Government Agencies Data sharing by Singapore government agencies is
governed under the Public Sector (Governance) Act 2018 or PS(G)A
42 (and not
the PDPA). The PS(G)A is intended to be in alignment with the PDPA, including to
“significantly improve the protection and safeguard of such shared data”.
43 Under
this act, where a “data sharing direction”
44 is given, a Singapore public sector agency
is generally authorised to share information under its control with another Singapore
public sector agency.
45 However, such direction must not be inconsistent with any
other written law.
46
2.2.1 Consent
At present, the PDPA remains largely a consent-based regime (although this may
evolve over time).
47 Organisations may not collect, use or disclose an individual’s
personal data unless the individual has given, or is deemed to have given, his consent
(save for the exceptions discussed below).
48 And an individual has not given consent
unless he/she has been notified of the purposes of the collection, use or disclosure of
the personal data; has given consent for such purposes; and has been provided
(on request) with the business contact information of a person who can answer the
individual’s questions about the collection, use or disclosure of the personal data.
49
An organisation collecting personal data about an individual from another organisation without the individual’s consent shall provide such other organisation with
sufficient information regarding the purpose of such collection, to allow such other
organisation to determine if the disclosure would be in accordance with the PDPA.
50
The PDPA does not prescribe the manner of obtaining consent, although it is
“good practice” to obtain written consent.
51 However, an organisation shall not
42 See n 16. The PSG(A) will likely be administered by the Prime Minister’s Office. See Public
Consultation on the Public Sector (Governance) Bill. https://www.reach.gov.sg/participate/publicconsultation/prime-ministers-office/public-service-division/public-consultation-on-the-public-sec
tor-governance-bill. Accessed 30 August 2019. Media Factsheet On The Public Sector (Governance) Bill. http://www.nas.gov.sg/archivesonline/data/pdfdoc/20180108011/Media%20factsheet
%20on%20the%20Public%20Sector%20-%20Governance-%20Bill.pdf. Accessed 30 August
2019.
43 Singapore Parliamentary Debates, Official Report (8 January 2018) vol 94.
44 “Data sharing direction” means a direction issued under the PS(G)A regarding “sharing of
information or re-identification of anonymised information under the control of a Singapore public
sector agency”. PS(G)A s 2(1).
45 PS(G)A s 6(1).
46 PS(G)A s 11(1).
47 See e.g. Chesterman (Introduction) (2018), paras 1.6–1.8; Tan (2018), para 5.12.
48 PDPA s 13.
49 PDPA s 14(1) read with s 20(1).
50 PDPA s 20(2).
51 PDPC Advisory Guidelines on Key Concepts para 12.5.
Singapore Report: Data Protection in the Internet
313
governed under the Public Sector (Governance) Act 2018 or PS(G)A
42 (and not
the PDPA). The PS(G)A is intended to be in alignment with the PDPA, including to
“significantly improve the protection and safeguard of such shared data”.
43 Under
this act, where a “data sharing direction”
44 is given, a Singapore public sector agency
is generally authorised to share information under its control with another Singapore
public sector agency.
45 However, such direction must not be inconsistent with any
other written law.
46
2.2.1 Consent
At present, the PDPA remains largely a consent-based regime (although this may
evolve over time).
47 Organisations may not collect, use or disclose an individual’s
personal data unless the individual has given, or is deemed to have given, his consent
(save for the exceptions discussed below).
48 And an individual has not given consent
unless he/she has been notified of the purposes of the collection, use or disclosure of
the personal data; has given consent for such purposes; and has been provided
(on request) with the business contact information of a person who can answer the
individual’s questions about the collection, use or disclosure of the personal data.
49
An organisation collecting personal data about an individual from another organisation without the individual’s consent shall provide such other organisation with
sufficient information regarding the purpose of such collection, to allow such other
organisation to determine if the disclosure would be in accordance with the PDPA.
50
The PDPA does not prescribe the manner of obtaining consent, although it is
“good practice” to obtain written consent.
51 However, an organisation shall not
42 See n 16. The PSG(A) will likely be administered by the Prime Minister’s Office. See Public
Consultation on the Public Sector (Governance) Bill. https://www.reach.gov.sg/participate/publicconsultation/prime-ministers-office/public-service-division/public-consultation-on-the-public-sec
tor-governance-bill. Accessed 30 August 2019. Media Factsheet On The Public Sector (Governance) Bill. http://www.nas.gov.sg/archivesonline/data/pdfdoc/20180108011/Media%20factsheet
%20on%20the%20Public%20Sector%20-%20Governance-%20Bill.pdf. Accessed 30 August
2019.
43 Singapore Parliamentary Debates, Official Report (8 January 2018) vol 94.
44 “Data sharing direction” means a direction issued under the PS(G)A regarding “sharing of
information or re-identification of anonymised information under the control of a Singapore public
sector agency”. PS(G)A s 2(1).
45 PS(G)A s 6(1).
46 PS(G)A s 11(1).
47 See e.g. Chesterman (Introduction) (2018), paras 1.6–1.8; Tan (2018), para 5.12.
48 PDPA s 13.
49 PDPA s 14(1) read with s 20(1).
50 PDPA s 20(2).
51 PDPC Advisory Guidelines on Key Concepts para 12.5.
Singapore Report: Data Protection in the Internet
313