SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
Organisations are expected, where practicable, to provide a clear explanation of: • the function of the AI system of the product that utilises personal data; • a general description of categories of personal data to be collected and processed; • an explanation on how such data supports or influ - ences the product feature; and • the specific data features likely to affect the prod - uct feature. Where detailed explanations cannot be provided due to legitimate commercial sensitivity or security con - cerns, organisations are expected to document and justify such limitations internally. Under the PDPA’s accountability obligation, organi - sations must implement internal governance meas - ures to ensure that AI-assisted decisions are fair and reasonable. This includes maintaining policies, risk controls and review mechanisms appropriate to the context in which the AI system is used. The degree of transparency and oversight expected is risk-propor - tionate, taking into account factors such as: • the potential impact on individuals; • the sensitivity of the data involved; and • the extent to which decisions are automated with - out human involvement. There are currently no legally prohibited AI use cases or formally designated “high-risk” AI categories under data protection law. The Info-communications Media Development Authority (IMDA) and the PDPC have jointly issued the Model Artificial Intelligence Governance Framework. It is a voluntary but influential instrument that encour - ages organisations to align their internal governance, policies and practices with recognised data protection standards, including the PDPA and international prin - ciples such as the OECD Privacy Principles. 1.6 Data Breach Requirement Under the PDPA, a data breach occurs when personal data is accessed, collected, used, disclosed, copied, modified or lost without authorisation, or when there is
a loss of a storage medium containing personal data in circumstances that make such outcomes likely. Organisations must expeditiously determine whether a data breach meets the threshold for notification, generally performing this assessment as soon as pos - sible and typically within 30 days of becoming aware of the incident. Where a breach is deemed notifiable, the organisation must report it to the PDPC within three days of making that determination. A breach is notifiable if it either (i) causes, or is likely to cause, significant harm to affect - ed individuals, or (ii) affects 500 or more individuals. Once notification to the PDPC has been made, if the breach involves actual or potential significant harm to individuals, organisations are generally required to inform the affected individuals promptly. The following are practical steps to be taken by organ - isations when a data breach occurs. • Immediate containment – For example, secure affected systems and data to prevent further unau - thorised access. • Assessment of risk – Determine the scope of the breach, the type of personal data involved and the potential harm to individuals. • PDPC notification – If the breach is notifiable, submit a report to the PDPC within three days of determination. • Notification of individuals – Where significant harm is likely or has occurred, communicate with affect - ed individuals in a clear and timely manner. • Remediation and prevention – Address system vulnerabilities, review policies and procedures, and implement measures to reduce the likelihood of recurrence. If a data processor suspects that a breach has occurred in relation to personal data it handles on behalf of a data controller, it must alert the controller swiftly. The controller is then responsible for evaluat - ing whether the incident meets the notifiable threshold and for co-ordinating any required reporting to the PDPC and affected individuals. Notifiable breaches may trigger investigations by the PDPC, which has the authority to examine the
417 CHAMBERS.COM
Powered by FlippingBook