SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
4.2 Personalised Advertising and Other Online Marketing Practices Singapore law does not specifically label or regulate “personalised” or “targeted” advertising as a dis - tinct category. Instead, such practices are governed through the PDPA to the extent they involve the collec - tion, use or disclosure of personal data. Where adver - tising activities rely on profiling or behavioural analysis that identifies or relates to an individual, organisations are generally required to obtain clear and affirmative opt-in consent. Where marketing involves sensitive personal data and children’s data, see 1.3 Special Categories of Per- sonal Data for additional constraints that apply. 4.3 Employment Privacy Law Under Section 4 (1)(a) and (b) of the PDPA, the Data Protection Provisions do not apply to an employee acting in the course of their employment. However, employers remain subject to the PDPA when collect - ing, using or disclosing personal data about employ - ees, job applicants and former employees. Generally, employers are required to notify individu - als of the purposes for which their personal data is processed and to obtain consent, unless an exception under the PDPA applies. In practice, employers often rely on deemed consent under Sections 15 and 15A of the PDPA, or on specific statutory exceptions set out in Section 17 and the First and Second Schedules to the PDPA. Where a job applicant voluntarily provides personal data in the course of a job application, consent is typi - cally deemed for the collection, use and disclosure of that data for purposes reasonably related to evaluat - ing the application. If the applicant is subsequently employed, it would generally be reasonable for the employer to continue using the data for employment- related purposes. Where the employer intends to use the data for purposes outside the scope of deemed consent or any applicable exception, fresh consent must be obtained. The First and Second Schedules to the PDPA permit the processing of employee personal data without
consent in various employment-related scenarios, including: • assessing an individual’s suitability, eligibility or qualifications for employment, advancement or continued employment; and • entering into, managing or terminating their employment relationships, or appointment would not require the consent of their employees. Note that employers are nevertheless required to noti - fy their employees of purposes of such collection, use or disclosure, by providing the individual with the pur - pose of processing. Upon request, the employer must provide contact details for a person able to address queries relating to the processing. In remote working arrangements and bring-your- own-device environments, employers may process personal data to safeguard business systems, man - age cybersecurity risks and ensure compliance with internal policies. Such processing may be carried out without consent under the “legitimate interests” exception, subject to the notification obligation and other PDPA requirements. 4.4 Data Protection in M&A In Singapore, the PDPA permits the collection, use and disclosure of personal data without consent in mergers, acquisitions and asset deals, provided the statutory conditions under Part 4 of the First Schedule to the PDPA are satisfied. The exception covers transactions where an organisa - tion (X) is a party or a prospective party to a business asset transaction with another organisation (Y), and personal data about an applicable individual of Y: • is collected from Y by X for the purposes of the business asset transaction; • is used or disclosed by X in relation to the business asset transaction; or • is disclosed by Y to X for the purposes of the busi - ness transaction. Where the transaction concerns any part of Y or Y’s business assets, the aforementioned personal data transferred must relate directly to that part.
423 CHAMBERS.COM
Powered by FlippingBook