Jurisdictional comparison Flashcards
(178 cards)
1
Q
What are the different consent obligations in Singapore
A
Organisation can only collect, use or disclose personal data for purposes for which an individual has given his or her consent.
- Can be in verbal or written form.
If verbal consent given, give written acknowledgement.
- DNC
2
Q
What are the different consent obligations in HK
A
- Consent needed in relation to direct marketing
- If verbal, written confirmation needed in 14 days
- Consent needed if online tracking info related to personal data and is collected for direct marketing purposes
3
Q
What are the consent obligations in India
A
A business cannot collect SPDI unless it obtains the prior consent of the provider of the info.
Consent has to be provided by letter, fax or email
No specific legislation that governs online direct marketing. However general practice to allow opt in/ opt out
4
Q
What are the notification obligations in Singapore
A
Notify ind of purposes before collection, use or disclosure
5
Q
What are the notification obligations in HK
A
PICS - Informed of purpose for which data is to be used and classes of person to whom the data may be transferred
6
Q
What are the notification obligations in India
A
Provider of info should be made aware that info is being collected, purpose of use, recipients, name of collection agency
Prior consent required for disclosure to any party other than gov
7
Q
What are the access obligations in SG?
A
Must upon request provide individual with his data in the possession or within the control of the organisation and information about the ways in which the personal days has been or may have been used or disclosed during the past one year
8
Q
What are the access obligations in HK?
A
The data subject to be informed of his/her rights to request access and the correction of the data and the name, job title, and address of the individual to handle any such request made to the data user.
Under DPP6 (Access and Correction), data subjects are entitled to request access to personal data within 40 days.
Failure to comply with a data access request is an offence under the PDPO
9
Q
What are the access obligations in India
A
The business should permit the provider of the info the right to review the info
10
Q
What is the response period and fulfilment or request for SG?
A
Fulfilment as soon as reasonably possible and otherwise, preferably, fulfilment within 30 days of the request, otherwise a response within such 30 days to inform about expected time of fulfilment
If valid request, correct the personal data as soon as reasonably possible and send the corrected data to other organisations to which the personal data was disclosed within a year before the correction is made.
11
Q
What is the response period and fulfilment or request for HK
A
Require data users to inform a data requestor if it does not hold any of the requested data within 40 days of receiving such a request
12
Q
What is the response period and fulfilment or request for India
A
Not stated
13
Q
Can an access fee be charged in SG?
A
Can charge an individual a reasonable fee for access to personal data about the individual
14
Q
Can an access fee be charged in HK?
A
May be entitled to request a fee if not excessive
15
Q
Can an access fee be charged in India
A
No requirement
16
Q
What are the correction obligations in SG?
A
If valid request, org must correct the personal data as soon as reasonably possible and send the corrected data or other organisations to which the personal data was disclosed within a year before the correction is made
17
Q
What are the correction obligations in HK
A
Data subjects are entitled to request the correction of personal data without charge to the data subject
18
Q
What are the correction obligations in India
A
The business should ensure that any information found to be inaccurate or deficient be corrected
19
Q
What are the complaint rights of individuals in SG
A
Can submit complaint to PDPC. individual can also take civil action against organisation
20
Q
What are the complaint rights of individuals in HK
A
Can submit complaint to PCPD. Privacy Comm may grant assistance such as legal rep and advice to data subjects
21
Q
What are the complaint rights of individuals in India
A
Body corporate must designate grievance officers to manage compliances. Grievance officer shall redress the grievances or provider of info expeditiously but within one month from the date of receipt of grievance.
22
Q
What are the exemptions in SG
A
Public sector, public authorities, publicly available information, public agency, business contracted by SG gov
23
Q
What are the exemptions in Hk
A
Chinese central gov org and media
24
Q
What are the exemptions in India
A
Limited application for sensitive data, limited application to “providers” not data subjects, freedom of speech, lack of openness
25
What is the difference between privacy and security?
Info privacy: Application of rules that govern collection, usage and disclosure (CUD) of personal data / information
Info security: Also protecting any type of info or info asset that supports a business, while ensuring Confidentiality, Integrity and Availability (CIA)
26
What are the info security requirements in SG?
Must make reasonable security arrangements to prevent unauthorised access, collection, use and other risks
27
What are the info security requirements in Hk
DPP4 - Security: A data user needs to take practical steps to safeguard personal data from unauthorised or accidental access, processing, erasure, loss or use
28
What are the info security requirements in India
The IT Act requires reasonable security procedures to be maintained in order to escape liability. Standards based or code by an industry association and approved and notified by the government. At least once a year audit by an independent auditor approved by the government.
