• Limited Purpose: Collection, use or disclosure of personal data only for purposes
that a reasonable person would consider appropriate and if the individual has been
notified of such purposes (see Sect. 2.2.2).
31
• Notification: To inform an individual of the purpose of the collection, use or
disclosure of personal data.
32 Most recently, there has been a proposal for deemed
consent by notification (see Sect. 2.2.1).
• Access: To give an individual access to personal data held by or under the control
of the organisation, including information about how such personal data was or
may have been used or disclosed within a year before the date of the request (see
Sect. 2.2.3).
33
• Correction: To correct an error or omission regarding personal data about that
individual (see Sect. 2.2.4).
34
• Accuracy: To ensure that personal data collected by or on behalf of the organisation is accurate and complete (see Sect. 2.2.4).
35
• Protection: To protect personal data in the organisation’s possession or under its
control through reasonable security arrangements (see Sect. 3.1).
36
• Limited Retention: To stop retaining personal data as soon as it is reasonable to
assume that the purpose for which the data was collected is no longer served by
such retention and retention is no longer necessary for legal or business purposes
(see Sect. 2.2.5).
37
• Limited Transfer: No transfer of personal data outside Singapore, unless the
transferred personal data will enjoy protection comparable to the protections
under the PDPA (see Sect. 4.2).
38
• Accountability: To implement data protection policies and practices, make information about its policies and procedures publicly available, and appoint a data
protection officer (see Sect. 2.2.6).
39
There are no specified standards for the Obligations. Instead, organisations may
collect, use and disclose data “for purposes which a reasonable person would
consider appropriate in the circumstances”.
40 A “reasonable person” is judged
based on an objective standard and can be said to be a person who exercises the
appropriate care and judgement in the particular circumstances.
41
31 PDPA s 18.
32 PDPA s 20(1).
33 PDPA s 21(1).
34 PDPA s 22.
35 PDPA s 23.
36 PDPA s 24.
37 PDPA s 25.
38 PDPA s 26.
39 PDPA ss 11–12, PDPC Advisory Guidelines on Key Concepts para 10.2.
40 PDPC Advisory Guidelines on Key Concepts para 9.3. See, e.g., PDPA ss 11(1), 18, 24, 25.
41 PDPC Advisory Guidelines on Key Concepts para 9.5.
312
E.-I. Ong
that a reasonable person would consider appropriate and if the individual has been
notified of such purposes (see Sect. 2.2.2).
31
• Notification: To inform an individual of the purpose of the collection, use or
disclosure of personal data.
32 Most recently, there has been a proposal for deemed
consent by notification (see Sect. 2.2.1).
• Access: To give an individual access to personal data held by or under the control
of the organisation, including information about how such personal data was or
may have been used or disclosed within a year before the date of the request (see
Sect. 2.2.3).
33
• Correction: To correct an error or omission regarding personal data about that
individual (see Sect. 2.2.4).
34
• Accuracy: To ensure that personal data collected by or on behalf of the organisation is accurate and complete (see Sect. 2.2.4).
35
• Protection: To protect personal data in the organisation’s possession or under its
control through reasonable security arrangements (see Sect. 3.1).
36
• Limited Retention: To stop retaining personal data as soon as it is reasonable to
assume that the purpose for which the data was collected is no longer served by
such retention and retention is no longer necessary for legal or business purposes
(see Sect. 2.2.5).
37
• Limited Transfer: No transfer of personal data outside Singapore, unless the
transferred personal data will enjoy protection comparable to the protections
under the PDPA (see Sect. 4.2).
38
• Accountability: To implement data protection policies and practices, make information about its policies and procedures publicly available, and appoint a data
protection officer (see Sect. 2.2.6).
39
There are no specified standards for the Obligations. Instead, organisations may
collect, use and disclose data “for purposes which a reasonable person would
consider appropriate in the circumstances”.
40 A “reasonable person” is judged
based on an objective standard and can be said to be a person who exercises the
appropriate care and judgement in the particular circumstances.
41
31 PDPA s 18.
32 PDPA s 20(1).
33 PDPA s 21(1).
34 PDPA s 22.
35 PDPA s 23.
36 PDPA s 24.
37 PDPA s 25.
38 PDPA s 26.
39 PDPA ss 11–12, PDPC Advisory Guidelines on Key Concepts para 10.2.
40 PDPC Advisory Guidelines on Key Concepts para 9.3. See, e.g., PDPA ss 11(1), 18, 24, 25.
41 PDPC Advisory Guidelines on Key Concepts para 9.5.
312
E.-I. Ong