under the Criminal Procedure Code, including the power to investigate personal data
on computers (as discussed under Sect. 3.2).
302
The Cybersecurity Act also authorises (among other things) the taking of measures to prevent, manage and respond to cyber security threats.
303 This has two
general components—ensuring the protection of CIIs,
304 and preventing and investigating cyber security incidents.
305
It is also notable that section 58 of the Telecommunications Act seemingly
provides a lower threshold for the minister to give directions to a telecommunications licensee, where it is “requisite or expedient to do so”, “on the occurrence of any
public emergency, in the public interest or in the interests of public security, national
defence, or relations with the government of another country”.
306
Finally, as stated in Sect. 3.7.1, under POFMA it will be an offence to do any act
(whether in or outside Singapore), in order to communicate a false statement, where:
the communication of such statement is likely to be prejudicial to Singapore’s
security, to public health, or Singapore’s friendly relations to other countries; or
will incite feelings of enmity between different groups of persons.
307 This includes
any statements made using “inauthentic online accounts” or “bots”.
308
3.10 Remedies and Sanctions
PDPA Enforcement under the PDPA is complaints-based rather than auditbased.
309 However, the Commission may also conduct an investigation under the
PDPA on its own motion.
310
Remedies The Commission may refer a complaint for mediation or direct the parties
to resolve the complaint “in the way directed by the Commission”.
311 Additionally,
in response to a complaint regarding an organisation’s non-compliance with the
Access or Correction Obligations, the Commission may: confirm a refusal to provide
access or direct the organisation to provide such access; confirm, reduce, or disallow
302 Cybersecurity Act s 23(2).
303 Cybersecurity Act (long title). See also Sect. 3.2.
304 Cybersecurity Act ss 7–10.
305 Cybersecurity Act ss 19–23.
306 Telecommunications Act s 58. See also Tan KB (2016) Security and privacy must not be traded
off against each other. In: Today Online. https://www.todayonline.com/commentary/security-andprivacy-must-not-be-traded-against-each-other. Accessed 18 June 2018.
307 POFMA s 7(1).
308 POFMA s 7(3).
309 Chesterman (2018), para 2.103; PDPA s 50(1).
310 PDPA s 50(1).
311 PDPA s 27.
Singapore Report: Data Protection in the Internet
339
on computers (as discussed under Sect. 3.2).
302
The Cybersecurity Act also authorises (among other things) the taking of measures to prevent, manage and respond to cyber security threats.
303 This has two
general components—ensuring the protection of CIIs,
304 and preventing and investigating cyber security incidents.
305
It is also notable that section 58 of the Telecommunications Act seemingly
provides a lower threshold for the minister to give directions to a telecommunications licensee, where it is “requisite or expedient to do so”, “on the occurrence of any
public emergency, in the public interest or in the interests of public security, national
defence, or relations with the government of another country”.
306
Finally, as stated in Sect. 3.7.1, under POFMA it will be an offence to do any act
(whether in or outside Singapore), in order to communicate a false statement, where:
the communication of such statement is likely to be prejudicial to Singapore’s
security, to public health, or Singapore’s friendly relations to other countries; or
will incite feelings of enmity between different groups of persons.
307 This includes
any statements made using “inauthentic online accounts” or “bots”.
308
3.10 Remedies and Sanctions
PDPA Enforcement under the PDPA is complaints-based rather than auditbased.
309 However, the Commission may also conduct an investigation under the
PDPA on its own motion.
310
Remedies The Commission may refer a complaint for mediation or direct the parties
to resolve the complaint “in the way directed by the Commission”.
311 Additionally,
in response to a complaint regarding an organisation’s non-compliance with the
Access or Correction Obligations, the Commission may: confirm a refusal to provide
access or direct the organisation to provide such access; confirm, reduce, or disallow
302 Cybersecurity Act s 23(2).
303 Cybersecurity Act (long title). See also Sect. 3.2.
304 Cybersecurity Act ss 7–10.
305 Cybersecurity Act ss 19–23.
306 Telecommunications Act s 58. See also Tan KB (2016) Security and privacy must not be traded
off against each other. In: Today Online. https://www.todayonline.com/commentary/security-andprivacy-must-not-be-traded-against-each-other. Accessed 18 June 2018.
307 POFMA s 7(1).
308 POFMA s 7(3).
309 Chesterman (2018), para 2.103; PDPA s 50(1).
310 PDPA s 50(1).
311 PDPA s 27.
Singapore Report: Data Protection in the Internet
339