Earlier this year, the Ministry of Communications and Information and the Personal Data Protection Commission (PDPC) issued the draft Personal Data Protection (Amendment) Bill 2020 which seeks to amend the Personal Data Protection Act (PDPA) (Act 26 of 2012). If passed, this would be the first amendment to the PDPA since it was passed in 2012. Further amendments may be sought to be included in the final Bill which is expected to be presented to Parliament soon.

The proposed amendments include:

1. New: Mandatory Data Breach Notification Requirement

To strengthen protection for individuals and make organisations more transparent when a data breach occurs:

• If the amendments are passed, organisations will now have to notify the PDPC of any data breach which results in or is likely to result in significant harm caused to the individual(s), or if it affects more than a prescribed number of individuals. There is no such requirement at the moment.
• The draft bill defines “Data Breach”, as “the unauthorised access, collection, use, disclosure, copying, modification, disposal of personal data, or the loss of any storage medium or device on which personal data is stored”.
• Notification must be made but no later than 72 hours after the organisation has determined that a notifiable data breach has occurred.
• Organisations would also be required to notify each affected individual who may suffer significant harm as a result of the data breach. There are exceptions to this requirement.

Organisations should institutionalise policies and processes to address scenarios of data breach occurrence (whether suspected or actual). Where possible, organisations should also conduct tabletop exercises during “peacetime” to test an organisation’s familiarity with identifying, detecting, responding and remediating the data breach.

2. New: Liability for Individuals Relating to Egregious Mishandling of Personal Data and Increased Penalties for Non-compliance with the PDPA

To make individuals and organisations who handle or have access to personal data more accountable:

• It is proposed to make individuals liable for egregious mishandling of personal data (e.g. unauthorized disclosure of personal data under the control of an organisation, or unauthorized re-identification of anonymized data). Individuals found guilty of each offence will be liable to a fine not exceeding S$5,000 or to imprisonment for a term not exceeding 2 years, or both.
• However, individuals would not be liable if they are able to prove that the data was publicly available at the time of disclosure, or if the re-identification was for a permitted purpose and the individual had notified the PDPC or the organisation of the re-identification.
• Currently, the maximum financial penalty that may be levied under the PDPA is S$1 million. With the proposed amendments, the maximum financial penalty for data breaches is up to 10% of annual gross turnover, or S$1 million, whichever is higher.

Organisations should review their Personal Data policies and practices and ensure that clear policies and guidelines are provided to every employee. Organisations should ensure that employees understand, internalize and comply with these policies. Policies should also be updated from time to time to reflect changes in the PDPA or the business environment.

Additionally, organisations should strengthen the security of their information systems so as to prevent any unauthorised disclosure of data and/or re-identification of anonymized data by employees.

Organisations need to take a proactive stance in protecting personal data given the heavier penalties that can be imposed.

3. New: Data Portability Obligation

To provide consumers greater autonomy over their personal data, and to allow individuals to switch to new service providers more easily:

• Under the new Data Portability Obligation, an organisation must, at the request of an individual, transmit his/her personal data to another organisation (i.e. data porting).
• An individual may exercise this right if she has an ongoing relationship with the individual, the data is in electronic form, and the data was collected or created by the porting organisation within a specified period before the individual’s request was made.
• The right to have one’s personal data ported is not absolute. There are circumstances under which an organisation may decline to carry out data porting.
• The PDPC can review an organisation's refusal to transmit the individual’s data despite having received a data porting request, the organisation’s failure to transmit the data within a reasonable time, and the fees charged by the organisation to transmit the data.

Organisations should start exploring ways to safely and efficiently transmit an individual's personal data (e.g. in a machine-readable format) and equip itself with the ability to perform data porting.

4. Updated: Meaningful Consent by Individuals

The framework for the collection, use and disclosure of personal data under the PDPA is being enhanced to ensure meaningful consent by individuals:

• The proposed amendments will expand the situations where an individual would be deemed to have given their consent under the PDPA (e.g. consent to disclose an individual’s personal data to a third party may be deemed given if disclosure was reasonably necessary to conclude or perform a contract between the individual and organization).
• Individuals could also be deemed to have consented if they have been notified of the purpose for which their personal data will be collected, used or disclosed, but failed to opt-out within a reasonable period.
• Organisations would also be able to collect, use and disclose individuals' personal data without their consent in certain prescribed circumstances. For example, where it is in the legitimate interests of the organisation or if it is for business improvement purposes.

Whilst the proposed amendments would be a boon for organisations, obtaining consent from individuals for the collection, use and disclosure should remain as the default since these proposed amendments do not cover all use cases.

5. Updated: Do-Not-Call (DNC) Provisions and Spam Control Act (SCA)

The goal? To address consumer annoyance and provide consumers with greater control over unsolicited marketing messages:

• The updated SCA will now cover commercial text messages sent to Instant Messaging accounts (e.g. Telegram and WeChat).
• The DNC Provisions will be updated to prohibit unsolicited messages from being sent to telephone numbers obtained through the use of dictionary attacks or address-harvesting software.
• Further, the PDPA will also introduce obligations on third-party checkers who are engaged by organisations to check the DNC Register(s) on their behalf.

Organisations who do marketing through instant messaging must now abide by the SCA provisions, and failure to do so may result in financial penalties.

If you have any questions regarding this article, please contact Gilbert Leong.