a fee imposed in connection with such request, or require a refund of such fee; or
confirm a refusal to correct data, or direct the organisation to correct such data.
312
The Commission may also give a non-PDPA compliant organisation such directions as it sees fit, including to: stop collecting, using or disclosing personal data;
destroy personal data collected in contravention of the PDPA; comply with the
Commission’s directions concerning the Access or Correction Obligations; and
pay a penalty not exceeding $1 million SGD (save for breaches which are offences
under the PDPA).
313 The Commission may register its directions at a District Court
for enforcement purposes.
314
As of writing, the maximum penalty issued under the PDPA has been $750,000
SGD.
315 In practice the Commission has also issued warnings in cases which it did
not deem severe breaches of the PDPA.
316
Offences It is an offence to request for access to, or to change personal data about
another individual without the authority of such individual, conviction under which
may result in a fine not exceeding $5000 SGD and/or imprisonment for a term not
exceeding 12 months.
317
An organisation or person commits an offence if (a) with intent to evade a request
under the Access or Correction Obligations, it/he/she disposes of, alters, falsifies,
conceals or destroys (or directs another person to do any of the above) a record
containing (1) personal data or (2) information about the collection, use or disclosure
of personal data; (b) obstructs or hinders the Commission in the performance of any
function or duty, or the exercise of any power, under the PDPA; or (c) makes a
statement or furnishes any information or document, to the Commission which it/he/
she knows (or ought reasonably to know) to be false or misleading.
318 Conviction
under (a) may result in, for an individual, a fine not exceeding $5000 SGD and
otherwise a fine not exceeding $50,000 SGD.
319 Conviction under (b) or (c) may
result in, for an individual, a fine not exceeding $10,000 SGD and/or imprisonment
for a term not exceeding 12 months, and otherwise a fine not exceeding $100,000
SGD.
320
Regarding the DNCR provisions, each of the following is an offence which may
result in a fine not exceeding $10,000 SGD:
312 PDPA s 28.
313 PDPA s 29.
314 PDPA s 30.
315 Singapore Health Services Pte Ltd [2019] SGPDPC 03. The financial penalties imposed against
the two organisations involved are, individually, the highest ($750,000 SGD) and second highest
($250,000 SGD) financial penalty amounts imposed by the Commission to date.
316 See, e.g., Singapore Computer Society [2016] SGPDPC 09; Jump Rope (Singapore) [2016]
SGPDPC 21.
317 PDPA ss 51(1)-(2).
318 PDPA s 51(3).
319 PDPA s 51(4).
320 PDPA s 51(5).
340
E.-I. Ong
confirm a refusal to correct data, or direct the organisation to correct such data.
312
The Commission may also give a non-PDPA compliant organisation such directions as it sees fit, including to: stop collecting, using or disclosing personal data;
destroy personal data collected in contravention of the PDPA; comply with the
Commission’s directions concerning the Access or Correction Obligations; and
pay a penalty not exceeding $1 million SGD (save for breaches which are offences
under the PDPA).
313 The Commission may register its directions at a District Court
for enforcement purposes.
314
As of writing, the maximum penalty issued under the PDPA has been $750,000
SGD.
315 In practice the Commission has also issued warnings in cases which it did
not deem severe breaches of the PDPA.
316
Offences It is an offence to request for access to, or to change personal data about
another individual without the authority of such individual, conviction under which
may result in a fine not exceeding $5000 SGD and/or imprisonment for a term not
exceeding 12 months.
317
An organisation or person commits an offence if (a) with intent to evade a request
under the Access or Correction Obligations, it/he/she disposes of, alters, falsifies,
conceals or destroys (or directs another person to do any of the above) a record
containing (1) personal data or (2) information about the collection, use or disclosure
of personal data; (b) obstructs or hinders the Commission in the performance of any
function or duty, or the exercise of any power, under the PDPA; or (c) makes a
statement or furnishes any information or document, to the Commission which it/he/
she knows (or ought reasonably to know) to be false or misleading.
318 Conviction
under (a) may result in, for an individual, a fine not exceeding $5000 SGD and
otherwise a fine not exceeding $50,000 SGD.
319 Conviction under (b) or (c) may
result in, for an individual, a fine not exceeding $10,000 SGD and/or imprisonment
for a term not exceeding 12 months, and otherwise a fine not exceeding $100,000
SGD.
320
Regarding the DNCR provisions, each of the following is an offence which may
result in a fine not exceeding $10,000 SGD:
312 PDPA s 28.
313 PDPA s 29.
314 PDPA s 30.
315 Singapore Health Services Pte Ltd [2019] SGPDPC 03. The financial penalties imposed against
the two organisations involved are, individually, the highest ($750,000 SGD) and second highest
($250,000 SGD) financial penalty amounts imposed by the Commission to date.
316 See, e.g., Singapore Computer Society [2016] SGPDPC 09; Jump Rope (Singapore) [2016]
SGPDPC 21.
317 PDPA ss 51(1)-(2).
318 PDPA s 51(3).
319 PDPA s 51(4).
320 PDPA s 51(5).
340
E.-I. Ong