SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
• Healthcare Services Act 2020 (No 3 of 2020) (HCSA), addressing the confidentiality and reten - tion of medical records; • Code of Practice for Competition in the Provision of Telecommunication Services 2012 issued under the Telecommunications Act 1999 (2020 Revised Edition), regulating how telecommunications licen - sees may handle end-user service information; and • Banking Act 1970 (2020 Revised Edition), contain - ing statutory banking secrecy obligations gov - erning the disclosure and handling of customer information by banks. Additionally, the PDPC has issued a substantial body of advisory guidelines. While these guidelines are not legally binding, they play an important interpretive role by explaining how the PDPC understands and applies the PDPA in practice, and they are frequently relied upon by organisations seeking compliance certainty. See 3.1 Objectives and Scope of Data Regulation and 1.5 Processing of Personal Data in the Context of Artificial Intelligence on how the PDPA interacts with laws governing non-personal data and AI respec - tively. 1.2 Rights and Obligations Primary Obligations The PDPA generally imposes 11 primary obligations on organisations. Consent obligation Generally, an organisation may not collect, use or dis - close personal data unless the individual has given consent or is deemed to have consented under the PDPA. However, consent is not required where the collection, use or disclosure is authorised or man - dated by written law. The PDPA recognises a number of exceptions where personal data may be processed without consent.
• research. Purpose limitation obligation
Personal data may only be collected, used or dis - closed for purposes that a reasonable person would consider appropriate in the circumstances. Where required under the PDPA, those purposes must also be made known to the individual. Notification obligation Organisations are generally required to inform indi - viduals of the purposes for which their personal data is being collected, used or disclosed. Notification is not necessary where consent is deemed by conduct or contractual necessity in accordance with the PDPA or where processing without consent is permitted pursu - ant to an exception to consent under the PDPA (save that there are disclosure/notification requirements when relying on the exceptions relating to general legitimate interests and managing employees). Access obligation Upon request, an organisation must provide an indi - vidual with access to their personal data in the organi - sation’s possession or control, as well as information about how that data has been used or disclosed. The obligation is subject to exceptions set out in the Fifth Schedule to the PDPA, including circumstances where disclosure would compromise an ongoing investiga - tion. There are also specific circumstances where access is prohibited. Further details are set out under “Data Subject Rights” below. Correction obligation Organisations must, on request, correct inaccuracies or omissions in an individual’s personal data, unless there are reasonable grounds for refusing the correc - tion or the request falls within one of the prescribed exceptions in the Sixth Schedule to the PDPA. Further details are set out under “Data Subject Rights” below. Accuracy obligation Where personal data is likely to be used to make a decision affecting an individual, or disclosed to anoth - er organisation, reasonable steps must be taken to ensure that the data is accurate and complete. This obligation is context-specific and turns on what is rea - sonable in the circumstances.
These include situations involving: • the protection of vital interests; • matters of public interest; • an organisation’s legitimate interests; • business asset transactions; • business improvement purposes; and
412 CHAMBERS.COM
Powered by FlippingBook