Search for:
Cybersecurity, Data and Tech

Singapore: MCI considering Digital Infrastructure Act expanding regulatory scope for digital services

By 4 Mins Read

In brief

The Ministry of Communications and Information (MCI) has announced that the inter-agency Taskforce on the Resilience and Security of Digital Infrastructure and Services (“Taskforce”) is studying the introduction of a Digital Infrastructure Act (DIA). The DIA builds on the Cybersecurity Act (“CS Act“) and aims to enhance the resilience and security of the digital infrastructure in Singapore. The scope of the DIA goes beyond cybersecurity and touches on other risks that may affect resilience.

In more detail

At the Committee of Supply 2024, MCI announced that the Taskforce is studying the introduction of the DIA. The Taskforce is led by MCI and comprises members from Smart Nation Group, Cyber Security Agency of Singapore, Info-communications Media Development Authority, and Government Technology Agency.

The CS Act governs the cybersecurity and resilience of critical information infrastructure (CII), which are computers or computer systems necessary for the continuous delivery of essential services. However, MCI notes that recent technological disruptions, such as a four-hour-long data center outage on 14 October 2023, was not a result of cyberattacks. Nonetheless, the impact on consumers was significant as it caused widespread disruption of banking services by several major banks in Singapore.

The DIA is intended to complement the government’s other regulatory levers. It addresses issues and risks beyond cybersecurity to cover a broader range of resilience risks faced by digital infrastructure and service providers (e.g., misconfigurations in technical architecture, fires, water leaks, cooling system failures, etc.). The Taskforce has stated that it intends to draw inspiration from similar legislation from the European Union, Australia and Germany in drafting the DIA, so incident reporting requirements and requirements to comply with baseline resilience and security standards are to be expected.

The Taskforce is still in the process of identifying the entities that will be subject to the DIA and formulating the requirements that regulated entities will be subject to. This entails studying the ecosystem in Singapore to identify digital infrastructures that would systemically impact Singapore’s economy and society if disrupted. Examples provided in the press release by MCI on 1 March 2024 include data centers and cloud services, as well as services that support the delivery of many widely-used digital services (e.g., banking and payments, ride-hailing, and digital identities). Significantly, these digital services are outside the scope of the CS Act.

Separately, we flag that the MCI has also proposed amendments to the CS Act, which were released for public consultation earlier this year. As part of the amendments, the scope of the CS Act will be expanded beyond CII to regulate foundational digital infrastructure (e.g., cloud service providers and data centers) and key entities that hold sensitive data and perform important public functions. For more information, refer to our earlier client alert dated 14 March 2024. The DIA will be drafted to complement the amended CS Act.

* * * * *

We will continue to monitor these developments as details are released to assess how it may affect you. In particular, digital services providers that provide banking and payments, ride-hailing or digital identity services would be well advised to pay close attention to this space.

LOGO_Wong&Leow_Singapore

© 2024 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “principal” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.

Categories:
Author

Andy Leck is the head of the Intellectual Property and Technology (IPTech) Practice Group and a member of the Dispute Resolution Practice Group in Singapore. He is a core member of Baker McKenzie's regional IP practice and also leads the Myanmar IP Practice Group. Andy is recognised by reputable global industry and legal publications as a leader in his field. He was named on "The A-List: Singapore's Top 100 lawyers" by Asia Business Law Journal 2018. In addition, Chambers Asia Pacific notes that Andy is "a well-known IP practitioner who is highlighted for his record of handling major trade mark litigation, as well as commercial exploitation of IP rights in the media and technology sectors. He's been in the industry for a long time and has always been held in high regard. He is known to be very fair and is someone you would like to be in the trenches with you during negotiations." Furthermore, Asian Legal Business acknowledges Andy as a leading practitioner in his field and notes that he “always gives good, quick advice, [is] client-focused and has strong technical knowledge for his areas of practice.” Andy was appointed by the Intellectual Property Office of Singapore (IPOS) as an IP Adjudicator to hear disputes at IPOS for a two-year term from April 2021. He has been an appointed member of the Singapore Copyright Tribunal since May 2010 and a mediator with the WIPO Arbitration and Mediation Center. He is also appointed as a Notary Public & Commissioner for Oaths in Singapore. He previously served on the International Trademark Association’s Board of Directors and was a member of the executive committee.

Author

Ren Jun Lim is a principal with Baker McKenzie Wong & Leow. He represents local and international clients in both contentious and non-contentious intellectual property matters. He also advises on a full range of healthcare, as well as consumer goods-related legal and regulatory issues. Ren Jun co-leads Baker McKenzie Wong & Leow's Healthcare as well as Consumer Goods & Retail industry groups. He sits on the Law Society of Singapore IP Committee and on the Executive Committee of the Association of Information Security Professionals. He is also a member of the Vaccines Working Group, Singapore Association of Pharmaceutical Industries, a member of the International Trademark Association, as well as a member of the Regulatory Affairs Professionals Association. Ren Jun is ranked in the Silver tier for Individuals: Enforcement and Litigation and Individuals: Prosecution and Strategy, and a recommended lawyer for Individuals: Transactions by WTR 1000, 2020. He is also listed in Asia IP's Best 50 IP Expert, 2020, recognised as a Rising Star by Managing IP: IP Stars, 2019 and one of Singapore's 70 most influential lawyers aged 40 and under by Singapore Business Review, 2016. Ren Jun was acknowledged by WTR 1000 as a "trademark connoisseur who boasts supplementary knowledge of regulatory issues in the consumer products industry." He was also commended by clients for being "very responsive to enquiries and with a keen eye for detail, he is extremely hands-on. His meticulous and in-depth approach to strategising is key to the excellent outcomes we enjoy."

Author

Ken Chia is a member of the Firm’s IP Tech, International Commercial & Trade and Competition Practice Groups. He is regularly ranked as a leading TMT and competition lawyer by top legal directories, including Chambers Asia Pacific and Legal 500 Asia Pacific. Ken is an IAPP Certified International Privacy Professional (FIP, CIPP(A), CIPT, CIPM) and a fellow of the Chartered Institute of Arbitrators and the Singapore Institute of Arbitrators.

Related Posts