SINGAPORE Trends and Developments Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
• the sharing arrangement must be authorised by the relevant Minister or a delegated authority, with the approval specifying the purpose of the sharing, the scope of data involved, and the external partners permitted to receive it; and • external partners must be subject to contractually binding terms of use that impose data protection and security requirements at least equivalent to those applicable to public agencies. Individuals working for such partners may also face criminal liability for misuse of shared data, with pen - alties aligned to those applicable to public officers under the PSGA. The amendments also clarify that public agencies may use, and not merely share, data for the purposes specified under the PSGA, while remaining subject to existing internal governance and security require - ments. Importantly, the PSGA does not override con - fidentiality obligations imposed under other written laws, legal privilege or contractual arrangements. For the private sector, the amendments are particular - ly relevant to organisations that provide services to, or partner with, government agencies. External partners, such as technology vendors, data analytics providers and contractors, may now receive government-held data under a statutory framework, leading to more structured arrangements with public-sector-aligned data protection, security and accountability require - ments. Furthermore, these external partners should expect heightened scrutiny of their data governance practices and be prepared to meet public-sector standards of accountability and security. Enforcement Trends The PDPC has been taking a strong enforcement stance against breaches of the various obligations under the PDPA. In Re Marina Bay Sands Pte Ltd [2025] SGPDPC 6, the PDPC meted out its second largest financial penalty (to date) of SGD315,000, hav - ing factored in the annual turnover of the organisation in determining the financial penalty amount. Clarity on financial penalty framework From 1 October 2022, Parliament raised the maximum financial penalty for large organisations with annual
turnovers in Singapore over SGD10 million, to 10% of their annual turnovers. The PDPC has now, for the first time, in Re Marina Bay Sands Pte Ltd [2025] SGPDPC 6, articulated key aspects of its financial penalty framework for deter - mining the quantum of financial penalties under the PDPA. In brief, Marina Bay Sands (MBS) is an integrated resort operator that runs, among other things, two membership programmes: Sands Rewards Lifestyle and ArtScience Friend. In October 2023, the personal data of 665,495 MBS patrons was illegally accessed and exfiltrated by unknown actors. The affected data, including names and contact details that identified MBS’s patrons, was later found for sale on the dark web. MBS admitted to breaching the protection obli - gation, by failing to take reasonable security measures to protect the personal data in its possession. The PDPC’s financial penalty framework is subject to the following guiding principles. • The framework aims to effectively deter non-com - pliance with the PDPA, while ensuring proportional - ity to the seriousness of the non-compliance. • When considering the relative weight to be given to effective deterrence and proportionality, consid - eration has to be given to the PDPA’s overarching balance of the right of individuals to protect their personal data and organisations’ need to process personal data for legitimate purposes. • There should be like and consistent treatment in the two-tiered financial penalty regime for organi - sations with annual turnovers of SGD10 million and below, and organisations with annual turno - vers above SGD10 million. Annual turnover size should be accorded more weight for organisations with annual turnovers above SGD10 million. Other relevant factors must be given similar weight in like cases. • The financial penalty framework must be applied in a fact-sensitive manner. With these in mind, the Penalty Framework comprises the following steps.
430 CHAMBERS.COM
Powered by FlippingBook