• such collection, use or disclosure is not likely to have any adverse impact on the
individuals.
59
However, the organisation must also conduct a risk and impact assessment, such
as a data protection impact assessment, to ascertain whether such collection, use or
disclosure is likely to have any adverse impact on the individual.
60
(b) Exceptions. Consent is not required if the collection, use or disclosure of data
is: necessary for any purpose that is “clearly in the interests of the individual” and if
consent cannot be obtained in a timely manner or the individual would not reasonably be expected to withhold consent
61 ; for an emergency threatening the life, health
or safety of any individual
62 ; for personal data which is publicly available
63
; in the
national interest
64 or necessary for investigation or proceedings
65
; necessary for
evaluative purposes
66 ; or necessary to recover debt owed from an individual to the
organisation or vice versa,
67 or to provide or obtain legal services.
68 Other exceptions apply, e.g. regarding personal data for business asset transactions
69 ; credit
bureaus
70 ; employment purposes
71 ; news activities
72
; and research purposes.
73
Pursuant to a public consultation in July 2017, there will be an additional
exception for “Legitimate Interests”.
74 Organisations will be able to collect, use or
disclose personal data where there is a need to protect legitimate interests that will
have economic, social, security or other benefits, so long as the benefits to the public
clearly outweigh any adverse impact to the individuals involved.
75 Organisations
wishing to use this exception will also need to conduct a risk and impact assessment
59 Response to Feedback on the Public Consultation on Approaches to Managing Personal Data in
the Digital Economy Part II.
60 Response to Feedback on the Public Consultation on Approaches to Managing Personal Data in
the Digital Economy para 4.2.
61 PDPA Second Schedule s 1(a), Third Schedule s 1(a), Fourth Schedule s 1(a) (save that there is
no requirement for disclosure that the individual not reasonably be expected to withhold consent).
62 PDPA Second Schedule s 1(b), Third Schedule s 1(b), Fourth Schedule ss 1(b)-(c).
63 PDPA Second Schedule s 1(c), Third Schedule s 1(c), Fourth Schedule s 1(d ).
64 PDPA Second Schedule s 1(d ), Third Schedule s 1(d ), Fourth Schedule s 1(e).
65 PDPA Second Schedule s 1(e), Third Schedule s 1(e), Fourth Schedule s 1( f ).
66 PDPA Second Schedule s 1( f ), Third Schedule s 1( f ), Fourth Schedule s 1(h).
67 PDPA Second Schedule s 1(i), Third Schedule s 1(g), Fourth Schedule s 1(i).
68 PDPA Second Schedule s 1( j ), Third Schedule s 1(h), Fourth Schedule s 1( j ).
69 PDPA Second Schedule s 1( p ), Third Schedule 1( j ), Fourth Schedule s 1( p ).
70 PDPA Second Schedule s 1(k), Third Schedule 1( j ), Fourth Schedule s 1(k).
71 PDPA Second Schedule s 1(o), Third Schedule 1( j ), Fourth Schedule s 1(s). See also Sect. 3.5.
72 PDPA Second Schedule s 1(h), Third Schedule s 1( j ), Fourth Schedule s 1(s).
73 PDPA Third Schedule s 1(i), Third Schedule s 1( j ), Fourth Schedule s 1(s).
74 Response to Feedback on the Public Consultation on Approaches to Managing Personal Data in
the Digital Economy Part II.
75 Response to Feedback on the Public Consultation on Approaches to Managing Personal Data in
the Digital Economy Part II.
Singapore Report: Data Protection in the Internet
315