Personal Data Protection Act 2012 - Singapore Statutes Online

FIRST SCHEDULE

Section 17(1) and Fifth and Twelfth Schedules

Collection, use and disclosure of
personal data without consent

Part 1

VITAL INTERESTS OF INDIVIDUALS

1.—(1) Subject to sub‑paragraph (2), the collection, use or disclosure (as the case may be) of personal data about an individual is necessary for any purpose which is clearly in the individual’s interests, and —

(a)	consent for the collection, use or disclosure (as the case may be) cannot be obtained in a timely way; or
(b)	the individual would not reasonably be expected to withhold consent.

(2) Where the organisation collects, uses or discloses (as the case may be) personal data about the individual under sub‑paragraph (1), the organisation must, as soon as is practicable, notify the individual of the collection, use or disclosure (as the case may be) and the purpose for the collection, use or disclosure, as the case may be.

2. The collection, use or disclosure (as the case may be) of personal data about an individual is necessary to respond to an emergency that threatens the life, health or safety of the individual or another individual.

3. The collection, use or disclosure (as the case may be) of personal data about an individual, where —

(a)	consent for the collection, use or disclosure (as the case may be) cannot be obtained in a timely way; and
(b)	there are reasonable grounds to believe that the health or safety of the individual or another individual will be seriously affected.

4. The collection, use or disclosure of personal data is for the purpose of contacting the next‑of‑kin or a friend of any injured, ill or deceased individual.

Part 2

MATTERS AFFECTING PUBLIC

1. The collection, use or disclosure (as the case may be) of personal data about an individual that is publicly available.

2. The collection, use or disclosure (as the case may be) of personal data about an individual is in the national interest.

3. The collection, use or disclosure (as the case may be) of personal data about an individual is solely for artistic or literary purposes.

4. The collection, use or disclosure (as the case may be) of personal data about an individual is solely for archival or historical purposes, if a reasonable person would not consider the personal data to be too sensitive to the individual to be collected, used or disclosed (as the case may be) at the proposed time.

5. The personal data about an individual is collected, used or disclosed (as the case may be) by a news organisation solely for its news activity.

6. In this Part —

“broadcasting service” has the meaning given by section 2(1) of the Broadcasting Act 1994;

“news activity” means —

(a)

the gathering of news, or the preparation or compilation of articles or programmes of or concerning news, observations on news, or current affairs, for the purposes of dissemination to the public or any section of the public; or

(b)

the dissemination, to the public or any section of the public, of any article or programme of or concerning —

(i)	news;
(ii)	observations on news; or
(iii)	current affairs;

“news organisation” means —

(a)

any organisation —

(i)	the business of which consists, in whole or in part, of news activity carried out in relation to a relevant broadcasting service, a newswire service or the publication of a newspaper; and
(ii)	which, if the organisation publishes a newspaper in Singapore which is not exempted from the provisions of Part 3 of the Newspaper and Printing Presses Act 1974, is a newspaper company defined in section 2(1) of that Act; or

(b)

any organisation which provides a broadcasting service in or from Singapore and holds a broadcasting licence granted under section 8 of the Broadcasting Act 1994;

“newspaper” has the meaning given by section 2(1) of the Newspaper and Printing Presses Act 1974;

“relevant broadcasting service” means any of the following licensable broadcasting services within the meaning of the Broadcasting Act 1994:

(a)	free‑to‑air nationwide television services;
(b)	free‑to‑air localised television services;
(c)	free‑to‑air international television services;
(d)	subscription nationwide television services;
(e)	subscription localised television services;
(f)	subscription international television services;
(g)	special interest television services;
(h)	free‑to‑air nationwide radio services;
(i)	free‑to‑air localised radio services;
(j)	free‑to‑air international radio services;
(k)	subscription nationwide radio services;
(l)	subscription localised radio services;
(m)	subscription international radio services;
(n)	special interest radio services.

Part 3

LEGITIMATE INTERESTS

1.—(1) Subject to sub‑paragraphs (2), (3) and (4) —

(a)	the collection, use or disclosure (as the case may be) of personal data about an individual is in the legitimate interests of the organisation or another person; and
(b)	the legitimate interests of the organisation or other person outweigh any adverse effect on the individual.

(2) For the purposes of sub‑paragraph (1), the organisation must —

(a)	conduct an assessment, before collecting, using or disclosing the personal data (as the case may be), to determine whether sub‑paragraph (1) is satisfied; and
(b)	provide the individual with reasonable access to information about the organisation’s collection, use or disclosure of personal data (as the case may be) in accordance with sub‑paragraph (1).

(3) The organisation must, in respect of the assessment mentioned in sub‑paragraph (2)(a) —

(a)

identify any adverse effect that the proposed collection, use or disclosure (as the case may be) of personal data about an individual is likely to have on the individual;

(b)

identify and implement reasonable measures —

(i)	to eliminate the adverse effect;
(ii)	to reduce the likelihood that the adverse effect will occur; or
(iii)	to mitigate the adverse effect; and

(c)

comply with any other prescribed requirements.

