SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
• access to the anonymised data is limited to recipi - ents who do not possess special knowledge of the individuals concerned, or who do not have access to complementary information that could reason - ably be used to re-identify individuals; • the recipient does not have both the ability and motivation to re-identify individuals from the dataset, or where such risks are mitigated through appropriate legal or regulatory safeguards; or • the anonymised dataset can reasonably be expect - ed to remain anonymised over time, having regard to foreseeable technological developments, data availability and data-linking techniques. However, where the nature of data is highly sensi - tive to individuals (eg, records of individuals with HIV), even if the organisation assesses that there is a less than serious possibility of an individual being re-identi - fied from the data, PDPC has cautioned organisations to carefully consider whether using or disclosing such data would be appropriate. Once data is anonymised, such that individuals can no longer be identified, it no longer falls under the PDPA. Therefore, this could allow medical device or software providers to use such anonymised data for research and development without patient consent. Organisa - tions should note that, if the risk of re-identification is more than a serious possibility, the data is brought back under the Data Protection Provisions, such as obtaining consent subject to approved exceptions. Impact of the European Health Data Space Regulation (EHDS) The EHDS regime is designed to govern entities oper - ating within the EU health data ecosystem, and its core obligations apply mainly to health data holders established in the EU. Singapore-based companies may be directly subject to the EHDS if they have an established presence within the EU, and where they fall within the definition of a health data holder as enti - ties developing health-related products or services, and wellness applications, or conducting healthcare- related research – and, in that capacity, either pro - cess personal electronic health data as a controller or have the ability to make non-personal electronic health data available through control of the relevant technical systems.
Singapore life sciences companies may also be indi - rectly affected where they operate EU subsidiaries, collaborate with EU healthcare providers or research institutions, or supply digital health products, medi - cal devices or Electronic Health Record (EHR)-linked services into the EU market. In such cases, EU-based affiliates or partners may be required to comply with EHDS obligations on data access, secondary use and secure processing, which can flow down con - tractually to Singapore parent entities or vendors. In contrast, Singapore companies seeking to access EU health datasets for research or product development will generally not qualify as health data users under the EHDS unless Singapore is recognised by the EU as offering reciprocal access. However, this has not occurred to date. Domestically, Singapore parliament has passed the Health Information Bill, which aims to structure nation - al data sharing through the National Electronic Health Record System, mirroring the EHDS. 1.5 Processing of Personal Data in the Context of Artificial Intelligence There is currently no AI-specific legislation in Singa - pore. The PDPA applies to the processing of personal data throughout the development, training, testing, deployment and operation of AI systems. While the PDPA does not contain provisions specifically tailored to AI, organisations deploying AI systems that collect, use or disclose personal data must comply with all obligations in the PDPA, such as the consent (Sec - tions 13 to 20 of the PDPA), notification (Section 20 of the PDPA) and accountability (Sections 11 and 12 of the PDPA) obligations. On 1 March 2024, the PDPC issued the Advisory Guidelines on the Use of Personal Data in AI Recom - mendation and Decision Systems, which articulate a risk-based approach to AI governance and provide targeted guidance on how the PDPA applies in AI contexts. These guidelines emphasise that consent and notification obligations must operate together to ensure that individuals are meaningfully informed when their personal data is used in AI-driven features or automated decision-making.
416 CHAMBERS.COM
Powered by FlippingBook