PART 5 | CYBERSECURITY SERVICE PROVIDERS |
| No person to provide licensable cybersecurity service without licence |
24.—(1) Except under and in accordance with a cybersecurity service provider’s licence granted or renewed under section 26, no person —| (a) | may engage in the business of providing any licensable cybersecurity service to other persons; or | | (b) | being a person who is in the business of providing a licensable cybersecurity service, may advertise, or in any way hold out, that the person provides, or is willing to provide, the licensable cybersecurity service. |
| (2) Any person who contravenes subsection (1) shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $50,000 or to imprisonment for a term not exceeding 2 years or to both. |
| (3) Subsection (1) does not apply to the provision of a cybersecurity service by a company to its related company. |
| (4) In this section, “related company” has the same meaning given to it by section 6 of the Companies Act (Cap. 50). |
|
| Licensing officer and assistant licensing officers |
25.—(1) For the purposes of this Part, the Commissioner is the licensing officer and the officer responsible for the administration of this Part.| (2) The licensing officer may appoint such number of assistant licensing officers as are necessary to assist the licensing officer in carrying out the licensing officer’s functions and duties under this Part. |
| (3) Only public officers may be appointed as assistant licensing officers. |
| (4) The functions and duties conferred on the licensing officer by this Part may be performed by any assistant licensing officer and such performance is subject to the direction and control of the licensing officer. |
| (5) The Minister may from time to time give to the licensing officer such directions, not inconsistent with the provisions of this Part, as the Minister may consider necessary for carrying out the provisions of this Part, and the licensing officer must comply with any direction so given. |
|
| Grant and renewal of licence |
26.—(1) An application for the grant or renewal of a licence must be —| (a) | made to the licensing officer in such form or manner as may be prescribed; | | (b) | accompanied by the prescribed fee, if any; and | | (c) | in the case of an application for the renewal of a licence, made not later than one month or such other period before the expiry of the licence (called in this section the renewal period) as may be prescribed. |
| (2) An applicant for the grant or renewal of a licence must, at the request of the licensing officer, provide such further information or evidence that the licensing officer may require to decide the application. |
(3) Upon receipt of an application under subsection (1), the licensing officer may —| (a) | grant or renew the licence applied for; or | | (b) | refuse the application. |
|
(4) Subject to the provisions of this Act, an applicant of an application under subsection (1) is eligible for the grant or renewal of the licence if, and only if —| (a) | the applicant has paid the prescribed fee (if any); and | | (b) | the applicant satisfies such other requirements as may be prescribed for such grant or renewal. |
|
(5) Without prejudice to subsection (4), the licensing officer may refuse to grant a licence to a person or renew the licence of a person if, in the opinion of the licensing officer —| (a) | where the person is an individual, the individual is not a fit and proper person to hold or to continue to hold the licence; | | (b) | where the person is a business entity, the business entity is not a fit and proper person to hold or to continue to hold the licence; or | | (c) | it is not in the public interest to grant or renew the licence, or the grant or renewal of the licence may pose a threat to national security. |
|
| (6) Where a person submits an application for the renewal of the person’s licence before the start of the renewal period, the licence continues in force until the date on which the licence is renewed or the application for its renewal is refused, as the case may be. |
(7) Any person who, in making an application for the grant or renewal of a licence —| (a) | makes any statement or furnishes any particulars, information or document which the person knows to be false or does not believe to be true; or | | (b) | furnishes any information which the person knows or has reason to believe is misleading in a material particular, |
| shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 12 months or to both. |
|
(8) In deciding for the purposes of this section whether an individual or a business entity is a fit and proper person to hold or continue to hold a licence, the licensing officer may take into account any matter the licensing officer considers relevant, including any of the following:| (a) | in the case of an individual —| (i) | that the individual has been convicted in Singapore or elsewhere of any offence involving fraud, dishonesty or moral turpitude; | | (ii) | that the individual has had a judgment entered against the individual in civil proceedings that involves a finding of fraud, dishonesty or breach of fiduciary duty on the part of the individual; | | (iii) | that the individual is or was suffering from a mental disorder; | | (iv) | that the individual is an undischarged bankrupt or has entered into a composition with the creditors of the individual; or | | (v) | that the individual has had a licence revoked by the licensing officer previously; |
