Singapore

Contribution Details Amica Law LLc

Geraldine tan Associate Director

Law

Singapore recently enacted a new Personal Data Protection Act 2012 (No. 26 of 2012) (“Act”) on 15 October 2012. The Act will take effect in 3 phases:

• Provisions relating to the formation of the Personal Data Protection Commission (“Commission”) came into force on 2 January 2013;
• Provisions relating to the National Do-Not-Call Registry (“DNC Registry”) will come into force in early 2014; and
• The main data protection provisions will come into force in mid-2014.

The phased implementation of the Act serves as a transition period for organisations to review and adopt internal personal data protection policies and practices, so that they may comply with the Act. The exact dates on which the DNC Registry provisions and other data protection provisions will come into force will be announced at a later date.

Definition of Personal Data

“Personal data” is defined in the Act to mean data, whether true or not, about an individual who can be identified;

• from that data; or
• from that data and other information to which the organisation has or is likely to have access.

Definition of Sensitive Personal Data

There is no definition of “sensitive personal data” in the Act.

National Data Protection Authority

Personal Data Protection Commission

Registration

There are no registration requirements under the Act.

Data Protection Officers

Each organization is required to appoint one or more data protection officers to be responsible for ensuring the organization’s compliance with the Act. The contact details of at least one of these data protection officers must be published.

Collection and Processing

Organizations may only collect, use, or disclose personal data where:

• they obtain consent from the individual prior to the collection, use, or disclosure of the personal data;
• there is deemed consent by the individual to the collection, use, or disclosure of the personal data; or
• if no consent or deemed consent is given, in specific circumstances prescribed in the Act. An individual may at any time withdraw any consent given, or deemed given under the Act, upon giving reasonable notice to the organization.

Further, any collection, use or disclosure of the personal data must only be for the purposes that a reasonable person would consider appropriate in the circumstances, and for purposes to which the individual has been notified of. Such notification must be made in accordance with the requirements of the Act.

Transfer

Transfer of personal data out of Singapore is allowed, provided that the organisation ensures that a comparable standard of protection (as set out in the Act) is accorded to personal data that is to be transferred overseas.

An organization may apply to be exempted from any requirement prescribed under the Act in respect of any transfer of personal data out of Singapore. An exemption may be granted on such

conditions as the Minister for Communications and Information may require.

Security

Organizations are obligated to protect personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks. The Act does not specify specific security measures to adopt and implement.

Breach Notification

Currently, there are no specific legislative requirements for data users to notify authorities regarding data protection breaches in Singapore.

Aggrieved parties may either make a complaint to the Commission, or may take out a private action in civil proceedings. The Commission may also conduct investigations on its own motion.

Enforcement

Enforcement of the Act is carried out by the Commission. The powers of the Commission

include giving directions to:

• stop collection, use or disclosure of personal data in contravention of the Act;
• destroy personal data collected in contravention of the Act;
• provide or refuse access to or correction of personal data; and/or
• pay a financial penalty not exceeding $1 million.

These directions may be registered with the Singapore District Courts so that they may have the force and effect of an order of court.

Directions or decisions given are subject to reconsideration by the Commission, upon written application by any aggrieved party.

Directions, decisions or reconsiderations of the Commission may also be subject to appeal to a Data Protection Appeal Committee, unless the direction or decision to be appealed is the subject of an application for reconsideration, in which case such appeal would be deemed withdrawn.

Directions may only be appealed to the High Court and Court of Appeal with regard to:

• a point of law arising from a direction or decision of the Appeal Committee; or
• any direction of the Appeal Committee as to the amount of a financial penalty.

Any person who has suffered loss or damage directly as a result of a contravention the Act is also entitled to pursue a private action in court. However, where the Commission has made a decision with regard to the said loss or damage, a right of private action will only lie after the decision has become final as a result of there being no further right of appeal. The court may grant to the plaintiff all or any of the following

Relief by way of injunction or declaration;

• Damages; and/or
• Such other relief as the court thinks fit.

Electronic Marketing

The Act will apply to electronic marketing activities, to the extent that there is any collection, use or disclosure of personal data by an organization.

Further, the Act provides that no person or organization is to conduct electronic marketing activities by sending a specified message to a Singapore telephone number, unless such person or organization has checked and received confirmation from the Commission that the telephone number is not on a Do-Not-Call register maintained by the Commission (“DNC Register”). An individual may apply to the Commission to add or remove his Singapore telephone number on the DNC Register.

Specified messages include messages that are sent with one of the following purposes

• To advertise or promote goods or services;
• To advertise or promote a supplier, or prospective supplier, of goods or services;
• To offer to supply land or an interest in land;
• To advertise or promote land or an interest in land;
• To advertise or promote a supplier, or prospective supplier, of land or an interest in land;
• To offer to provide a business opportunity or an investment opportunity;
• To advertise or promote a business opportunity or an investment opportunity;
• To advertise or promote a provider, or prospective provider, of a business opportunity or an investment opportunity; or
• Any other prescribed purpose related to obtaining or providing information.

“Message” is defined in the Act to mean any message, whether in sound, text, visual or other form. This includes any voice calls, faxes, Short Messaging Service (SMS) or Multimedia Messaging Service (MMS)

The Act will apply to specified messages addressed to a Singapore telephone number where:

• the sender of the specified message is present in Singapore when the specified message was sent; or
• the recipient of the specified message is present in Singapore when the message is accessed.

Electronic marketing activities are also regulated under the Spam Control Act (Cap 311A), to the extent that such activities involve the sending of unsolicited commercial communications in bulk by electronic mail or by SMS or MMS to a mobile telephone number

Currently, there are no specific requirements relating to online privacy (including cookies and

location) under the Act.