Personal Data Protection Act 2012 - Singapore Statutes Online

Unauthorised re-identification of anonymised information

48F.—(1) If —

(a)

an individual takes any action to re-identify or cause re-identification of the person to whom anonymised information in the possession or under the control of an organisation or a public agency relates (called in this section the affected person);

(b)

the re-identification is not authorised by the organisation or public agency, as the case may be; and

(c)

the individual does so —

(i)	knowing that the re-identification is not authorised by the organisation or public agency, as the case may be; or
(ii)	reckless as to whether the re-identification is or is not authorised by the organisation or public agency, as the case may be,

the individual shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 2 years or to both.

(2) In proceedings for an offence under subsection (1), it is a defence to the charge for the accused to prove, on a balance of probabilities, any of the following:

(a)

that —

(i)	the information on the identity of the affected person is publicly available; and
(ii)	where that information was publicly available solely because of an applicable contravention, the accused did not know, and was not reckless as to whether, that was the case;

(b)

the action to re-identify or cause re-identification is —

(i)	permitted or required by or under an Act or other law (apart from this Act); or
(ii)	authorised or required by an order of court;

(c)

the accused —

(i)	reasonably believed that the re-identification was for a specified purpose; and
(ii)	notified the Commission or the organisation or public agency (as the case may be) of the re-identification as soon as was practicable;

(d)

the accused took the action to re-identify or cause re-identification in the reasonable belief that, and was not reckless as to whether, the accused had the legal right to do so, other than for a specified purpose;

(e)

in any other circumstances, or for any other purpose, prescribed.

(3) To avoid doubt, subsection (2) does not affect any obligation or limitation imposed on, or prohibition of, the re-identification of the affected person by or under any other written law or other law.

(4) In this section —

“applicable contravention” means a contravention of any of the following:

(a)	subsection (1);
(b)	section 8(1) of the Public Sector (Governance) Act 2018;
(c)	section 14C(1) of the Monetary Authority of Singapore Act;

“specified purpose” means any purpose specified in the Eleventh Schedule.

[Act 40 of 2020 wef 01/02/2021]

Search within Legislation