29
What are the DPO requirements in SG?
Each org must appoint one or more DPOs. May delegate certain reps, including to non-employees. Business contact of DPO must be made available to the public.
30
What are the DPO requirements in HK
No legal requirement for DPO. However PCPD issued a best practice guide to encourage users to appoint DPO.
31
What are the DPO requirements in India?
Every corporate entity collecting SPDI must appoint a Grievance Officer to address complaints, and respond to requests in an expeditious manner within one month.
32
What are the breach notification requirements in SG?
No mandatory req.
Best practice guide recommends that affected individuals be notified immediately if sensitive personal data involved.
PDPC should be notified ASAP for breaches that might cause public concern or where there is a risk of harm to a group of affected individuals.
33
What are the breach notification requirements in HK
No mandatory requirement.
However according to non-binding guidance issued by the PCPD; encourages notification to the PCPD and to data subjects and where there would be a risk of harm but not notifying.
34
What are the breach notification requirements in India
Upon the occurrence of some cybersecurity incidents, companies a data required to notify the Cert-in within reasonable time.
Breach notice obligations depend upon the place of occurrence of such breaches and whether or not Indian customers have been targeted.
35
What are Binding Corporate Rules?
BCRs are a set of rules adopted within a particular company or corporate group that provide legally binding protections for data processing within the company or the group.
36
What is pseudonymisation?
Anonymisation technique that replaces personal identifiers with other references
37
What is de-identification?
Process used to prevent a person’s identity from being connected with info
38
What is anonymisation?
Removing identifying info
39
What is the definition of personal data in SG?
Data, whether true or not, about an individual who can be identified from that data and other information to which the organisation has or is likely to have access.
Individual is defined as natural persons whether living or deceased
40
What is the definition of personal data in HK
Data relating directly or indirectly to a living individual. From which it is practicable to identify the individual in a form in which access to or processing of the data is practical.
Does not protect info concerning a deceased individual
41
What is the definition of personal data in India?
No definition of personal data, only personal information.
Defined as any information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such a person.
42
What is the definition of sensitive data in SG?
No concept or specific requirement.
Reasonableness requirement in CUDS leads to a need for additional measures in practice in connection with sensitive data.
43
What is the definition of sensitive data in HK
No concept or specific requirement.
Sensitive data include ic card numbers, healthcare, biometric data, financial info
44
What is the definition of sensitive data in India?
SPDI includes passwords, financial info, physical, physiological and mental health condition, sexual orientation, medical records and history, biometrics.
45
What are the children’s data protection rules in SG?
No concept or specific requirement.
In advisory-Data Activities relating to Minors
Age threshold of 13- typically have sufficient understanding to be able to consent on his own behalf.
46
What are the children’s data protection rules in HK?
No concept or specific requirement
PCPD leaflet to help parents and Teachers help children under their care to protect their personal data in the online environment.
47
What are the children’s data protection rules in India?
Child porn crime.
s67 of IT Bill- creating, transmitting, browsing obscene material.
48
What is the treatment of publicly available data / registries in SG?
Generally available if any member of the public could obtain or access the data with few or no restrictions.
Consent not needed if data is publicly available.
49
What is the treatment of publicly available data / registries in HK?
May access and obtain public information, but must still observe Data Protection Principle 1(2) and 3
If for direct marketing activities has to comply with Part VIA of the PDPO and obtain consent.
Relevant factors for assessing:
- Original purpose for which the personal data was placed in the public domain
- Restrictions
- Reasonable expectation of the personal data privacy of the data subjects
50
What is the treatment of publicly available data / registries in India?
No mention of treatment of public registers.
51
What is the National ID system in India?
UIDAI (Unique Identification Authority of India) created In 2009 to issue biometric UID, Aadhaar
52
What is the position for national surveillance in SG?
Credit reporting covered under where necessary for loan evaluation.
53
What is the position for national surveillance in HK
PDPO Code of Practice on consumer credit data.
54
What is the position for national surveillance in India
Only India has credit reporting limitations.
The Credit Information Companies (Regulations) Act is the only Indian legislation, other than the IT code, to have its own data protection code.
India’s Centralised Monitoring system
55
What are the rules on data processing and export in SG?