(4) Sub‑paragraph (1) does not apply to the collection, use or disclosure of personal data about an individual for the purpose of sending to that individual or any other individual a message for an applicable purpose within the meaning given by section 37(6).

2. The collection, use or disclosure (as the case may be) of personal data about an individual is necessary for evaluative purposes.

3. The collection, use or disclosure (as the case may be) of personal data about an individual is necessary for any investigation or proceedings.

4. The collection, use or disclosure (as the case may be) of personal data about an individual is necessary for the organisation —

(a)	to recover a debt owed by the individual to the organisation; or
(b)	to pay to the individual a debt owed by the organisation.

5. The collection, use or disclosure (as the case may be) of personal data about an individual is necessary for the provision of legal services by the organisation to another person, or for the organisation to obtain legal services.

6.—(1) Subject to sub‑paragraph (2), the collection, use or disclosure (as the case may be) of personal data about an individual —

(a)	is for the purpose of the preparation by a credit bureau of a credit report; or
(b)	relates to a credit report provided by a credit bureau to a member of the credit bureau in relation to a transaction between the member and the individual.

(2) Sub‑paragraph (1) does not apply to a credit bureau that, being required to obtain a licence under any other written law, does not hold such a licence.

7. The collection, use or disclosure (as the case may be) of personal data about an individual is to —

(a)	confer an interest or a benefit on the individual under a private trust or benefit plan; and
(b)	administer that trust or benefit plan, at the request of the settlor or the person establishing the benefit plan, as the case may be.

8. The personal data about an individual —

(a)	is provided to the organisation by another individual to enable the organisation to provide a service for the personal or domestic purposes of that other individual; and
(b)	is collected, used or disclosed (as the case may be) by the organisation solely for the purpose in sub‑paragraph (a).

9. The personal data about an individual —

(a)	is included in a document produced in the course, and for the purposes, of the individual’s employment, business or profession; and
(b)	is collected, used or disclosed (as the case may be) for purposes consistent with the purpose for which the document was produced.

10. The personal data about an individual is collected, used or disclosed (as the case may be) by the organisation, and the collection, use or disclosure (as the case may be) of the personal data is reasonable for the purpose of or in relation to the organisation —

(a)	entering into an employment relationship with the individual or appointing the individual to any office; or
(b)	managing or terminating the employment relationship with or appointment of the individual.

Part 4

BUSINESS ASSET TRANSACTIONS

1.—(1) Subject to the conditions in sub‑paragraphs (2), (3), (4) and (5), where an organisation (X) is a party or a prospective party to a business asset transaction with another organisation (Y), personal data about an applicable individual of Y —

(a)	is collected from Y by X for the purposes of the business asset transaction;
(b)	is used or disclosed by X in relation to the business asset transaction; or
(c)	is disclosed by Y to X for the purposes of the business transaction.

(2) Where the business asset transaction concerns any part of Y or Y’s business assets, the personal data mentioned in sub‑paragraph (1) must relate directly to that part of Y or Y’s business assets, as the case may be.

(3) If X is a prospective party to the business asset transaction, the following conditions apply:

(a)	X may collect, and Y may disclose, only personal data that is necessary for X to determine whether to proceed with the business asset transaction;
(b)	X and Y must have entered into an agreement that requires X to use or disclose the personal data solely for purposes related to the business asset transaction.

(4) If X enters into the business asset transaction, the following conditions apply:

(a)

X may use or disclose the personal data X collected from Y only for the same purposes for which Y would have been permitted to use or disclose the personal data;

(b)

if any personal data X collects from Y does not relate directly to the part of Y or Y’s business assets with which the business asset transaction entered into is concerned, X must destroy, or return to Y, that personal data;

(c)

X or Y must notify the applicable individuals of Y whose personal data is disclosed that —

(i)	the business asset transaction has taken place; and
(ii)	the personal data about them has been disclosed to X.

(5) If the business asset transaction does not proceed or is not completed, X must destroy, or return to Y, all personal data collected.

2.—(1) Subject to the conditions in sub‑paragraphs (2), (3) and (4), where an organisation (X) is a party or a prospective party to a business asset transaction with another organisation (Y) in respect of Y’s interest in a third organisation (Z) (called in this paragraph the relevant transaction), personal data about an applicable individual of Z —

(a)	is collected from Y or Z by X, or from Z by Y, for the purposes of the relevant transaction;
(b)	is used or disclosed by X or Y in relation to the relevant transaction; or
(c)	is disclosed by Y or Z (as the case may be) to X, or by Z to Y, for the purposes of the relevant transaction.

(2) If X is a prospective party to the relevant transaction, the following conditions apply:

(a)

where X collects the personal data mentioned in sub‑paragraph (1) from Y or Z —

(i)	X may collect, and Y or Z (as the case may be) may disclose, only personal data that is necessary for X to determine whether to proceed with the relevant transaction; and
(ii)	X and Y or Z (as the case may be) must have entered into an agreement that requires X to use or disclose the personal data solely for purposes related to the relevant transaction;

(b)

where Y collects the personal data mentioned in sub‑paragraph (1) from Z —

(i)	Y may collect, and Z may disclose, only personal data that is necessary for X or Y (as the case may be) to determine whether to proceed with the relevant transaction; and
(ii)	Y and Z must have entered into an agreement that requires Y to use or disclose the personal data solely for purposes related to the relevant transaction.

