SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
Processing of Data Relating to Criminal Convictions and Investigations
In addition to the PDPA, healthcare providers are sub - ject to sector-specific statutory requirements. The HCSA, the Healthcare Services (General) Regulations 2021, and applicable licensing conditions impose obligations relating to patient confidentiality and record-keeping, which operate alongside the PDPA framework. Processing of Data Relating to Minors The processing of minors’ personal data is governed by the Data Protection Provisions, as supplemented by guidance issued by the PDPC. The principal requirement concerns consent. Whether a minor may validly consent depends on whether the minor has sufficient understanding of the nature and consequences of the collection, use or disclosure of personal data. The PDPC has indicated that, as a general benchmark, minors aged 13 years and above are typically capable of providing valid consent on their own behalf. Where an organisation has reason to believe that a minor lacks such understanding, con - sent must be obtained from a parent or legal guardian. For online products or services likely to be accessed by children (individuals below 18 years of age), the PDPC’s Advisory Guidelines on the PDPA for Chil - dren’s Personal Data in the Digital Environment impose additional expectations. In particular, organi - sations must ensure that privacy notices and consent mechanisms are age-appropriate and readily under - standable, and that children aged between 13 and 17 years understand the consequences of giving and withdrawing consent. Children’s personal data is generally regarded by the PDPC as sensitive, necessitating stronger protection. The use of such data or profiles to target harmful or inappropriate content (as defined in the Code of Prac - tice for Online Safety, issued under the Broadcasting Act 1994) is considered unreasonable. Organisations are also expected to implement enhanced safeguards and to assess data protection risks, such as through data protection impact assessments, where products or services are likely to involve children’s data.
The processing of personal data relating to criminal convictions and investigations is subject to the Data Protection Provisions. Under the PDPA, processing data without consent is permitted where it is neces - sary for purposes such as: • investigations or proceedings; • compliance with written law; or • where required by public authorities exercising law - ful functions. Further, where an organisation has provided personal data to a prescribed law enforcement authority with - out the individual’s consent, the PDPA requires the organisation to refrain from notifying the individual of that disclosure. Personal data gathered in connection with investigations, prosecutions or related proceed - ings may fall outside the access regime under the PDPA, particularly while proceedings remain pend - ing. In such circumstances, access to the data should generally be pursued through the relevant criminal or civil discovery processes, which operate indepen - dently of the PDPA framework. 1.4 Processing of Personal Data for Research and Development Purposes Generally, the PDPC promotes the use of anonymisa - tion as a means of tapping on data for insights where individuals need not be identified. In Singapore, the PDPC defines anonymisation as the process of “converting personal data into data that cannot identify any particular individual”. A dataset would be considered anonymised, where there is no serious possibility that an individual can be identified from the dataset when it is combined with other infor - mation that the data recipient has or is likely to have access to, by carrying out an assessment of the risk of re-identification. The following factors go towards lowering re-identification risks: • the intended use of the anonymised data and the extent of its disclosure are controlled, for example where the data is used internally or disclosed only to a restricted group of recipients rather than made publicly available;
415 CHAMBERS.COM
Powered by FlippingBook