Transfer only where overseas organisation provide a comparable standard of protection
56
What are the rules on data processing and export in HK?
S33 PDPO - prohibits transfer abroad except in certain circumstances.
57
What are the rules on data processing and export in India?
A business can only transfer the SPDI or information to a party overseas if the overseas party ensures the same level of protection provided for under the Indian Rules.
58
What is the position for intermediaries in SG?
Only the Retention Limitation and Protection obligation are applicable.
59
What is the position for intermediaries in HK
Data processor: DPP2 (Accuracy and retention) and DPP 4 (Security) had been revised to cover data processors.
In outsourcing arrangements (within or outside HK), data user must adopt “contractual means or other means” to prevent any personal data transferred to the data processor from being kept longer than is necessary for processing of that data.
Data user remains accountable for the acts done and practices engaged by data processor
60
What is the position for intermediaries in India?
No concept of data processor - only body corporate
Entire s43A and the Rules are clearly intended to impose liability on:
- Business process outsourcing
- IT enabled Services
- Other outsourced providers
61
What is the extra-territoriality of the data privacy rules in SG?
No specific provisions for extraterritorial operations of the PDPA.
Foreign companies which do not have a physical presence in SG can still be liable under the PDPA but only for actions which takes place in SG such as collection or disclosure of personal information
62
What is the extra-territoriality of the data privacy rules in HK?
No provision dealing with extraterritorial application of the ordinance.
In yahoo Hk case, Privacy Commissioner concluded that the China entities not liable.
63
What is the extra-territoriality of the data privacy rules in India?
IT Act s1(2) unlimited territorial jurisdiction and applies to any offence or contravention committed outside India by any person.
Section 75(1) and (2) states “the act or conduct constituting the offence involved a computer, computer systems or computer network located in India.
64
What are the rules for marketing in SG?
The data protection principles apply to any marketing activities (including electronic marketing) which involve the collection, use or disclosure of personal data.
Telemarketing needs to comply with DNC provisions.
65
What are the rules for marketing in HK?
Data users who wish to use personal data for data user’s own direct marketing purposes to obtain prior consent from the data subject for such action and notify the data subject accordingly.
If consent given orally, data users have the additional obligation to send a written confirmation to the data subject confirming the particulars of the consent received.
Sharing personal data with third party requires prior written consent.
66
What are the rules for marketing in India?
Act does not refer to electronic marketing directly. Privacy rules provide the right to “opt out” of email marketing, and the company’s privacy policy must address marketing and info collection practices.
DNC registry effectively implemented by TRAI.
67
What are the OECD principles?
```
CUPIDASO
Collection Limitation
Use Limitation
Purpose Specification
Individual Participation
Data Quality
Accountability
Security safeguards
Openness
```
68
What are the SG PDPA Principles?
Carp on Tap
Consent
Accuracy
Retention Limitation
Purpose Limitation
Openness/accountability
Notice Specification
Transfer Limitation
Access & Correction
Protection
69
What are the India security practices rules?
Rule 4 : Provide privacy policy
Rule 5: Collection of information (Consent and Purpose Limitation; Lawful purpose and minimal collection, notice and purpose Limitation, Retention, use, subject access and correction, option to refuse or withdraw consent, security, complaint handling
Rule 6: Disclosure limitations and exceptions/ Processing of info
Rule 7: Transfer of information/ data export restriction
Rule 8: Reasonable security practices and procedures
70
What are the HK data privacy rules
CArUSOA
1. Collection
2. Accuracy & Retention
3. Use
4. Security
5. Openness
6. Access & Correction
71
What HK law covers surveillance and identification?
Interception of Comms and Surveillance Ordinance
Introduced a requirement for judicial authorisation of both interception of communications and the more intrusive types of other covert surveillance by law enforcement bodies, while allowing law enforcement agencies to sanction their own use of less intrusive forms.
72
What are the key constitutions for the protection of privacy in Hk
Basic Law which provides the continued application of the International Covenant in Civil and Political Rights; Bill of Rights Ordinance.
ICPR 1966 is the broadest international convention protecting human rights.
73
What is the key ICCPR provision?
Art 17 - deals with the protection of privacy, family, home, correspondence, honour and reputation.
74
What is the HK Bill of Rights 1991?
- Binding only on the gov and all public authorities
| - article 14 replicates 17 of the ICCPR
75
What is the HK position for online tracking info?
