Suspect a PDPA Data Breach? Here’s What to Do Next

If you suspect that your personal information has been misused by an organisation, Singapore’s Personal Data Protection Act (PDPA) provides you with some protections on which you may rely.

This article will highlight the aspects of the PDPA that would be relevant in those circumstances. It will cover:

• The obligations of organisations under the PDPA
• Whether the information that has allegedly been misused is protected by the PDPA?
• What can you do if you suspect a PDPA breach?
• What are the penalties for PDPA breaches?

What are the Obligations of Organisations Under the PDPA?

First, organisations have a range of responsibilities to you in how they handle your data, pursuant to the PDPA. These responsibilities relate primarily to how they collect, store, use or share your data. In short, they need to obtain your consent to do certain things with your data, and they can operate only within the bounds of that consent.

For example, an organisation cannot share your personal data with a third-party, unless you have given your express consent for them to do so. Even if consent is given, they can share it with only the kinds of parties and for the purposes that they informed you of when they obtained your consent.

For more detail, see our other article on organisations’ obligations under the PDPA.

Is the Information That Has Allegedly been Misused Protected by the PDPA?

Next, you must ensure that the data allegedly misused by an organisation is actually the kind of data that is protected by the PDPA. Most kinds of data that would personally identify you or provide information about you such as contact details or addresses would be protected.

However, your business contact information is not protected. This refers to information such as your work phone number or work email address as opposed to your personal phone number or email address.

That said, if your business contact information such as your work email address is given out for personal use, e.g. when signing up for a yoga class, then such information will not be treated as business contact information and will be protected under the PDPA in such scenarios of personal use.

What Can You Do If You Suspect a PDPA Breach?

If you believe that protected personal data has been misused by an organisation, you can file a complaint with the Personal Data Protection Commission (PDPC). The PDPC will usually open an investigation and contact the organisation to find out more.

Depending on the circumstances, you may also consider filing a police report. If you believe your data has been illegally accessed as a result of a computer hacking incident, a cybersecurity breach or something of that nature, then an offence under the Computer Misuse Act may have been committed. The police may be interested in investigating the matter if you have any evidence that suggests this is what may have happened.

In the event of a data security breach, organisations are required to report the incident to the PDPC if it had been conducted by individuals outside of the organisation, and has resulted in (or is likely to result in) significant harm to an affected individual, or if it is (or is likely to be) of a significant scale. If required, the reporting has to be done within 3 days of assessing whether the breach needs to be reported.

If you suffer losses as a result of a personal data breach in Singapore, you may also be able to sue for compensation.

What are the Penalties for PDPA Breaches?

Although you may not be able to obtain compensation for a data breach, there are potential consequences for companies that fail to discharge their obligations under the PDPA. Such organisations could face a financial penalty of 10% of the organisation’s annual turnover in Singapore for organisations with annual local turnover exceeding S$10 million, or up to S$1 million, whichever is higher.

Various high-profile companies including Singtel, SPH Magazines and Royal Caribbean Cruises have already been levied with financial penalties by PDPC for violating the PDPA. The usual range of financial penalties so far have been from high 4-figure sums to modest 5-figure sums.

So far, one of the largest financial penalties meted out by PDPC has been $60,000 on IT vendor Learnaholic. Many of these financial penalties have been meted out for cybersecurity breaches that have led to the unauthorised access and exposure of individuals’ personal data.

—

If you encounter an issue involving misuse of your personal data in Singapore and you wish to take action against the organisation responsible for it, it is advisable to consult a data protection lawyer.

A good data protection lawyer will usually be able to give you a quick assessment of whether or not you have any recourse and can assist you in preparing a more professional complaint to the PDPC.

The lawyer can also assist in drafting a letter to the offending organisation to complain about the breach, demand a copy of all of your personal data that they have, and/or demand that they destroy any of your personal data that they have.