obtain consent from an individual legally able to provide consent on the minor’s
behalf, such as a parent or guardian.
185
Deemed Consent While the 13-year-old threshold would still apply, organisations
wishing to rely on deemed consent should take extra care to establish whether such
minor has sufficient understanding of the purposes for which the organisation is
collecting, using and disclosing data and the consequences of giving his/her data.
186
Organisations should also not exercise undue influence to obtain personal data from
minors.
187
3.4 Right to Erasure
There is no specific right to be forgotten. However, the Limited Retention Obligation
applies.
3.5 Employees
The PDPA applies to employees’ personal data, irrespective of the form of the
data.
188 Organisations should treat the personal data of their employees and job
applicants “with equal care” and in the same manner as they would treat the personal
data of any other individual.
189
For instance, at Yes Tuition Agency,
190 the organisation (a tuition agency)
disclosed on its website the national identification numbers and images of individuals who had registered to be tutors.
191 The Commission held that the organisation
had breached the Consent Obligation by failing to obtain the tutors’ consent for such
disclosure.
192 And at Jump Rope (Singapore),
193 the organisation sent an email to
185 PDPC Advisory Guidelines for Selected Topics paras 7.6, 7.9. The PDPC has also decided a
number of cases where minors’ personal data were involved. See e.g., Singapore Taekwondo
Federation [2018] SGPDPC 17 (unauthorized disclosure of minor’s national identification numbers
via the organisation’s website); Spring College International Pte. Ltd. [2018] SGPDPC 15 (school
posted, without permission, personal data about its minor students on a public social media page to
promote its courses).
186 PDPC Advisory Guidelines for Selected Topics para 7.11.
187 PDPC Advisory Guidelines for Selected Topics para 7.11.
188 PDPC Protecting the Personal Data of Job Applicants and Employees p. 1.
189 PDPC Protecting the Personal Data of Job Applicants and Employees p. 1.
190 [2016] SGPDPC 05.
191 [2016] SGPDPC 05 at [1].
192 [2016] SGPDPC 05 at [15].
193 [2016] SGPDPC 21.
Singapore Report: Data Protection in the Internet
327
behalf, such as a parent or guardian.
185
Deemed Consent While the 13-year-old threshold would still apply, organisations
wishing to rely on deemed consent should take extra care to establish whether such
minor has sufficient understanding of the purposes for which the organisation is
collecting, using and disclosing data and the consequences of giving his/her data.
186
Organisations should also not exercise undue influence to obtain personal data from
minors.
187
3.4 Right to Erasure
There is no specific right to be forgotten. However, the Limited Retention Obligation
applies.
3.5 Employees
The PDPA applies to employees’ personal data, irrespective of the form of the
data.
188 Organisations should treat the personal data of their employees and job
applicants “with equal care” and in the same manner as they would treat the personal
data of any other individual.
189
For instance, at Yes Tuition Agency,
190 the organisation (a tuition agency)
disclosed on its website the national identification numbers and images of individuals who had registered to be tutors.
191 The Commission held that the organisation
had breached the Consent Obligation by failing to obtain the tutors’ consent for such
disclosure.
192 And at Jump Rope (Singapore),
193 the organisation sent an email to
185 PDPC Advisory Guidelines for Selected Topics paras 7.6, 7.9. The PDPC has also decided a
number of cases where minors’ personal data were involved. See e.g., Singapore Taekwondo
Federation [2018] SGPDPC 17 (unauthorized disclosure of minor’s national identification numbers
via the organisation’s website); Spring College International Pte. Ltd. [2018] SGPDPC 15 (school
posted, without permission, personal data about its minor students on a public social media page to
promote its courses).
186 PDPC Advisory Guidelines for Selected Topics para 7.11.
187 PDPC Advisory Guidelines for Selected Topics para 7.11.
188 PDPC Protecting the Personal Data of Job Applicants and Employees p. 1.
189 PDPC Protecting the Personal Data of Job Applicants and Employees p. 1.
190 [2016] SGPDPC 05.
191 [2016] SGPDPC 05 at [1].
192 [2016] SGPDPC 05 at [15].
193 [2016] SGPDPC 21.
Singapore Report: Data Protection in the Internet
327