Consent is needed if online tracking info relates to personal data and is collected for direct marketing purposes
76
What are the Codes of Practice issued for HK DPP1
Consumer credit data, human resource management, IC and other personal identifiers
77
What does excessive disclosure of personal information breach in Hk?
DPP3 Use
78
What are the consequences of not providing a HK user with an opt out right from consent?
Non compliance HK$500k-1m and imprisonment of 3-5 years depending if personal data used for personal gain.
79
What are the security measures (DPP4) for outsourcing in HK?
In outsourcing arrangements (within or outside HK)(data users must adopt contractual or other means to prevent unauthorised or accidental access, processing, erasure, loss or use of the data transferred to the data processor (DPP4(2)
80
What are the new amendments for DPP5 in HK under the Amendments Ordinance?
Commissioner is empowered to serve enforcement notice directing the data user who is found to have contravened DPP5 (Openness) to remedy and it appropriate, prevent any recurrence.
Recommendations: systematic approach by data users in implementing a privacy management programme built upon a robust data privacy policy and practices that are properly executed,reviewed and assessed by designated data protection officers.
81
How Long can personal data of unsuccessful candidates be held in HK?
2 yrs from date of rejection. may retain beyond 2 if it has a subsisting reason to do so or the applicants have given their consent.
82
What are the consequences of breaching an enforcement notice in Hk?
Fine of HK$50k on first conviction and HK$100k on subsequent conviction and imprisonment for two years
83
What are the penalties for direct marketing contraventions in HK?
If the data user provided data for gain- fine of up to HK$1m and imprisonment for up to five yrs
If otherwise than for gain- fine of up to $500k and imprisonment for up to 3 yrs
If it fails to stop using data for direct marketing, punishable for a fine of up to Hk$500k and imprisonment for up to 3 yrs.
84
Which two DPPs were breached by Octopus in 2010?
DPP 1 Data collection - collected HKID etc for authentication. Commissioner found that Octopus had failed to justify claim that collecting HKID numbers necessary to safeguard against damage and loss. PICS also in unreasonably small font.
DPP3 - Data use (sale of personal data not made clear to data subject)
85
What can a HK complainant appeal to AAB?
A complainant may appeal to AAB (Administrative Appeals Board) against a decision of the Privacy Commissioner not to issue an enforcement notice following an investigation into a complaint.
Can appeal decision not to investigate or to discontinue an investigation, to issue an enforcement notice.
86
What are the two HK consultative advisory committees?
Personal Data (Privacy) Advisory Committee to advise the Commissioner on privacy matters.
Standing Committee on Technological Developments - to advise the Commissioner on matters relevant to the developments in the processing of data and computer tech
87
What laws regulate data privacy in India?
ITA 2000, ITAA 2008!
April 2011, Indian Ministry of Communications and IT published four sets of rules implementing certain provisions of the 2008 amendment:
- The Security Practice Rules require entities holding SPDI to maintain certain specified security standards
- The Intermediary Guidelines Rules
- The Cyber Cafe Rules
- Electronic Service Delivery Rules
88
What are the key sectoral laws in India?
Public Financial Institutions Act 1993, Professional Code of Ethics of Doctors, Telecommunications Laws, Banking Laws
89
What are the two major laws dealing with telephonic and digital surveillance in India?
Indian Telegraph Act 1885
- interception in public emergency and if it is considered necessary
ITA 2000
69: Empowers Central Gov and State Gov to issue directions for monitoring, intercepting or decrypting any info transmitted, received or stored through a computer resource.
90
What is the Indian surveillance system?
Centralised Monitoring System - gives the authorities sweeping access to citizens’ phone calls and internet comms in the name of national security.
No law exists which mandates or regulates the CMS. This mass surveillance system is merely regulated under section 5(2) of the Indian Telegraph Act 1885 which empowers the Indian gov to intercept comms on the occurrence of any public emergency or in the interest of public safety.
91
What is the only Indian legislation, other than the ITA, to provide a data protection code?
Credit Information Companies (Regulation) Act
92
Are there any express provisions in the Constitution of India on the right to privacy?
Only implicit in 2 fundamental rights:
- Art 19(1)(a) Right to freedom and expression
- Art 21: Right to life and personal liberty
93
What are the permitted reasonable restrictions in Art 19(2) in the constitution of India?
State can impose any reasonable restrictions:
(A) in the interest of sovereignty and integrity of India
(B) Security of the state
(C) Friendly relations with foreign states
(D) Public order
(E) Decency
(F) Morality
(G) Contempt of court
(H) Defamation
(I) Incitement to an offence
94
What Indian act mandates timely response to citizens requests for gov info?
