---
# System prepended metadata

title: Lecture 07 PDPA
tags: [School, Notes, DISM, CLI]

---

---
title: 'Lecture 07 PDPA'
disqus: hackmd
---

:::info
ST2502 Computer Law & Investigation
:::

Lecture 07 Personal Data Protection Act
===

<style>
img{
/*     border: 2px solid red; */
    margin-left: auto;
    margin-right: auto;
    width: 80%;
    display: block;
}
</style>


## Table of Contents

[TOC]

Background
---
- PDPA aims to strengthen & entrench sg's competitiveness & position as trusted, world-class hub for businesses

Data Privacy & Personal Data
---
### Data Privacy
- data privacy - right to prevent release of personal info to public
- in sg, personal data protected under PDPA Act 2012 (PDPA)
    - administered by personal data protection commission (PDPC)

### Personal Data
- personal data - data abt indiv who can be identified from data
    - doesnt matter if true or false
    - only certain rules apply for personal data on deceased
        - protection up to 10 years after death
    - covers electronic & non-electronic data

#### Examples
- unique identifiers
    - NRIC
- set of data put tgt that will identify indiv
    - name, age, job, address
- includes

![](https://i.imgur.com/ixoWgzW.png)

#### NRIC Collection Rules
- illegal for orgs to hold on to indiv's NRIC & collect its full num
    - penalty up to 1 mil


Personal Data Protection
---
- PDPA comprises of rules governing
    - collection
    - use
    - disclosure
    - care of personal data
- PDPA recognises both
    - rights of indivs to protect their personal data
        - includes rights of access & correction
    - needs of org to collect, use or disclose personal data for legit & reasonable purposes

#### PDPC's Decision
- breach of protection obligation by tan tock seng hospital 4 Nov 2019
    - warning issued to tan tock seng hospital for failing to implement reasonable security arrangements to orevent unauth disclosure of personal data of patients
    - 85 notif letters to patients to reschedule appointments sent to wrong addresses

### PDPA's Coverage
- organisation, grp of peeps whether or not
    - formed or recognised under sg law
    - resident or having office/place of business in sg

#### Doesn't Cover
- indiv acting in personal/domestic capacity
    - Eg. personal friends
- employee acting in course of employment with org
    - Eg. as employee
- public agency/org acting on behalf of pub agency in relation to collection/use/disclosure of personal data
    - Eg. gov service - civil service

### Key Concepts
- consent
    - orgs can collect/use/disclose personal info only with indiv's knowledge & consent
        - has exceptions
- purpose
    - orgs can collect in appropriate manner for circumstances only if informed the indiv of purposes for collection
- reasonableness
    - orgs can collect only for purposes considered appropriate to reasonable person in given circumstances

### Overview of Data Protection Regime
![](https://i.imgur.com/vp8MEPy.png)

#### Discussion
![](https://i.imgur.com/WiyvfbL.png)
![](https://i.imgur.com/61phgEm.png)
![](https://i.imgur.com/nr5azbi.png)
![](https://i.imgur.com/8r63VNj.png)
![](https://i.imgur.com/BfyiaAU.png)


### Case Studies
![](https://i.imgur.com/OkRonWU.png)
![](https://i.imgur.com/u0Zlok3.png)
![](https://i.imgur.com/rgEwfaF.png)
![](https://i.imgur.com/OouozsX.png)
![](https://i.imgur.com/iQ0I6Mj.png)
![](https://i.imgur.com/8ZgvuXh.png)
![](https://i.imgur.com/OFArycm.png)
![](https://i.imgur.com/NvnoOla.png)
![](https://i.imgur.com/GFbTM0d.png)


### Disposal of Data in Electronic Media
- physical destruction of media itself to render stored data inaccessible
    - Eg. cut it up/smash it
- disposal of data in media only
    - specialised software tools used to securely erase all data in media
    - just moving to recycle bin is insufficient as it's recoverable even after the bin is emptied
- companies can choose disposal methods as long as data cannot be recovered

### Points to Note
- companies liable for employee's acts/breaches of PDPA
- engaging external service providers to dispose docs containing data doesnt relieve companies of their PDPA obligations to protect data

#### Examples
- PDPC fines singhealth for data breach
    - https://www.todayonline.com/singapore/pdpc-slams-singhealth-being-overly-dependent-ihis-metes-out-total-s1-million-fines-over?cid=h3_referral_inarticlelinks_03092019_todayonline
- recent personal data leak by singapore accountacy commission
    - https://www.straitstimes.com/singapore/singapore-accountancy-commission-accidentally-leaks-personal-data-of-6541-people?utm_source=STSmartphone&utm_medium=share&utm_term=2019-11-22+18%3A16%3A16


### Do Not Call Registry
- PDPA provides for establishment of national __do not call (DNC) registry__
    - DNS registry allow indivs to register sg telephone nums to opt out of receiving marketing phone calls, mobile text msgs & faxes
- email ads are regulated by spam control act

- covered
    - B2C marketing msgs
        - Eg. offer to supply, advertise or promote goods/services
    - includes voice calls, SMS/MMS/texts, faxes

- not covered
    - B2B marketing
    - personal calls & SMSes
    - market research/surveys
    - msgs by public agencies for non-commercial programmes
    - doesnt include msgs sent w/o use of phone nums
        - Eg. cell-broadcast
- orgs obliged to check DNC registry within 30 days of doing marketing
    - unless have clear & unambiguous consent in evidential form
    - display their ID, contact info & originating num
- indiv registers phone num with DNC registry
    - num addedd to registry
    - number remains thr unless indiv deregisters or terminates service

#### Isit Effective?
- https://www.straitstimes.com/forum/letters-in-print/do-not-call-registry-does-not-appear-to-stop-unsolicited-messages-calls


More PDPA Cancer
---
- collection, use & disclosure of personal data
- consent required

### Part IV - Collection, use & disclosure of personal data
![](https://i.imgur.com/dVGWJwD.png)
![](https://i.imgur.com/qVt6ISY.png)
![](https://i.imgur.com/3xVg9kV.png)
![](https://i.imgur.com/Fjk0tTs.png)
![](https://i.imgur.com/u8nuU3p.png)

### Part V - Access to & correction of personal data
![](https://i.imgur.com/BjrsKmQ.png)

### Part VI - Care of personal data
![](https://i.imgur.com/NeWqnsl.png)
![](https://i.imgur.com/WYQtxmO.png)

### Part IX - Do not call registry
![](https://i.imgur.com/2GrTlDu.png)
![](https://i.imgur.com/ptFMj3b.png)
![](https://i.imgur.com/iie2AsL.png)



###### tags: `CLI` `DISM` `School` `Notes`