Under recent amendments to the Criminal Procedure Code or CPC,
163 the
authorities’ computer-related powers of investigation were enhanced. Investigators
can, as part of an investigation:
• inspect and search, in and from Singapore, any data stored on or available to a
computer implicated in the investigation, regardless of whether such computer is
inside or outside Singapore (thus this could include web-based email accounts
and web storage accounts);
• order a person to provide login information such as usernames and passwords, to
gain access to a computer under investigation; and
• prevent a person from accessing a computer or account by changing a password
or by other means.
164
The Computer Misuse Act or CMA
165 also involves personal data on computers.
It is an offence to obtain, retain, supply, transmit or make available “personal
information” obtained in violation of offences under the CMA.
166 The definition
of “personal information” would appear to involve personal data, as it includes:
any information, whether true or not, about an individual of a type that is commonly used
alone or in combination with other information to identify . . . an individual, including . . .
biometric data, name, address, date of birth, national registration identity card number. . .
167
Additionally, personal data located on computers may be affected by the Cybersecurity Act.
168 Under this Act, the relevant authorities may take measures with
regard to computers and computer systems which are deemed “critical information
infrastructure”
169 and/or affected by cyber security incidents,
170 including scanning
the relevant computers for cyber security vulnerabilities.
171 This includes requiring
information concerning a computer or computer system (including any data therein)
to determine if it is a “critical information infrastructure” (“CII”).
172 If there is a
cyber security incident, the Commissioner may also take investigatory steps,
163 See n 11.
164 CPC s 39(1). See also Singapore Parliamentary Debates, Official Report (19 March 2018) vol 94:
“Many people now use web-based email accounts or web storage accounts. Technically, such data
may reside in computers outside Singapore, even if the data is accessed from within Singapore.
Applicable laws in other countries will be duly considered when such powers are exercised”.
165 See n 10.
166 CMA s 8A(1). Offences include: causing a computer to perform any function to secure
unauthorised access to computer material (CMA s 3); causing a computer to perform any function
to secure access to computer material with intent to commit a CMA offence (CMA s 4);
unauthorised modification of computer material (CMA s 5); and unauthorised access, use or
interception of computer services (CMA s 6).
167 CMA s 8A(7).
168 See n 12.
169 Cybersecurity Act ss 7–16.
170 Cybersecurity Act s 19.
171 Cybersecurity Act ss 20(2)(b)-( f ).
172 Cybersecurity Act s 8.
Singapore Report: Data Protection in the Internet
325
163 the
authorities’ computer-related powers of investigation were enhanced. Investigators
can, as part of an investigation:
• inspect and search, in and from Singapore, any data stored on or available to a
computer implicated in the investigation, regardless of whether such computer is
inside or outside Singapore (thus this could include web-based email accounts
and web storage accounts);
• order a person to provide login information such as usernames and passwords, to
gain access to a computer under investigation; and
• prevent a person from accessing a computer or account by changing a password
or by other means.
164
The Computer Misuse Act or CMA
165 also involves personal data on computers.
It is an offence to obtain, retain, supply, transmit or make available “personal
information” obtained in violation of offences under the CMA.
166 The definition
of “personal information” would appear to involve personal data, as it includes:
any information, whether true or not, about an individual of a type that is commonly used
alone or in combination with other information to identify . . . an individual, including . . .
biometric data, name, address, date of birth, national registration identity card number. . .
167
Additionally, personal data located on computers may be affected by the Cybersecurity Act.
168 Under this Act, the relevant authorities may take measures with
regard to computers and computer systems which are deemed “critical information
infrastructure”
169 and/or affected by cyber security incidents,
170 including scanning
the relevant computers for cyber security vulnerabilities.
171 This includes requiring
information concerning a computer or computer system (including any data therein)
to determine if it is a “critical information infrastructure” (“CII”).
172 If there is a
cyber security incident, the Commissioner may also take investigatory steps,
163 See n 11.
164 CPC s 39(1). See also Singapore Parliamentary Debates, Official Report (19 March 2018) vol 94:
“Many people now use web-based email accounts or web storage accounts. Technically, such data
may reside in computers outside Singapore, even if the data is accessed from within Singapore.
Applicable laws in other countries will be duly considered when such powers are exercised”.
165 See n 10.
166 CMA s 8A(1). Offences include: causing a computer to perform any function to secure
unauthorised access to computer material (CMA s 3); causing a computer to perform any function
to secure access to computer material with intent to commit a CMA offence (CMA s 4);
unauthorised modification of computer material (CMA s 5); and unauthorised access, use or
interception of computer services (CMA s 6).
167 CMA s 8A(7).
168 See n 12.
169 Cybersecurity Act ss 7–16.
170 Cybersecurity Act s 19.
171 Cybersecurity Act ss 20(2)(b)-( f ).
172 Cybersecurity Act s 8.
Singapore Report: Data Protection in the Internet
325