Right to Information Act 2005
95
What are the key highlights under the proposed data protection act released by the Ministry of Electronics & IT, Gov of India MeitY?
(1) Extra territorial application to foreign data processors insofar as they have a business connection to India or carry on activities involving profiling of individuals in India
(2) Differential obligations for personal data and sensitive personal data
(3) Obligations of the Data Controller: Notice, Purpose and Collection Limitation, maintaining data quality, storage Limitation
(4) Grounds for processing in addition to consent include use for employment purposes as well as emergencies
96
What are high risk data for processors required to implement under the upcoming India Data Protection Act?
Trust scores, data audits as well as a data protection impact assessment
97
Is data localisation applicable in India?
Under the upcoming Data Protection Act, a copy of all personal data must be stored in India; additionally the Gov may notify certain types of personal data that should mandatorily be processed only in India. the Gov has retained with itself the powers to exempt storage of copies of Sensitive Personal Data
98
What are the requirements for cross border data flows under the upcoming Indian Data Protection Act?
In addition to consent cross border transfers would also require the use of: (a) model clauses and (b) possible adequacy requirements - that is transfer to jurisdictions approved by the Gov
99
What is the court that resolves disputes under the IT Act 2000?
Cyber Appellate Tribunal
100
What is s43 of the IT Act in India?
Section 43 relates to penalty and compensation for damage to computer, computer systems which attracts civil prosecution and criminal action
101
What is section 65 of the Indian IT Act?
Tampering with computer source documents
Penalty: 3yrs imprisonment and 2 lakh rupees
102
What is section 66 of the IT Act
Hacking of computer system
Penalty: 3 yrs imprisonment and fine up to INR 500,000
103
What is section 72 of the Indian IT Act?
Penalty for breach of confidentiality and privacy
Penalty: Three years imprisonment( fine up to INR 100,000)
104
What does the new Section 43A of the ITAA cover?
(A) Where a body corporate
(B) possessing, dealing and handling SPDI or info in a computer resource that it owns, controls or operates
(C) is negligent in implementing and maintaining reasonable security practices and procedures
(D) Causes wrongful loss or gain
(E) Liable to pay damages by way of compensation, not exceeding five crore rupees, to the persons affected
105
What is s66A of the ITAA?
Has been held to be unconstitutional because it was over broad, penalised the sending of offensive messages
Petition that it violated the freedom of speech guarantee in art 19(1)(a) in the Constitution of India
Found unconstitutional in the Shreya Singhal 2015 case
106
Which sections of the ITAA penalise identity theft and computer based scams?
Sections 66C and 66D
107
Which is the national agency for cybersecurity in India?
Indian Computer Emergency Response Team as established by s70B ITAA
108
What is the coverage of the IT Rules 2011?
Bodies corporate or persons located in India
Does not apply to the processing of data in India regarding data subjects located overseas
Some of the rules do not apply to B2B, but only to the collection of individuals’ data by businesses
Covers private sector only
109
What three categories are exempt under the IT Rules?
Religious and social, charitable orgs, non-commercial orgs, non-automated data
110
What is the definition of “personal data” under the IT Rules?
No specific definition of the term “personal data”
IT Rules define “personal info” as “any info that relates to a natural person which, either directly or indirectly, in combination with other info available or likely to be available with a body corporate, is capable of identifying such a person.
111
What is SPDI under section 43A?
- passwords
- financial info
- physical, physiological and mental health info
- sexual orientation
- medical records and history
- biometric info
112
What is the definition of a body corporate?
Any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities
113
Under the India IT Rules, is there data protection where info is collected from third parties or other documentary sources?
Possibly no as some rules only apply to “providers of information”.
114
What is acceptable as reasonable security procedures under s8 of the IT Rules?
Either the IS/ISO/IEC 27001 or a code developed by an industry association and approved and notified by the government.
115
Who is the regulator of CICRA?
Reserve Bank of India
Any Indian citizen can also move to The National Human Rights Commission with an application of violation of privacy right.
116
Who enforces the IT Act in India?
The adjudicating officer and Cyber Appellate Tribunal and thereafter, the different High Courts and the Supreme Court
117
Who regulates unsolicited commercial communications through telephone or text?
Telecom Regulatory Authority of India (TRAI)
Telemarketers must register with TRAI before they may send out marketing communication through telephone or text messages.
