to determine whether the benefits outweigh any foreseeable adverse impact to the
individual.
76 While the term “Legitimate Interests” tracks the language adopted in
the EU’s General Data Protection Regulation, the Commission will provide its own
guidelines on the term.
77
Withdrawing Consent An individual may at any time, with reasonable notice,
withdraw consent given or deemed given.
78 The organisation shall inform the
individual of the likely consequences of such action, but without prohibiting him/her
from such action. However, such withdrawal shall not affect any legal consequences
from such withdrawal.
79
Upon withdrawal, the organisation shall also cease (and cause its data intermediaries and agents to cease) collecting, using or disclosing such personal data,
subject to exceptions under the PDPA or other law.
80 Withdrawal of consent does
not require deletion or destruction of the individual’s personal data, save as required
under the Limited Retention Obligation (see Sect. 2.2.5).
81
2.2.2 Limited Purpose
An organisation may collect, use or disclose personal data about an individual only
for purposes that “a reasonable person would consider appropriate in the circumstances” and of which the individual has been notified.
82 A purpose that is in
violation of law or which would be harmful to the individual concerned is unlikely
to be considered appropriate by a reasonable person.
83
76 Response to Feedback on the Public Consultation on Approaches to Managing Personal Data in
the Digital Economy Part II.
77 Response to Feedback on the Public Consultation on Approaches to Managing Personal Data in
the Digital Economy (para 5.6).
78 PDPA s 16(1).
79 PDPA ss 16(2)-(3). For example, a telecoms service provider provides subscriber services
requiring the collection, use and disclosure of personal data. The subscriber provides consent to
the above but subsequently withdraws it. Such withdrawal will result in the operator being unable to
provide said services, i.e. early termination of the service contract; thus the operator should inform
the individual of the consequences, i.e. incurrence of early termination charges. PDPC Advisory
Guidelines on Key Concepts para 12.45. Additionally, where an organisation provides a facility for
individuals to withdraw consent, e.g. by clicking on an “unsubscribe” link within an e-mail, the
organisation should indicate the scope of such withdrawal. For instance, a statement that “[y]ou
have unsubscribed successfully from e-mail marketing messages from ABC” means that the
individual has only withdrawn consent to marketing messages sent by e-mail, and not by fax.
PDPC Advisory Guidelines on Key Concepts para 12.48.
80 PDPA s 16(4).
81 PDPA s 16(4); PDPC Advisory Guidelines on Key Concepts para 12.55.
82 PDPA s 18 read with s 20.
83 PDPC Advisory Guidelines on Key Concepts para 13.4.
316
E.-I. Ong
individual.
76 While the term “Legitimate Interests” tracks the language adopted in
the EU’s General Data Protection Regulation, the Commission will provide its own
guidelines on the term.
77
Withdrawing Consent An individual may at any time, with reasonable notice,
withdraw consent given or deemed given.
78 The organisation shall inform the
individual of the likely consequences of such action, but without prohibiting him/her
from such action. However, such withdrawal shall not affect any legal consequences
from such withdrawal.
79
Upon withdrawal, the organisation shall also cease (and cause its data intermediaries and agents to cease) collecting, using or disclosing such personal data,
subject to exceptions under the PDPA or other law.
80 Withdrawal of consent does
not require deletion or destruction of the individual’s personal data, save as required
under the Limited Retention Obligation (see Sect. 2.2.5).
81
2.2.2 Limited Purpose
An organisation may collect, use or disclose personal data about an individual only
for purposes that “a reasonable person would consider appropriate in the circumstances” and of which the individual has been notified.
82 A purpose that is in
violation of law or which would be harmful to the individual concerned is unlikely
to be considered appropriate by a reasonable person.
83
76 Response to Feedback on the Public Consultation on Approaches to Managing Personal Data in
the Digital Economy Part II.
77 Response to Feedback on the Public Consultation on Approaches to Managing Personal Data in
the Digital Economy (para 5.6).
78 PDPA s 16(1).
79 PDPA ss 16(2)-(3). For example, a telecoms service provider provides subscriber services
requiring the collection, use and disclosure of personal data. The subscriber provides consent to
the above but subsequently withdraws it. Such withdrawal will result in the operator being unable to
provide said services, i.e. early termination of the service contract; thus the operator should inform
the individual of the consequences, i.e. incurrence of early termination charges. PDPC Advisory
Guidelines on Key Concepts para 12.45. Additionally, where an organisation provides a facility for
individuals to withdraw consent, e.g. by clicking on an “unsubscribe” link within an e-mail, the
organisation should indicate the scope of such withdrawal. For instance, a statement that “[y]ou
have unsubscribed successfully from e-mail marketing messages from ABC” means that the
individual has only withdrawn consent to marketing messages sent by e-mail, and not by fax.
PDPC Advisory Guidelines on Key Concepts para 12.48.
80 PDPA s 16(4).
81 PDPA s 16(4); PDPC Advisory Guidelines on Key Concepts para 12.55.
82 PDPA s 18 read with s 20.
83 PDPC Advisory Guidelines on Key Concepts para 13.4.
316
E.-I. Ong