Singapore: Important changes proposed to Singapore’s Personal Data Protection Act

Organisations should plan ahead for significant changes to Singapore’s Personal Data Protection Act (“PDPA”), proposed in a consultation paper published on 14 May 2020.

It is likely that most of the amendments set out in the draft Personal Data Protection (Amendment) Bill 2020 (“Bill”) will be passed, since the PDPC has previously carried out three consultations on key policy proposals, and the Bill consolidates all of these earlier proposals.

If passed, the Bill will be the first amendment to the PDPA since it was passed in 2012.

The key proposed amendments are:

  • Mandatory Data Breach Notification: organisations must notify the local data protection authority (“PDPC”) of a data breach as soon as it is practicable (and in any case no later than 3 days after the day the organisation makes an assessment of a notifiable breach); as well as a requirement to notify affected individuals. The proposed parameters for notification are similar to the current best practice PDPC breach notification guidelines.

 

  • Wider Scope for Deemed Consent: the concept of “deemed consent” will be expanded in scope so as also to cover circumstances where: (i) the collection, use or disclosure of personal data is reasonably necessary to conclude or perform a contract or transaction; or (ii) where individuals have been notified of the purpose of the intended collection, use or disclosure of personal data, given a reasonable opportunity to opt-out, and have not opted out.

 

  • Data Portability: individuals can request a copy of their personal data be transmitted to another organisation, enabling consumers to switch service providers more easily.

 

  • Higher Fines: financial penalties for non-compliance with the PDPA will be increased up to 10% of annual turnover or S$1 million, whichever is higher.

The consultation period is open until 28 May 2020. To read the consultation paper, click here.

For more information, please contact Carolyn Bigg (Partner) or Yue Lin Lee (Registered Foreign Lawyer).

DLA Piper Singapore Pte. Ltd. is licensed to operate as a foreign law practice in Singapore. Where advice on Singapore law is required, we will refer the matter to and work with licensed Singapore law practices where necessary.