Can register preference with Customer Preference Registration Facility (CPRF) or DNC
118
What is s46 of the IT Act?
An adjudicating officer appointed to discern IT Act violations
119
What kind of claims does an Indian adjudicating officer have jurisdiction over?
Claims only to a max of INR 50 million. Jurisdiction for all claims exceeding INR 50 million is vested with the competent court
120
Are the orders of the adjudicating officer appealable?
Yes before the Cyber Appellate Tribunal and thereafter, to the High Courts and the Supreme Court.
121
What are the powers of the adjudicating officer?
- Hear offences of a civil and criminal nature
- Award compensation as damages in a civil remedy
- Impose penalties for the contravention of the Act
122
How soon must grievance officers redress grievances according to the IT Rules?
Within one month from date of receipt
123
What is s72A of the IT Act?
Punishment for disclosure of information in breach of lawful contract - 3 yrs imprisonment and five lakh rupees
124
What is the NCDRC and it’s function?
National Consumer Disputes Redressal Commission
Customers can lodge complaints and includes consumer disputes involving privacy issues
125
What are the penalties for breaching the PDPA?
Up to $1 million. 10k per DNC breach.
126
What are the penalties for breaching the PDPO?
HK$500k -1m of fines and 3-5 yrs jail.
127
What is business contact info in SG?
```
The personal data protection rules do not apply to business contact info, which is defined as:
- an individual’s name
- business title
- business telephone number
- business address
- business email or fax
- any other similar info
Which is not provided by the individual solely for personal purposes
```
128
What is the definition of “organisation” in Singapore
Any individual, company, association, body of persons, corporate or incorporated, whether or not formed or recognised under the law or Singapore, or resident, or having an office or a place of business, in Singapore.
129
What is the definition of individuals in PDPA?
A natural person, whether living or deceased. Not data relating to corporate bodies and other legal persons.
130
What is the definition of a data intermediary?
An organisation that processes personal data in behalf of another organisation but does not include an employee of that other organisation.
131
What provisions apply for a deceased person who has been dead for 10 yrs or fewer
Only the disclosure and protection obligation.
132
What is the definition of a “specified message”?
Under s37 PDPA, a message is a “specified message” if the purpose of the message, or one of its purposes is:
- to advertise, promote or offer to supply or provide any of the following:
> goods or services
> land or an interest in land or
> a business opportunity or an investment opportunity
- to advertise or promote a supplier/ provider or prospective supplier/ provider
133
What are the exclusions from the scope of the DNC as set out in the 8th Schedule of the PDPA?
For voice calls, text and fax messages:
- B2B Marketing
- Personal calls and sms es
- Market research / surveys
- Messages by public agencies for non-commercial programmes
- Servicing messages
- Customer services (appointments)
For text and fax messages: Does not apply to voice calls
- current ongoing relationship with recipient
- message relates to subject of ongoing relationship
134
What does the exemption for evaluative purposes mean?
Organisations may collect, use and disclose personal data without consent where this is necessary for evaluative purposes. (This is set out as exception 1(f) in the Second Schedule, 1(f) in the Third Schedule and 1(h) in the Fourth Schedule respectively).
The term “evaluative purpose” is defined in section 2(1) of the PDPA and includes, amongst other things, the purpose of determining the suitability, eligibility or qualifications of an individual for employment, promotion in employment or continuance in employment.
Hence, the evaluative purpose exception allows employers to collect, use and disclose personal data without the consent of the individual or employee concerned for various purposes that are common in the employment context, for example:
a) Obtaining a reference from a prospective employee’s former employer to determine his suitability for employment; or
b) Obtaining performance records or other relevant information or opinions to determine the performance of an employee.
135
Is consent required when using personal data for managing and terminating the employment relationship in Singapore?
No consent required, only notification needed.
The PDPA does not prescribe the manner of notification and organisations should determine the form and manner that would provide the individual with the required information that allows him to understand the purposes for which his personal data would be collected, used and disclosed. For example, organisations may determine in the particular circumstances if it would be appropriate to inform their employees of these purposes through employment contracts, employee handbooks, or notices in the company intranet. Organisations should also keep their employees updated about new purposes for which an employee’s personal data may be collected, used and disclosed without consent.
For the avoidance of doubt, where an organisation has sufficiently provided a general notification to employees on the purposes for which their personal data may be collected, used and disclosed, for example for performance appraisals, the Commission does not expect organisations to notify employees of the same purpose prior to each time that the organisation engages in such activities.
