In brief
In light of COVID-19, the PDPC issued an advisory to guide organizations in the proper collection of personal data for purposes of contact tracing.
Contents
Recommended actions
- Organizations may use the PDPC-issued notice and display it prominently at the entrance of their premises.
- For purposes of contract tracing, organizations should ensure that only the necessary data, such as national IDs, NRIC, FIN and passport numbers are collected from visitors.
- Organizations should provide sufficient training to the frontliners of the premises (receptionist / security officers / building management officers) on how to properly collect and handle data.
Background
The Personal Data Protection Commissioner of Singapore (PDPC) recently issued an advisory, which states that the collection, use and disclosure of relevant personal data without consent is permissible during the pandemic for purposes of contract tracing, as this is necessary to respond to an emergency that threatens the life, health or safety of other individuals.
While organizations may require the presentation of national identification numbers to accurately identify individuals in the event of a COVID-19 case, organizations must comply with data protection requirements provided by the Personal Protection Act in relation to access, storage, modification and other processing of the data collected. These include: making reasonable security arrangements to protect the personal data in their possession from unauthorized access or disclosure, and ensuring that the personal data is not used for other purposes without consent or authorization under the law.
The PDPC also provided a sample notice in their website.
