On January 10, 2022, the Singapore Ministry of Communications and Information (MCI) responded to a parliamentary question regarding the number of cases of unauthorized sales of consumer personal data that have been investigated over the past five years, and how many of these cases have been successfully prosecuted by the Personal Data Protection Commission (PDPC).
Over the past five years, the PDPC has investigated three cases of alleged data breaches involving unauthorized sales of personal data.
Two companies have been found guilty of breaching the Personal Data Protection Act 2012 (No 26 of 2012) for failing to notify and obtain consent from individuals before selling personal data to third parties at telemarketing purposes, and were fined SGD48,000 (approximately US$35,703) and SGD6,000 (approximately US$4,462) respectively. In addition to being fined, the two companies were also told to cease their actions and rectify their data protection practices.
In conclusion, MCI stated that the PDPC takes a strong stance against the unauthorized sale of personal data to protect against harm to the public, including identity theft and spam calls.
Organizations purchasing contact lists must exercise due diligence to ensure that the sale of personal data is authorized, and that the data is sufficiently accurate and up-to-date for their purposes, or be prepared to face the consequences .
* * * * *
© 2022 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is a privately held company and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. Consistent with common terminology used in professional services organizations, reference to a “principal” means a person who is a partner, or equivalent, in such law firm. Similarly, reference to an “office” means an office of such law firm. This may qualify as “lawyer advertising” requiring notice in some jurisdictions. Previous results do not guarantee a similar result.