Search for:
Cybersecurity, Data and Tech

Singapore: Parliament passes Cybersecurity (Amendment) Bill on 7 May 2024

By , , and 4 Mins Read

The Cybersecurity Act 2018 will be amended to cover a wider range of entities, reporting obligations will be enhanced, and the CSA will be empowered to issue significant civil penalties.

In brief

The Singapore Parliament has passed the Cybersecurity (Amendment) Bill (“Bill“) amending the Cybersecurity Act 2018 (“Act“). The Act, which formerly only regulated Critical Information Infrastructure (CII), has been expanded significantly to cover a wider range of entities. Reporting obligations have been expanded. Finally, the penalty regime has also been revised, and the Cybersecurity Agency of Singapore (CSA) may now issue civil penalties in place of criminal penalties, with the maximum quantum of penalties significantly increased to up to 10% of the annual turnover of the entity in Singapore.

This is similar to the existing penalty regime under the Personal Data Protection Act 2012.

In more detail

The Bill was passed on 7 May 2024 after its Second Reading, following extensive consultation efforts undertaken by the CSA to engage stakeholders over two years.

Much of the Bill retains its original shape. For more details you can refer to our earlier client alerts of March 2024 and April 2024.

Some notable changes and obligations to note are as follows:

  • The newly created category of “Foundational Digital Infrastructure” service providers, which will now be regulated under the Act and subject to obligations, standards of performance and codes of practice. The Bill includes two sectors in this category, namely cloud computing services and data centre facility services.
  • The regulation of providers of essential services that use third-party-owned CII. This is a new category of regulated entity, intended to more appropriately address the case where providers of essential services use computing or virtualisation vendors. This was previously referred to with the terminology of “non-provider-owned CII” but has since been revised to “third-party-owned CII”.
  • The expansion of reporting obligations for providers of essential services.

However, there have been some updates to the Bill from its draft iteration circulated during consultation. In particular, the penalty regime has been revised. Previously, compliance with obligations was enforced through criminal penalties on CII owners.

Under the new Section 37A of the Act, the CSA may now bring an action in court for civil penalties with the Public Prosecutor’s consent in place of any criminal penalties under Part 3, 3A, 3B, 3C or 3D of the Act. In making a recommendation to the Public Prosecutor, the CSA will consider a range of factors, including the risks created by the non-compliance, the egregiousness, and the facts of the case.

The criminal penalties under Part 3D of the Act, regulating Foundational Digital Infrastructure, can be a fine of up to SGD 200,000 or 10% of the annual turnover of the entity’s business in Singapore (Section 18H of the Act). This is noticeably higher than the existing penalties for CII, which is a fine only up to a maximum of SGD 100,000 (Section 10 of the Act).

The CSA is empowered to issue civil penalties with a range of maximum penalties for different offences, the highest of which would be up to SGD 500,000 or 10% of the annual turnover of the entity’s business in Singapore (Section 37A of the Act).

Key takeaways

With these changes, especially the steeper potential penalties, clients should continue to stay vigilant and monitor the landscape. Businesses should stay engaged with the cybersecurity discourse and stay informed regarding the latest cybersecurity developments. It is important to review security protocols, ensure compliance, and take proactive steps to protect your interests.

* * * * *

For further information and to discuss what this might mean for you, please get in touch with your usual Baker McKenzie contact.

* * * * *

LOGO_Wong&Leow_Singapore

© 2024 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “principal” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.

Categories:
Author

Andy Leck is the head of the Intellectual Property and Technology (IPTech) Practice Group and a member of the Dispute Resolution Practice Group in Singapore. He is a core member of Baker McKenzie's regional IP practice and also leads the Myanmar IP Practice Group. Andy is recognised by reputable global industry and legal publications as a leader in his field. He was named on "The A-List: Singapore's Top 100 lawyers" by Asia Business Law Journal 2018. In addition, Chambers Asia Pacific notes that Andy is "a well-known IP practitioner who is highlighted for his record of handling major trade mark litigation, as well as commercial exploitation of IP rights in the media and technology sectors. He's been in the industry for a long time and has always been held in high regard. He is known to be very fair and is someone you would like to be in the trenches with you during negotiations." Furthermore, Asian Legal Business acknowledges Andy as a leading practitioner in his field and notes that he “always gives good, quick advice, [is] client-focused and has strong technical knowledge for his areas of practice.” Andy was appointed by the Intellectual Property Office of Singapore (IPOS) as an IP Adjudicator to hear disputes at IPOS for a two-year term from April 2021. He has been an appointed member of the Singapore Copyright Tribunal since May 2010 and a mediator with the WIPO Arbitration and Mediation Center. He is also appointed as a Notary Public & Commissioner for Oaths in Singapore. He previously served on the International Trademark Association’s Board of Directors and was a member of the executive committee.

Author

Ren Jun Lim is a principal with Baker McKenzie Wong & Leow. He represents local and international clients in both contentious and non-contentious intellectual property matters. He also advises on a full range of healthcare, as well as consumer goods-related legal and regulatory issues. Ren Jun co-leads Baker McKenzie Wong & Leow's Healthcare as well as Consumer Goods & Retail industry groups. He sits on the Law Society of Singapore IP Committee and on the Executive Committee of the Association of Information Security Professionals. He is also a member of the Vaccines Working Group, Singapore Association of Pharmaceutical Industries, a member of the International Trademark Association, as well as a member of the Regulatory Affairs Professionals Association. Ren Jun is ranked in the Silver tier for Individuals: Enforcement and Litigation and Individuals: Prosecution and Strategy, and a recommended lawyer for Individuals: Transactions by WTR 1000, 2020. He is also listed in Asia IP's Best 50 IP Expert, 2020, recognised as a Rising Star by Managing IP: IP Stars, 2019 and one of Singapore's 70 most influential lawyers aged 40 and under by Singapore Business Review, 2016. Ren Jun was acknowledged by WTR 1000 as a "trademark connoisseur who boasts supplementary knowledge of regulatory issues in the consumer products industry." He was also commended by clients for being "very responsive to enquiries and with a keen eye for detail, he is extremely hands-on. His meticulous and in-depth approach to strategising is key to the excellent outcomes we enjoy."

Author

Ken Chia is a member of the Firm’s IP Tech, International Commercial & Trade and Competition Practice Groups. He is regularly ranked as a leading TMT and competition lawyer by top legal directories, including Chambers Asia Pacific and Legal 500 Asia Pacific. Ken is an IAPP Certified International Privacy Professional (FIP, CIPP(A), CIPT, CIPM) and a fellow of the Chartered Institute of Arbitrators and the Singapore Institute of Arbitrators.

Author

Sanil is a local principal in the Intellectual Property & Technology Practice Group in Baker McKenzie Wong & Leow. Sanil is qualified in both Singapore and Australia, and is a Certified Information Privacy Professional (CIPP/A) by the International Association of Privacy Professionals. Sanil is recognized as a Rising Star by both Legal 500 Asia Pacific in the Intellectual Property: Local Firms category as well as by IP Stars for his advisory work in the IP space. Sanil is also recommended by World Trademark Review 1000 for IP enforcement, litigation, prosecution and strategy.

Related Posts