Main Advisory Guidelines

5 Enforcement on Data Protection Provisions

The PDPA confers powers on PDPC to enforece Data Protection Provisions. Such powers can be categorised as below:

1. Related to alternative dispute resolution and other modes of dispute settlement.
2. Related to reviews.
3. Related to investigations.

In exercising its powers to enforce the data protection provisions, PDPC’s considers 2 main objectives, which are not mutually exclusive:

1. To facilitate the resolution of an individual’s complaint with regards to an organisation’s contravention or alleged contravention to any data protection provisions;
2. To make sure organisation comply with their obligations under PDPA and, in the event of non-compliance, ensure appropriate corrective actions to be taken in a timely manner.

When PDPC receives a compliant from an individual of a possible contravention by an organisation, it generally prefer to facilitate the resolution between the 2 parties instead of immediately exercising its powers. PDPC is not empowered to award damages to a complainant. Therefore facilitation and alternative dispute resolution mechanisms like mediation are encouraged to find a mutually acceptable resolution, which may include compensation. PDPC, may conduct an investigation even if the complainant and the organisation reached an agreement to resolve their issues. This may include scenarios where facts of the case disclose issues of general public interest or there are other individuals affected by the same case.

We summarised them into 5 enforcements of the data protection which served only as reference below:

1. Offences Related to PDPC’s Powers of Investigation
2. Enforcement of Data Protection Provisions
3. Enforcement of DNC Provision
4. General Offences and Penalties
5. Dispute Resolution

Offences Related to PDPC’s Powers of Investigation

• An orgnisation or person is guilty of an offence if any of the offence is committed:
  1. If the organisation or person with an intent to evade a request for access or correction, disposes of, alters, falsifies, conceals or destroys, or direct another person to do so such acts for a record containing-
     • Personal data; or
     • information about the collection, use or disclosure of personal data
  2. If the organisation or person obstructs PDPC or an authorised officer in the performance of their duties or exercise their powers under the Act;
  3. If the organisation or person knowingly or recklessly makes a false statement to PDPC, in the course of the performance of its duties or powers under the Act; and
  4. If a person makes a request for access or correction to obtain access or to change the personal data of another individual without the given authority of the individual.

Enforcement of Data Protection Provisions

• If PDPC finds that an organisation is in breach of any of the data protection provisions, it may give the organisation directions to make sure compliance. These may include requiring the organisation to:
  1. Stop the collection, use and disclosure of the personal data in contravention;
  2. Destroy personal data in contravention;
  3. Provide access to or to correct the personal data;
  4. Pay a financial penalty of an amount not exceeding S$1 million.
• The individual may choose to tick or check the boxes his preferred method of receiving such information.
• Read the 9 obligations under the Act.

Enforcement of DNC Provisions

• The aim of DNC Registry is to reduce the number of unwanted marketing calls, text messages and faxes. Registering one’s number on the registry does not stop such calls, texts or faxes which can include:
  1. Calls, texts or faxes from businesses to which you have given your consent to receive;
  2. Calls, texts or faxes solely to provide you with periodic updates on your account statement, to notify you a change in terms or features of your ongoing commercial relationship with the organisation or you have an ongoing relationship with the organisation and the calls, texts or faxes is related to that relationship;
  3. An individual acting in a personal or domestic capacity;
  4. You are entitled to receiving such messages under the terms of a transaction from a product or service delivery organisation. 
  5. An organisation which is facilitating, completing or confirming a transaction that the you have previously agreed with the sender;
  6. Public agencies promoting any programme which is not for commercial purpose.

General Offences and Penalties

• It is an offence under PDPA to:
  1. Obstruct or impede PDPC, its inspector or authorised officers in carrying out and exercising its powers and duties;
  2. Knowingly or recklessly made a false statement to PDPC, or knowingly misleads or attempts to mislead the PDPC when it is carrying out its duties.
• An organisation or person that commits an offence is liable to:
  1. For individual: fine not exceeding $10,000 or imprisonment for a term not exceeding 12 months or both;
  2. Any other case, a fine not exceeding $100,000.

DNC Registry Penalties

• Any organisation that breaches DNC provisions is liable to a fine of up to 10,000 per offence. In appropriate cases, PDPC may compound the offence for a sum up to $1,000.

Dispute Resolution

Alternative Dispute Resolution

• PDPC’s powers relating to alternative dispute resolution:
  1. If PDPC thinks the complaint by the individual against the organisation is more appropriately solved by mediation, it will refer the matter for mediation, with the consent of the individual.
  2. PDPC may direct both complainant and organisation to resolve the complaint in a certain way.
  3. PDPC’s powers to alternate dispute resolution do not include deciding disputes between the complainant and the organisation or ordering an organisation to compensate complainant who suffers a loss as a result of the contravention of the Act.

Measures to Facilitate Resolution of a Complaint

• There are 5 steps in the measure to facilitate resolution of a complaint namely:
  1. Encourage self-resolution
  2. Referring a complaint to an organisation (CASE etc.)
  3. Facilitating Resolution
  4. Referring a complaint to mediation (SMC etc.)
  5. Directing parties to attempt to resolve the complaint

Mediation as an Alternative

• Mediation can be a faster and less costly way of resolving disputes. This takes place outside of PDPC’s investigation process.
• The complainant and organisation can choose to solve their dispute through mediation. When both parties meet at mediation table, it could lead to better understanding of each other’s interest and area of disagreement.
• Both parties may also independently approach mediation bodies such as Consumer Association of Singapore (CASE) or Singapore Mediation Centre (SMC) for their mediation services before coming to PDPC.