Public Consultation on the Draft Personal Data Protection (Amendment) Bill

28 May 2020

Thank you for your feedback. The public consultation on the draft Personal Data Protection (Amendment) Bill 2020, including related amendments to the Spam Control Act, is now closed.

14 May 2020

INTRODUCTION

1. The Ministry of Communications and Information (MCI) and the Personal Data Protection Commission (PDPC) invite the public to provide feedback on the draft Personal Data Protection (Amendment) Bill, including related amendments to the Spam Control Act (SCA).

   • SCOPE OF CONSULTATION

2. The Personal Data Protection Act 2012 (PDPA) sets a baseline standard for data protection in the private sector. It strikes a balance between the need to protect individuals’ personal data and private organisations’ need to collect, use and disclose personal data for legitimate and reasonable purposes. The PDPA contains Data Protection Provisions which govern the collection, use and disclosure of personal data by organisations; and Do Not Call Provisions which govern the sending of telemarketing messages to Singapore telephone numbers. The SCA regulates the sending of unsolicited commercial messages (e.g. emails or text messages) in bulk.

3. MCI/PDPC is reviewing the PDPA to take into account technological advances, new business models and global developments in data protection legislation.

4. MCI/PDPC proposes four key areas of amendments:

   • a) First, we intend to amend the PDPA to strengthen the accountability of organisations. Accountability will be reflected as a key principle of the PDPA, and accountability practices will be introduced as a requirement to complement new and existing avenues for the collection, use and disclosure of personal data under the PDPA. We also intend to amend the PDPA to incorporate relevant recommendations of the Public Sector Data Security Review Committee (PSDSRC) to ensure the accountability of third parties handling Government personal data and introduce offences for egregious mishandling of personal data.

   • b) Second, we intend to enhance the PDPA’s framework for the collection, use and disclosure of personal data to enable meaningful consent where necessary. In other circumstances, organisations will be able to collect, use or disclose personal data (as applicable) for legitimate interests and business improvement purposes, especially where there are wider public or systemic benefits.

   • c) Third, we intend to amend the PDPA to provide for greater consumer autonomy over their personal data. The new Data Portability Obligation will give individuals greater choice and control over their personal data, prevent consumer lock-in and enable switching to new services. The Do Not Call Provisions under the PDPA and the SCA will also be amended to provide consumers with more protection and control over unsolicited marketing messages.

   • d) Fourth, we intend to increase deterrence and strengthen the effectiveness of PDPC’s enforcement efforts, by providing for increased financial penalties, and additional enforcement powers for the PDPC, such as requiring a person’s attendance for taking statements and referring parties to mediation.

   • PERIOD OF CONSULTATION

5. The public consultation is from 14 to 28 May 2020.

   • FEEDBACK CHANNEL

6. Respondents should organise their submissions as follows:

   • a) Cover page (including their personal/company particulars and contact information); 
     b) Summary of major points; 
     c) Statement of interest; 
     d) Comments; and 
     e) Conclusion.

   • Supporting materials may be enclosed as an annex to the submission.

7. All submissions should be clearly and concisely written, and should provide a reasoned explanation for any feedback. Where feasible, please identify the specific provision of the draft PDP (Amendment) Bill which you are commenting on.

8. All submissions should reach MCI/PDPC no later than 5pm on 28 May 2020. Late submissions will not be considered. Submissions are to be in softcopy only (in Microsoft Word or PDF format). Please send your submissions to DataRegulation@mci.gov.sg, with the subject “Public Consultation for the PDP (Amendment) Bill”.

9. MCI/PDPC reserves the right to make public all or parts of any written submission and to disclose the identity of the source. Respondents may request confidential treatment for any part of the submission that the respondent believes to be proprietary, confidential or commercially sensitive. Any such information should be clearly marked and placed in a separate annex. Respondents are also required to substantiate with reasons any request for confidential treatment. If MCI/PDPC grants confidential treatment, it will consider, but will not publicly disclose, the information. If MCI/PDPC rejects the request for confidential treatment, it will return the information to the respondent, and will not consider this information as part of its review. As far as possible, respondents should limit any request for confidential treatment of information submitted. MCI/PDPC will not accept any submission that requests confidential treatment of all, or a substantial part, of the submission.

   • DOCUMENTS TO DOWNLOAD

10. The public consultation documents can be downloaded below.

    • Public Consultation Document

    • Personal Data Protection (Amendment) Bill 2020

11. View the press release here.