as unsolicited email is regulated by the Spam Control Act and can also be blocked by filters. Specified messages sent without the use of telephone numbers (such as messages sent through cell broadcast) will also be excluded from the ambit of the DNC Registry.

Separate DNC registries for voice, SMS and fax will be set up and individuals can opt out and register at any one or all these registries.

Application – The DNC Registry provisions will apply to marketing messages addressed to a Singapore telephone number where the sender is in Singapore when the message is sent or when the recipient is in Singapore when the message is accessed.

Marketing messages – Where one of the purposes of a message is to offer to supply, advertise or promote goods or services, or to promote the suppliers or prospective suppliers of goods and services, that message would be considered a marketing message.

Non-marketing messages – Messages without marketing elements, such as messages promoting political or charitable causes, messages soliciting donations, market research messages and messages that promote national programmes of a non-commercial nature would not be considered marketing messages.

Business numbers – Business numbers can be registered under the DNC Registry, but messages sent to organisations for any purpose of the receiving organisations are not considered marketing messages. This means owners of business numbers will not be able to prevent B2B marketing, but organisations cannot send messages to a business number registered on the DNC to market products or services to individuals. This balance seeks to mitigate the impact on B2B transactions whilst preserving the right of individuals not be reached at business numbers for personal marketing purposes.

Explicit consent – Organisations can nevertheless send specified messages to individuals who have registered their numbers on the DNC Registry if that organisation has obtained explicit consent from the individuals.

The DNC obligations will apply to organisations that outsource their promotion or advertising functions to other organisations if they are found to authorise that other organisation’s acts.

“Filtering” of DNC lists – Organisations will need to send their database for a campaign to the DNC Registry for “filtering” within 60 days (for the first 6 months and eventually for 30 days) of the campaign in order to confirm whether any Singapore telephone number is listed on the registers.

Penalty and enforcement regime – Penalties will be capped at $10,000 per breach and up to $1,000 in composition fines. A Data Protection Commission will also have the power to require the cooperation of telecommunication licensees in the investigation of whether an organisation has breached the DNC Rules.

Implementation Framework

The PDPA is likely to come into effect in January 2013. The Singapore Government will establish the Data Protection Commission and issue Guidelines from about March 2013 to assist organisations’ in their efforts to comply with the PDPA.

Transitional provisions – The data protection obligations in the PDPA will be effective 18 months after the PDPA comes into effect and the sunrise period will apply equally to small and large companies alike. The DNC Registry however will be implemented earlier, 12 months after the PDPA comes into effect. 

Existing PD – Organisations will be allowed to use PD collected before the day of commencement of the PDPA for purposes for which the data was collected unless consent for such use is withdrawn. However, obligations relating to safekeeping and retention of such PD will apply.

The PDPA will not invalidate existing contractual agreements for the use of customers’ PD. However, fresh consent would need to be obtained for new uses of existing PD. Where consent was not previously obtained, individuals may require organisations to stop using the PD by indicating that they do not consent to such use.

Conclusion

The PDPA marks a milestone in providing some form of protection for individuals’ PD in Singapore notwithstanding the exclusion of public agencies from the law.  It is intended to be a baseline law without stringent requirements such as breach notification. The PDPA is seen as an important step in attracting more data centres and data analytics businesses to set up operations in Singapore and to regulate the flow of data, even as Singapore positions itself as a regional data hub. The DNC aspects of the law will provide challenges for the direct marketing industry and B2C marketing across a wide range of industries but is likely to have less of an impact on compliance costs after the initial period of compliance. Overall, the PDPA provides a regime that can boost Singapore’s attractiveness to companies as a business hub in Asia.