SINGAPORE Trends and Developments Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
• Preliminary step – The PDPC first identifies the applicable statutory maximum financial penalty under Section 48J(3) of the PDPA. It then deter - mines an appropriate percentage rate or quantum cap, not exceeding that statutory maximum, based on the nature of the contravention. In general, intentional breaches attract higher rates than negligent ones, and this exercise establishes the maximum financial penalty applicable for the case before the subsequent steps of the framework are applied. • A five-step methodology then applies. (a) Step 1 – Identification of level of culpability and harm. The PDPC assesses all relevant factors, including the nature, gravity and duration of the non-compliance, to determine the organisa - tion’s level of culpability as “low”, “medium” or “high”. It will also assess whether the level of harm is “slight”, “moderate” or “severe”, tak - ing into account factors such as the type and sensitivity of the affected data, the number of individuals impacted, and the extent of actual or potential harm. (b) Step 2 – Calculation of the starting financial penalty. Based on the assessed levels of culpa - bility and harm in Step 1, the PDPC identifies the corresponding starting range and deter - mines an appropriate starting financial penalty within that range. (c) Step 3 – Adjustment for aggravating and mitigating factors. The PDPC then adjusts the starting financial penalty identified in Step 2 to reflect relevant aggravating and mitigating considerations, such as the organisation’s co- operation, remedial actions, prior compliance record or any benefit derived from the contra - vention. (d) Step 4 – The PDPC considers whether the pro - posed financial penalty would adversely affect the organisation’s ability to continue its usual operations, based on the available evidence. Where appropriate, it may extend the payment timeline, allow instalment payments or reduce the penalty amount.
(e) Step 5 – Final adjustments. The PDPC con - ducts a final review of the quantum to ensure that the resulting financial penalty is both effective as a deterrent and proportionate in the circumstances of the case. Applying this framework, the PDPC found that the maximum financial penalty applicable to MBS was 10% of its turnover. Applying Step 1, MBS’s level of culpability was low, but there was a moderate level of harm due to the large number of affected individu - als. The PDPC then determined the starting financial penalty within the low-moderate band and adjusted this to account for relevant mitigating factors, includ - ing MBS’s voluntary notification to affected individu - als and prompt remedial measures. This ultimately resulted in a reduced financial penalty of SGD315,000, which the PDPC found would not adversely affect MBS’s ability to carry out its usual operations. The decision signals the PDPC’s increasing empha - sis on deterrence, as substantial penalties may be imposed even where the compromised data is not highly sensitive. It also underscores the regulator’s expectations that organisations implement robust operational controls, rather than relying solely on indi - vidual employees, particularly where large volumes of personal data are involved. Businesses should place increased emphasis on data protection and cyberse - curity. Conclusion Singapore’s data protection landscape is evolving alongside developments in digital trade, AI and data- driven public services, with a clear emphasis on ena - bling innovation while strengthening accountability and security obligations. For businesses, compliance should not be treated as a static or one-off exercise. Recent developments across digital services, AI governance, authentication practices and public-sector data sharing, coupled with increased enforcement scrutiny, point to a more integrated, risk-based data environment.
431 CHAMBERS.COM
Powered by FlippingBook