Preservation of secrecy
43.—(1)  Subject to subsections (3) and (7), every specified person must preserve, and aid in preserving, the secrecy of —
(a)all matters relating to a computer or computer system of any person;
(b)all matters relating to the business, commercial or official affairs of any person;
(c)all matters that have been identified as confidential under subsection (5); and
(d)all matters relating to the identity of persons furnishing information to any specified person,
that may come to the specified person’s knowledge in the performance of his or her functions or the discharge of his or her duties under this Act.
(2)  The specified person must not communicate any matter mentioned in subsection (1) to any person, except insofar as such communication —
(a)is necessary for the performance of any such function or the discharge of any such duty; or
(b)is lawfully required by any court, or lawfully required or allowed by or under this Act or any other written law.
(3)  This section does not apply to any information provided in compliance with a direction or requirement under section 23.
(4)  Any person who fails to comply with subsection (1) or (2) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 12 months or to both.
(5)  Any person, when furnishing any information to a specified person, may identify information that the person claims to be confidential information.
(6)  Every claim made under subsection (5) must be supported by a written statement giving reasons why the information is confidential.
(7)  Despite subsection (1), the Commissioner may disclose any information relating to any matter mentioned in subsection (1) in any of the following circumstances:
(a)where the written consent of the person to whom the information relates has been obtained;
(b)for the purposes of —
(i)a prosecution under this Act;
(ii)subject to subsection (8), enabling the Commissioner to give effect to any provision of this Act;
(iii)enabling the Commissioner to investigate a suspected offence under this Act or to enforce a provision of this Act;
(iv)disclosing to any police officer any information which discloses the commission of an offence under the Computer Misuse Act 1993; or
(v)complying with such provision of an agreement between Singapore and a country or territory outside Singapore (called in this section a foreign country) as may be prescribed, where the conditions specified in subsection (9) are satisfied.
(8)  If the Commissioner is considering whether to disclose any information under subsection (7)(b)(ii), the Commissioner must have regard to —
(a)the need to exclude, so far as is practicable, information the disclosure of which would in his or her opinion be contrary to the public interest;
(b)the need to exclude, so far as is practicable —
(i)commercial information the disclosure of which would, or might, in his or her opinion, significantly harm the legitimate business interests of the undertaking to which it relates; or
(ii)information relating to the private affairs of an individual the disclosure of which would, or might, in his or her opinion, significantly harm the individual’s interest; and
(c)the extent to which the disclosure is necessary for the purposes for which the Commissioner is proposing to make the disclosure.
(9)  The conditions mentioned in subsection (7)(b)(v) are —
(a)the information or documents requested by the foreign country are available to the Commissioner;
(b)unless the Government otherwise allows, the foreign country undertakes to keep the information or documents given confidential at all times; and
(c)the disclosure of the information or documents is not likely to be contrary to the public interest.
(10)  In this section, “specified person” means a person who is or has been —
(a)the Commissioner, the Deputy Commissioner, an Assistant Commissioner, a cybersecurity officer or a person appointed or employed to assist the Commissioner;
(b)an authorised officer appointed under section 6;
(c)a member of an Appeals Advisory Panel established under section 18;
(d)a cybersecurity technical expert appointed under section 22;
(e)an assistant licensing officer; or
(f)the Minister, or a person appointed or employed to assist the Minister.