SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
• the issue is more appropriately resolved through facilitation or mediation; • the facts do not suggest a breach of the data pro - tection obligations; or • the organisation concerned falls primarily within the remit of another sectoral regulator better placed to address the matter. If investigation is warranted, the PDPC formally opens a case. During an investigation, the PDPC may: • issue notices for the production of documents and information from the relevant organisations; • carry out interviews and record statements from the organisations and individuals concerned; and • where appropriate, undertake site visits to obtain a comprehensive understanding of the facts. The organisation under investigation is given the opportunity to respond and make representations before any decision is reached. After evaluating the facts of the case and represen - tations, the PDPC determines whether a breach has occurred and may issue directions to the organisation. These may include financial penalties, which currently can reach SGD1 million or 10% of the organisation’s annual turnover in Singapore, whichever is higher. When setting financial penalties, the PDPC considers factors such as: • the nature, gravity and length of the organisation’s or individual’s non-compliance; • the type and sensitivity of the personal data affected by the non-compliance; • whether the organisation or individual derived any financial gain, or avoided a financial loss, as a result of the non-compliance; • the steps taken by the organisation or individual to reduce or address the impact of the non-compli - ance, including how promptly and effectively those steps were implemented; • whether, notwithstanding the non-compliance, the organisation or individual had put in place appro - priate and sufficient measures to comply with the PDPA;
• any history of previous non-compliance with the PDPA by the organisation or individual; • the extent to which the organisation or individual complied with any directions issued under Section 48I or 48L(4) to remedy or mitigate the effects of the non-compliance; • whether the proposed financial penalty is appro - priate and effective in promoting compliance and deterring future breaches of the PDPA; • the anticipated impact of the financial penalty on the organisation or individual, including their ability to continue normal operations; and • any other factors considered relevant. Beyond financial penalties, the PDPC may issue administrative directions to compel compliance, including requiring organisations to cease unlaw - ful data practices, correct or delete personal data, or provide access to affected individuals, with such directions enforceable through the courts. Separately, the PDPA also recognises a private right of action for individuals who suffer loss or damage. An organisation or individual dissatisfied with a direc - tion or decision of the PDPC may first apply to the PDPC for reconsideration, under Section 48N of the PDPA. Following a reconsideration decision, the aggrieved party may appeal to the Data Protection Appeal Panel pursuant to Section 48Q of the PDPA. Alternatively, an appeal may be brought directly to the Appeal Panel without first seeking reconsideration. A further appeal from a decision of the Appeal Panel lies to the High Court only on limited grounds, namely a question of law or, in the case of a financial penalty, the amount imposed. Applications for reconsidera - tion and appeals must be made within the prescribed period of 28 days. Illustrative Example In Re Marina Bay Sands Pte Ltd [2025] SGPDPC 6, the PDPC imposed a financial penalty of SGD315,000 on Marina Bay Sands Pte Ltd. This decision illustrates the PDPC’s calibrated approach to financial penalties fol - lowing the 2020 amendments to the PDPA, clarifying that penalties are assessed with reference to factors such as the organisation’s annual turnover, the seri - ousness and duration of the breach, and the extent
419 CHAMBERS.COM
Powered by FlippingBook