SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
organisation’s breach response and data protection practices, potentially resulting in enforcement action. In addition, data breaches expose organisations to potential privacy litigation, outlined in 2. Privacy Liti- gation . 1.7 Regulators The PDPC is the primary regulator of the PDPA. Its jurisdiction covers private sector organisations. Its core functions include: • promoting awareness of data protection in Singa - pore; • providing advisory, consultancy and technical ser - vices relating to data protection; • advising the Singapore government on policy and representing Singapore internationally; • conducting research and educational programmes; • facilitating technical co-operation and exchange in the area of data protection with other organisa - tions, including foreign data protection authorities and international or intergovernmental organisa - tions, on its own behalf or on behalf of the govern - ment; and • administering and enforcing the PDPA and func - tions assigned by law or the Minister. Investigations may arise from complaints or on the PDPC’s own initiative. According to the Advisory Guidelines on Enforcement of the Data Protection Provisions, the PDPC would consider factors such as: • whether the organisation may have breached all or a substantial portion of its obligations under the PDPA; • whether the organisation’s actions reflect a sys - temic lapse in compliance, including a failure to put in place or maintain adequate internal policies and procedures to ensure adherence to the PDPA; • the number of individuals who have been, or could potentially be, affected by the organisation’s actions; • the extent of harm or adverse impact suffered by the complainant or any affected individuals; • whether the organisation has a history of PDPA contraventions or has failed to take adequate remedial steps to prevent a recurrence of earlier breaches;
• whether the complainant had previously sought to resolve the matter directly with the organisation without success; • where the PDPC has attempted to facilitate dispute resolution, whether the parties agreed to partici - pate, their conduct throughout the process, and the eventual outcome of such resolution efforts; • where the PDPC has initiated a review, whether the organisation complied with its obligations under the Enforcement Regulations, its conduct during the review, and the result of that review; and • broader considerations of public interest. In the course of investigations, the PDPC may: • compel the production of documents and informa - tion; • compel witnesses, and conduct oral examinations or record statements; and • enter premises to take necessary equipment or copies of documents (amongst other things). 1.8 Enforcement Proceedings and Fines The PDPC is responsible for enforcing the PDPA. It is guided by four key objectives as set out in the PDPC’s Guide to Active Enforcement (revised on 1 October 2022), namely: • to respond to PDPA breaches effectively, with attention to incidents affecting large numbers of individuals or involving personal data that may result in significant harm; • to apply enforcement measures in a manner that is proportionate and consistent across organisations found to be in breach of the PDPA; • where penalties imposed function as a meaningful deterrent against future non-compliance; and • to ensure that organisations in breach take ade - quate remedial action to rectify weaknesses in the protection and handling of personal data within their possession or control. When a possible personal data incident comes to the PDPC’s attention (whether through a complaint, self-report or other means), the PDPC will first assess whether the matter warrants a formal investigation. The Commissioner may decide not to investigate where:
418 CHAMBERS.COM
Powered by FlippingBook