Data Protection Enforcement in Singapore

Administrative Remedies

The Personal Data Protection Commission (PDPC) has the power to give such directions as it deems fit to ensure compliance, including directions to stop organizations from collecting, using or disclosing personal data or to destroy personal data collected in contravention of the Personal Data Protection Act (PDPA), destroy personal data collected in contravention of the PDPA, provide access to correct the personal data. The PDPC can also direct infringing organizations to pay a financial penalty of up to S$1 mil. The PDPC currently takes a complaints-based approach towards enforcement, and organizations are not required to proactively register with or seek approval from the PDPC in relation to their activities. Having said that, the PDPC is statutorily empowered to conduct investigations on its own accord to determine whether an organisation is complying with the PDPA. Directions issued by the PDPC are subject to applications for reconsideration and appeals.

Civil Remedies

Directions from the PDPC may be registered with and enforced by a District Court in Singapore. The PDPA also provides aggrieved individuals with the right of private action, allowing them to commence civil proceedings in respect of loss or damage suffered.

Criminal Remedies

Contravention of the data protection requirements in the PDPA will generally not amount to a criminal offence. However, the PDPA does provide for criminal penalties in respect of certain “obstruction-type” offences e.g. disposal of personal data to avoid access or correction requests, obstructing or impeding the PDPC in the performance of its duties or making a false statement to mislead the PDPC. Organizations or persons convicted of such offences are liable to fines ranging from S$5,000 to S$100,000 (depending on the offence and whether the offence is committed by an individual or organization). A failure to comply with obligations prescribed under the PDPA in relation to the Do-Not-Call (DNC) Registry constitutes a criminal offence. For example, a contravention of the requirement to check the DNC registry is punishable with a fine not exceeding S$10,000 (compoundable for a sum not exceeding S$1,000).

Other Remedies

Not applicable.

Selected Enforcement Actions / General Comments

There have been a few enforcement decisions in relation to violation of the DNC provisions at this point of time, one involving a real estate agent and the other by a tuition agency.