Privacy & Information Security Law Blog

On October 15, 2012, the Singapore Parliament passed the Personal Data Protection Act 2012. Though a law has been under discussion for quite some time, this bill was introduced before Parliament only recently, in September of this year. The new law will apply only to data processing in the private sector as data processing by public agencies (or organizations acting on behalf of public agencies) are already subject to internal government rules. Reportedly, the bill will become law in January 2013, enforceable after 18 months, in mid-2014.

A General Framework; More Detailed Rules Forthcoming

The bill introduced before Parliament establishes a general baseline for the protection of personal information, but does not offer a particularly detailed or exacting framework. Previous discussions concerning the possible shape of the law indicate that this high-level approach was intentional. The earlier discussions focused on a general data protection law that would provide a commonly accepted paradigm for the protection of personal data, but would leave more detailed rulemaking to sector-specific efforts by industry regulatory agencies.

For example, the bill does not contain a definition of “sensitive personal information,” and does not impose any special requirements for the handling of “sensitive personal information.” In principle, whether to impose special data protection requirements for “sensitive personal information” will be determined on sector-by-sector basis by appropriate regulatory agencies. For instance, health care regulatory authorities may decide to enact their own industry-specific regulation requiring that personal health information be subject to additional safeguards and treated as “sensitive personal information.” In addition, the bill does not impose a generally applicable data breach notification requirement. Accordingly, regulators in certain sectors (for instance, financial services) may determine on an individual basis whether breach notification obligations are appropriate for their industry.

In keeping with the apparent intention to establish a general, baseline framework, the bill includes a consent requirement clearly influenced by earlier lawmaking elsewhere in the Asia-Pacific region. The bill mandates that data subjects be provided information about the purpose for the collection, use or disclosure of their personal data, and that the consent data subjects consent to such processing. The consent requirement is subject to certain exemptions, including, but not limited to, actions taken in the interest of the data subject where consent cannot be obtained in a timely manner; emergencies that threaten the life, health or safety of the data subject or another individual; processing of personal data which is publicly available; and actions in the national interest. In general, the collection, use or disclosure of personal information is permitted only for the purposes outlined in the data subject’s informed consent, and the data subject may withdraw his or her consent at any time. Data subjects have access and correction rights, and the bill imposes very generalized requirements to maintain the accuracy and completeness of personal data, establish security for the personal data and delete personal data when it is no longer necessary for the purpose for which it was collected.

The bill very generally prohibits transfers of personal data outside Singapore, but leaves open the possibility of permitting cross-border transfers if they comply with requirements under the law (presumably to be enacted later) to ensure the transferred data is subject to comparable data protection as is provided under the bill, or transfers carried out pursuant to an application by the transferring organization. The former might in practice lead to an accountability standard, and the latter might lead to a mechanism resembling European-style binding corporate rules.

Heavy Penalties for Violations

Despite its posture as a general, baseline framework, the bill does contain some stringent characteristics, including arguably heavy penalties for data privacy breaches. For instance, in addition to the S$1 million fine that the Personal Data Protection Commission may levy (as described below), punishment for offenses under the bill may result in a fine not exceeding S$10,000 (higher fines may be imposed in particular circumstances) or up to three years imprisonment, or both.

New Personal Data Protection Commission

The bill also would create a new agency, the Personal Data Protection Commission, with the authority to administer and enforce the new law. The Commission would be able to conduct investigations of possible non-compliance, and would have the power to address violations by issuing orders (euphemistically called “directions”) to (1) stop the collection, use or disclosure of personal data, (2) destroy personal data, (3) comply with any “direction” issued by the Commission, or (4) pay a financial penalty of up to S$1 million (approximately $820,000 USD). The Commission’s “directions” may be enforced by a district court in Singapore. The bill also includes a private right of action for persons suffering loss or damage resulting from a violation.

National Do-Not-Call Registry

Finally, the bill also establishes a national “do-not-call” registry to address the problem of intrusive and unsolicited telemarketing.

This blog post is based on the text of the bill introduced before Parliament, as posted on the Singapore Parliament website. We will provide additional details if further materials are made available by Parliament in the days to come.