complainant’s WhatsApp conversations with A (which included the complainant’s
personal mobile phone number and residential address) on A’s Facebook page.
220 A
claimed he merely intended to transfer the screenshots to his lawyers.
221 The
Commission held that the transfer over Facebook “was wholly inappropriate” and
unreasonable, and there “were other ways” to send the screenshots.
222 A could have
encrypted or password protected the screenshots, or even “connected his phone to
his PC and transferred the file without the need to make use of the open Internet”.
223
As A was acting in the course of his employment with respondent, the respondent
failed to make reasonable security arrangements to protect personal data in its
possession or control, and was in breach of the PDPA.
224
Additionally, employees who post material on social networks could be subject to
defamation claims, both criminal
225 and civil,
226 as well as claims of malicious
falsehood.
227 Other claims could include breach of confidence (e.g. through the
unauthorised posting of private information)
228 and copyright infringement (e.g. by
posting materials to which the poster does not have the copyright).
229 Employees
have also been simply fired for unwise postings on social media.
230
Vicarious liability may also apply if such employees’ actions could be attributed
to the employer, whether under the PDPA
231 or other law.
232
3.6 Security Obligations and Data Breach Notifications
Security obligations are addressed more generally under other parts of Sect. 3.
220 [2016] SGPDPC 20 at [4], [13].
221 [2016] SGPDPC 20 at [21].
222 [2016] SGPDPC 20 at [21], [25].
223 [2016] SGPDPC 20 at [25].
224 [2016] SGPDPC 20 at [14], [24]-[26].
225 Penal Code (Cap 224, 200 Rev Ed) s 499.
226 See, e.g., Golden Season Pte Ltd v Kairos Singapore Holdings Pte Ltd [2015] SGHC 38 (involving claims of defamation and malicious falsehood through an employee’s statements regarding
another entity, made via Facebook, emails and text messages).
227 See Golden Season Pte Ltd v Kairos Singapore Holdings Pte Ltd [2015] SGHC 38.
228 See Chan and Lee (2016) paras 16.020–16.027.
229 See Golden Season Pte Ltd v Kairos Singapore Holdings Pte Ltd [2015] SGHC 38. See also Tan
B (2011) Social Media in the Workplace: Challenges and Implications. http://www.lawgazette.com.
sg/2011-06/131.htm. Accessed 30 August 2019. Sedition Act (Cap 290, 2013 Rev Ed); Public
Order Act (Chapter 257A); and the Penal Code (Cap 224, 2008 Rev Ed).
230 See, e.g., Lai L (2016) Aussie expat fired after offensive Facebook rant. In: The Straits Times.
http://www.straitstimes.com/singapore/aussie-expat-fired-after-offensive-facebook-rant. Accessed
30 August 2019.
231 PDPA s 53(1).
232 See Chan and Lee (2016), paras 19.001 et seq.
330
E.-I. Ong
personal mobile phone number and residential address) on A’s Facebook page.
220 A
claimed he merely intended to transfer the screenshots to his lawyers.
221 The
Commission held that the transfer over Facebook “was wholly inappropriate” and
unreasonable, and there “were other ways” to send the screenshots.
222 A could have
encrypted or password protected the screenshots, or even “connected his phone to
his PC and transferred the file without the need to make use of the open Internet”.
223
As A was acting in the course of his employment with respondent, the respondent
failed to make reasonable security arrangements to protect personal data in its
possession or control, and was in breach of the PDPA.
224
Additionally, employees who post material on social networks could be subject to
defamation claims, both criminal
225 and civil,
226 as well as claims of malicious
falsehood.
227 Other claims could include breach of confidence (e.g. through the
unauthorised posting of private information)
228 and copyright infringement (e.g. by
posting materials to which the poster does not have the copyright).
229 Employees
have also been simply fired for unwise postings on social media.
230
Vicarious liability may also apply if such employees’ actions could be attributed
to the employer, whether under the PDPA
231 or other law.
232
3.6 Security Obligations and Data Breach Notifications
Security obligations are addressed more generally under other parts of Sect. 3.
220 [2016] SGPDPC 20 at [4], [13].
221 [2016] SGPDPC 20 at [21].
222 [2016] SGPDPC 20 at [21], [25].
223 [2016] SGPDPC 20 at [25].
224 [2016] SGPDPC 20 at [14], [24]-[26].
225 Penal Code (Cap 224, 200 Rev Ed) s 499.
226 See, e.g., Golden Season Pte Ltd v Kairos Singapore Holdings Pte Ltd [2015] SGHC 38 (involving claims of defamation and malicious falsehood through an employee’s statements regarding
another entity, made via Facebook, emails and text messages).
227 See Golden Season Pte Ltd v Kairos Singapore Holdings Pte Ltd [2015] SGHC 38.
228 See Chan and Lee (2016) paras 16.020–16.027.
229 See Golden Season Pte Ltd v Kairos Singapore Holdings Pte Ltd [2015] SGHC 38. See also Tan
B (2011) Social Media in the Workplace: Challenges and Implications. http://www.lawgazette.com.
sg/2011-06/131.htm. Accessed 30 August 2019. Sedition Act (Cap 290, 2013 Rev Ed); Public
Order Act (Chapter 257A); and the Penal Code (Cap 224, 2008 Rev Ed).
230 See, e.g., Lai L (2016) Aussie expat fired after offensive Facebook rant. In: The Straits Times.
http://www.straitstimes.com/singapore/aussie-expat-fired-after-offensive-facebook-rant. Accessed
30 August 2019.
231 PDPA s 53(1).
232 See Chan and Lee (2016), paras 19.001 et seq.
330
E.-I. Ong