requested but not made),
91 it shall correct the data and send it to “every other
organisation to which the personal data was disclosed by the organisation within a
year before the date the correction was made”.
92 Fees may not be charged for such
correction.
93
Exceptions An organisation need not correct an opinion, including a professional
or expert opinion.
94 Correction is also not required regarding, e.g. opinion data kept
solely for evaluative purposes; school examinations; and documents related to a
prosecution if proceedings have not been completed.
95
2.2.5 Limited Retention
Organisations must cease retaining personal data as soon as it is “reasonable” to
assume that the purpose for which the personal data was collected is no longer served
by such retention, and retention is no longer necessary for legal or business purposes.
96 Thus, an organisation may not retain data “just in case” the data may be
needed for other purposes.
97
An organisation ceases to retain documents containing personal data when it, its
agents and its data intermediaries no longer have access to those documents and the
personal data they contain, e.g. by destroying the documents or anonymizing the
data.
98 Documents should be “completely irretrievable or inaccessible” to the organisation.
99 Data in electronic form which is archived or to which access is limited is
still considered retained.
100
Factors to consider in determining whether an organisation has ceased to retain
personal data are: whether the organisation has any intention to use or access the
personal data; the effort and resources needed to use or access the personal data
again; whether third parties have been given access to that personal data; and
whether the organisation has made a reasonable attempt to destroy, dispose of or
delete the personal data in a permanent and complete manner.
101
91 PDPA s 22(2) read with s 22(5).
92 PDPA s 22(2).
93 PDPC Advisory Guidelines on Key Concepts para 15.39.
94 PDPA s 22(6).
95 PDPA Sixth Schedule s 1.
96 PDPA s 25.
97 PDPC Advisory Guidelines on Key Concepts para 18.4.
98 PDPC Advisory Guidelines on Key Concepts para 18.10.
99 PDPC Advisory Guidelines on Key Concepts para 18.12.
100 PDPC Advisory Guidelines on Key Concepts para 18.11.
101 PDPC Advisory Guidelines on Key Concepts para 18.13. See, e.g., Orchard Turn Developments
Pte. Ltd. [2017] SGPDPC 12 (failure to purge personal data from server led to data breach; retention
of data was also unnecessary); Social Metric Pte Ltd [2017] SGPDPC 17 (company penalised for, in
part, failure to cease retaining personal data); Jade E-Services Singapore Pte. Ltd. [2018] SGPDPC
21 (company should not have taken the risk of allowing webpages with personal data to be cached
for display).
318
E.-I. Ong
91 it shall correct the data and send it to “every other
organisation to which the personal data was disclosed by the organisation within a
year before the date the correction was made”.
92 Fees may not be charged for such
correction.
93
Exceptions An organisation need not correct an opinion, including a professional
or expert opinion.
94 Correction is also not required regarding, e.g. opinion data kept
solely for evaluative purposes; school examinations; and documents related to a
prosecution if proceedings have not been completed.
95
2.2.5 Limited Retention
Organisations must cease retaining personal data as soon as it is “reasonable” to
assume that the purpose for which the personal data was collected is no longer served
by such retention, and retention is no longer necessary for legal or business purposes.
96 Thus, an organisation may not retain data “just in case” the data may be
needed for other purposes.
97
An organisation ceases to retain documents containing personal data when it, its
agents and its data intermediaries no longer have access to those documents and the
personal data they contain, e.g. by destroying the documents or anonymizing the
data.
98 Documents should be “completely irretrievable or inaccessible” to the organisation.
99 Data in electronic form which is archived or to which access is limited is
still considered retained.
100
Factors to consider in determining whether an organisation has ceased to retain
personal data are: whether the organisation has any intention to use or access the
personal data; the effort and resources needed to use or access the personal data
again; whether third parties have been given access to that personal data; and
whether the organisation has made a reasonable attempt to destroy, dispose of or
delete the personal data in a permanent and complete manner.
101
91 PDPA s 22(2) read with s 22(5).
92 PDPA s 22(2).
93 PDPC Advisory Guidelines on Key Concepts para 15.39.
94 PDPA s 22(6).
95 PDPA Sixth Schedule s 1.
96 PDPA s 25.
97 PDPC Advisory Guidelines on Key Concepts para 18.4.
98 PDPC Advisory Guidelines on Key Concepts para 18.10.
99 PDPC Advisory Guidelines on Key Concepts para 18.12.
100 PDPC Advisory Guidelines on Key Concepts para 18.11.
101 PDPC Advisory Guidelines on Key Concepts para 18.13. See, e.g., Orchard Turn Developments
Pte. Ltd. [2017] SGPDPC 12 (failure to purge personal data from server led to data breach; retention
of data was also unnecessary); Social Metric Pte Ltd [2017] SGPDPC 17 (company penalised for, in
part, failure to cease retaining personal data); Jade E-Services Singapore Pte. Ltd. [2018] SGPDPC
21 (company should not have taken the risk of allowing webpages with personal data to be cached
for display).
318
E.-I. Ong