(3) If X enters into the relevant transaction, the following conditions apply:

(a)

X may use or disclose the personal data collected from Y or Z (as the case may be) only for the same purposes for which Y or Z (as the case may be) would have been permitted to use or disclose the personal data;

(b)

Y may use or disclose the personal data collected from Z only for the same purposes for which Z would have been permitted to use or disclose the personal data;

(c)

X, Y or Z must notify the applicable individuals of Z whose personal data is disclosed that —

(i)	the relevant transaction has taken place; and
(ii)	the personal data about them has been disclosed to X.

(4) If the relevant transaction does not proceed or is not completed —

(a)	X must destroy, or return to Y or Z (as the case may be), all personal data collected; and
(b)	Y must destroy, or return to Z, all personal data collected.

3. In this Part —

“applicable individual”, in relation to an organisation, includes a contractor, a customer, a director, an employee, an officer or a shareholder of the organisation;

“business asset transaction” —

(a)

means the purchase, sale, lease, merger or amalgamation or any other acquisition, disposal or financing of —

(i)	an organisation or a portion of an organisation;
(ii)	an interest in an organisation; or
(iii)	any of the business or assets of an organisation, other than any personal data to be disclosed under paragraph 1(1) or 2(1), as the case may be; and

(b)

includes —

(i)	the amalgamation of a corporation with one or more related corporations; and
(ii)	the transfer or disposal of any of the business or assets of a corporation to a related corporation;

“business trust” has the meaning given by section 2 of the Business Trusts Act 2004;

“corporation” and “related corporation” have the meanings given by section 4(1) of the Companies Act 1967;

“interest” means —

(a)	in relation to a corporation — a share in that corporation;
(b)	in relation to an entity other than a corporation — any right or interest (whether legal or equitable) in that entity, by whatever name called;
(c)	in relation to a business trust — a unit in that business trust; and
(d)	in relation to a trust other than a business trust — any right or interest (whether legal or equitable) in that trust, by whatever name called.

Part 5

BUSINESS IMPROVEMENT PURPOSES

1.—(1) Subject to the conditions in sub‑paragraphs (3), (4) and (5), personal data about an individual (P) —

(a)	is collected by an organisation (X) that is a corporation from a related corporation (Y) for a purpose specified in sub‑paragraph (2) (called the relevant purpose);
(b)	is used by X for a relevant purpose; or
(c)	is disclosed by Y to X for a relevant purpose.

(2) The relevant purposes mentioned in sub‑paragraph (1) are the following:

(a)	improving or enhancing any goods or services provided, or developing new goods or services to be provided, by X or Y;
(b)	improving or enhancing the methods or processes, or developing new methods or processes, for the operations of X or Y;
(c)	learning about and understanding the behaviour and preferences of P or another individual in relation to the goods or services provided by X or Y;
(d)	identifying any goods or services provided by X or Y that may be suitable for P or another individual, or personalising or customising any such goods or services for P or another individual.

(3) Sub‑paragraph (1)(a) and (c) applies only if —

(a)	the relevant purpose for which X collects, or Y discloses, personal data about P cannot reasonably be achieved without the collection, use or disclosure (as the case may be) of the personal data in an individually identifiable form;
(b)	a reasonable person would consider the collection or disclosure of personal data about P for the relevant purpose to be appropriate in the circumstances; and
(c)	X and Y are bound by any contract or other agreement or binding corporate rules requiring the recipient of personal data about P to implement and maintain appropriate safeguards for the personal data.

(4) Sub‑paragraph (1)(b) applies only if —

(a)	the relevant purpose for which X uses personal data about P cannot reasonably be achieved without the use of the personal data in an individually identifiable form; and
(b)	a reasonable person would consider the use of personal data about P for the relevant purpose to be appropriate in the circumstances.

(5) Where X collects from Y, and Y discloses to X, personal data about P for a purpose mentioned in sub‑paragraph (2)(c) or (d), P must be, at the time of the collection or disclosure, as the case may be —

(a)	an existing customer of Y; and
(b)	an existing customer or a prospective customer of X.

(6) To avoid doubt, sub‑paragraph (1) does not apply to the collection, use or disclosure of personal data about P for the purpose of sending to P or another individual a message for an applicable purpose within the meaning given by section 37(6).

2. In this Part —

“corporation” and “related corporation” have the meanings given by section 4(1) of the Companies Act 1967;

“existing customer”, in relation to a corporation, means an individual who purchases, hires or uses, or has purchased, hired or used, any goods or services provided by the corporation;

“prospective customer of X” means an individual who, at the time mentioned in paragraph 1(5) —

(a)	has informed X of the individual’s interest in purchasing, hiring or using any goods or services provided by X; or
(b)	is conducting negotiations with X that lead or may lead to an agreement between the individual and X for the purchase, hire or use of any goods or services provided by X. [40/2020]

Search within Legislation