136
When would consent be invalid under the PDPA?
Consent is invalid if:
- individual is forced to give consent
- individual has not been notified of the purpose
- purposes are beyond what is reasonable
- The organisation gives false or misleading info to mislead or deceive to obtain consent
137
What are the exceptions to consent for collection in SG?
Emergency, publicly available data, public agency
138
What are the exceptions to consent for usage in SG?
Employment, business purposes, professional purposes, business asset transactions.
139
What are the exceptions to consent for disclosure in SG?
Recover debts, make payment, evaluative purposes.
140
What are the options to satisfy the requirement of comparable standard of protection in SG?
- Recipient country has adequate data protection law
- getting informed consent
- coming within an exception
- getting contractual protection or
- relying on binding corporate rules
141
When was the PDPC established?
2 Jan 2013
| From 1 Oct 2016, the IMDA is designated as the PDPC
142
Individuals who suffer loss or damage directly as a result as a result of a contravention of which provisions of the PDPA have a right of action for relief in civil proceedings?
Part IV- Collection, use and disclosure of personal data
Part V- Access to and correction of personal data
Part VI- Care of person data
143
What is the liability for breaches of the Banking Act?
Liability for fine up to 125k and/or imprisonment up to 3 yrs or fine up to 250k for non individuals
144
Outsourcing Risk Management key requirements
Institutions should perform:
- The necessary due diligence and apply sound governance and risk management practices when subscribing to cloud services
- take active steps to address the risks associated with data access, confidentiality, integrity, sovereignty, recoverability, regulatory compliance and auditing
- Ensure that the service provider possesses the ability to clearly identify and segregate customer data using strong physical or logical controls
145
What directions can PDPC give to Ensure compliance with the PDPA?
- To stop collecting, using or disclosing of personal data in contravention of PDPA
- To destroy personal data collected in contravention of PDPA
- To comply with any directions concerning access and correction
- Except where any failure to comply with the PDPA is an offence, pay a financial penalty not exceeding $1m
146
What are the possibilities for appeal or individuals or orgs dissatisfied with PDPC decisions?
28 days to appeal to Data Protection Appeal Panel (DPAP)
Will be heard by an Appeal Comm (3 or more members). Appeal Committees will have all the powers and duties of the PDPC necessary for their work, plus those of a district court.
There can also be appeals to the HC (On a point of law or amount of a financial penalty) or the COA. No appeals thus far.
147
How should organisations handle data breaches under PDPC guidance?
Containing the breach
Assessing risks and impact
Reporting the incident
Evaluating the response and recovery to prevent future breaches
148
Is it an offence to make an access or correction request about another individual without the authority of that individual in SG?
Yes under s51(1) PDPA.
A person who commits an offence under s51(1) is liable to a fine not exceeding 5k or to imprisonment for a term not exceeding 12 months or to both.
149
Is it an offence to alter, destroy documents to evade an access and/or correction request in SG?
Yes under s53(3)(a) of PDPA.
An org or person that commits an offence under s53(1)(a) is liable:
- in the case of an individual, to a fine not exceeding 5k
- in any other case, to a fine not exceeding 50k
150
What PDPA offence is under s51(3)(b) and (c)?
(A)Obstructing or hindering the PDPC in the exercise of their powers or performance of their duties; or
(B) Knowingly or recklessly make a false statement to the PDPC; or
(c) knowingly misleads or attempts to mislead the PDPC in the course of the performance of the duties or powers of the PDPC under the PDPA
151
What is the penalty for breaching 51(3)(b) and (c) PDPA?
In the case of an individual, to a fine not exceeding 10k or to imprisonment for a term not exceeding 12 months or to both
In any other case, to a fine not exceeding $100,000
152
What are the penalties for breaching the DNC
Fine is 10k per offence. In appropriate cases, PDPC may compound the offence for a sum of up to 1k
153
Outsourcing arrangements in the 2012 amendments of the HK PDPO are requirements under which data protection principles?
Security principle (DPP 4) as well as Accuracy and Retention (DPP 2)
154
What is the significance of the Do No Evil Mobile App case in HK?
Issue of aggregating data from publicly available sources- The Commissioner ruled that the use of personal data obtained from the public domain for due diligence review and background check was inconsistent with the original purpose of data collection by the Judiciary, ORO and Companies Registry, as well as their purposes of making the data publicly available.
155
The Octopus Rewards case was a breach of which data protection principles under the PDPO?
Data collection and data use
156
Can a complainant appeal the decision of the AAB in HK?
There is no appeal against the decision to court, but aggrieved parties can seek judicial review of the AAB decision.
157
Out of SG, HK and India, which relates to personal identifiable information that relates directly or indirectly to the individual?
HK and India
HK: Data relating directly or indirectly to a living individual (data subject). From which it is practicable to identify the individual in a form in which access to or processing of the data is practical.
India: Defined as any info that relates to a natural person, which, either directly or indirectly, in combination with other info available or likely to be available with a body corporate, is capable of identifying such a person.
Singapore does not make such references in the PDPA
158
What kind of individuals are not covered by Singapore’s PDPA?
An employer or domestic maid is not covered as the PDPA does not apply to any individual acting in a personal or domestic capacity.
Would cover a financial advisor or a Real Estate agent.
159
What kind of records are exempted by PDPA?
Personal data that is in a record more than 100 yrs old
160
Which telephone lines applies to SG’s DNC registry?
Fixed residential lines and business numbers (a telemarketer May target a CEO and call him or her at his office line).
161
What kind of records are exempted by PDPA?
Personal data that is in a record more than 100 yrs old
162
Which telephone lines applies to SG’s DNC registry?
Fixed residential lines and business numbers (a telemarketer May target a CEO and call him or her at his office line).
163
The following are requirements under the SG DNC registry rules except:
Providing opt in consent at point of collection.
Real requirements: Organisations must check against DNC registry within 30 days before doing marketing unless they have clear and unambiguous consent in evidential form, display their ID, contact info and originating number.
164
What are the exceptions to getting consent in Singapore?
- Emergency situation
- Publicly available data
- When the information consists of documents produced for employment business or professional purposes (eg. a business contract which involves personal data)
- When two companies merge or there is an acquisition (business asset transactions)
165
Which of the following does not apply when managing opt outs?
Clear and unambiguous consent required under the Consent obligation (as this is under the DNC provisions not Consent).
Fresh consent for new purposes is required under the consent obligation and purpose Limitation obligation.
166
Is there a common law tort of invasion of privacy in Hk or SG?
No
167
Which are the ways in which there is constitutional protection of privacy in HK?
- Basic Law specifically provides the protections in relation to privacy
- HK’s Bill of Rights Ordinance
- Basic Law (1990) provides for the application of the ICCPR
168
Does the PDPO distinguish between automated and non automated data or processing?
No
169
How is “person” defined in HK PDPO?
Includes any public body and any body of persons, corporate or unincorporate
170
What is the definition of a data user?
A person who, either alone or jointly or in common with other persons, controls and collection, holding, processing or use of the data
171
Is fabricated or untrue data relating to an individual considered as personal data under Hk PDPO?
No.
However biometric data, mobile phone numbers and exam scripts on their own will not be considered personal data unless coupled with other personally identifiable information.
172
What are the key amendments in the Personal Data (Privacy) (Amendment) Ordinance 2012?
The Amendment Ordinance changes took effect on 1 Oct 2012 :
- use of personal data for direct marketing (new sections 35B to 35H)
- provision of personal data to another for use in direct marketing (new sections 35I and 35M)
- exclusions for social services, welfare dept, health care services
- disclosure of personal data obtained without consent
- regulating data processors
- enforcement notices
- legal assistance for aggrieved individuals
173
What is a general vs partial exemption under Hk PDPO?
General exemption: personal data held for domestic or recreational purposes
Partial exemption: publicly available data, employment related matters, legal proceedings and legal privilege
174
What are the constitutional protections that may relate to privacy in India?
Constitution of India does not contain any express provisions on the right to privacy. It is only implicit in two fundamental rights of the India Constitution:
- Right to freedom of speech and expressions (Art 19(1)(a))
- Right to life and personal liberty (Article 21)
Other Constitutional Protections
- The Right to Information Act 2005
- The Protection of Human Rights Act 1993
175
Section 43A and the 2011 Rules are also know as
Reasonable security practices and procedures
176
Which of the three jurisdictions has a code of practice for the national ID?
PCPD Code of Practice on ID card numbers and other personal identifiers
177
Section 43A and the 2011 Rules are also know as
Reasonable security practices and procedures
178
Which of the three jurisdictions has a code of practice for the national ID?
PCPD Code of Practice on ID card numbers and other personal identifiers