| | (b) | in the case of a business entity —| (i) | that the business entity has been convicted in Singapore or elsewhere of any offence involving fraud, dishonesty or moral turpitude; | | (ii) | that the business entity has had a judgment entered against the business entity in civil proceedings that involves a finding of fraud, dishonesty or breach of fiduciary duty on the part of the business entity; | | (iii) | that any officer of the business entity is not a fit and proper person to be an officer of a business entity holding the licence; | | (iv) | that the business entity is in liquidation or is the subject of a winding up order, or there is a receiver appointed in relation to the business entity, or the business entity has entered into a composition or scheme of arrangement with the creditors of the business entity; or | | (v) | that the business entity has had a licence revoked by the licensing officer previously. |
|
|
| (9) In deciding, for the purposes of subsection (8)(b)(iii), whether an officer of a business entity is a fit and proper person to be an officer of a business entity holding a licence, the licensing officer may take into account any matter the licensing officer considers relevant, including any of the matters in subsection (8)(a)(i) to (v) with each reference to the individual substituted with a reference to the officer. |
| (10) In this section, “officer of a business entity” means any director or partner of the business entity or other person who is responsible for the management of the business entity. |
|
27.—(1) The licensing officer may grant a licence to an applicant, or renew an applicant’s licence, subject to such conditions as the licensing officer thinks fit to impose.(2) For the purpose of subsection (1), the licensing officer may specify —| (a) | conditions applicable to all licensees; | | (b) | conditions applicable to a specified class of licensees; or | | (c) | conditions applicable to a specified licensee only. |
|
| (3) The licensing officer may at any time add to, modify or revoke any condition of a licence imposed under subsection (1). |
(4) Before making any modification to the conditions of a licence, the licensing officer must give notice to the licensee concerned —| (a) | stating that the licensing officer proposes to make the modification in the manner specified in the notice; and | | (b) | specifying the time (being not less than 14 days after the date of service of the notice) within which written representations with respect to the proposed modification may be made. |
|
(5) Upon receipt of any written representation mentioned in subsection (4)(b), the licensing officer must consider the representation and may —| (a) | reject the representation; or | | (b) | withdraw or amend the proposed modification whether in accordance with the representation or otherwise, |
| and, in either case (except where the proposed modification is withdrawn), must issue a direction in writing to the licensee concerned requiring that effect be given within a reasonable time to the proposed modification specified in the notice or to such modification as amended. |
|
|
| Form and validity of licence |
28.—(1) A licence must —| (a) | be in such form as the licensing officer may determine; and | | (b) | contain the conditions subject to which it is granted. |
| (2) A licence is in force for such period (not exceeding 5 years) as the licensing officer may specify in the licence, starting from the date of its issue. |
| (3) A licence that is renewed continues in force for such period (not exceeding 5 years) as the licensing officer may specify in writing to the licensee, starting from the date immediately following that on which (but for its renewal) the licence would have expired. |
|
29.—(1) A licensee must —| (a) | in relation to each occasion on which the licensee is engaged to provide its cybersecurity service, keep a record of the following information:| (i) | the name and address of the person engaging the licensee for the service; | | (ii) | the name of the person providing the service on behalf of the licensee; | | (iii) | the date on which the service is provided; | | (iv) | details of the type of service provided; | | (v) | such other particulars as may be prescribed; and |
| | (b) | retain every such record for a period of not less than 3 years after the date of the occasion to which the record relates. |
| (2) Every licensee must furnish to the licensing officer such records at such time, in such format and through such medium (whether electronic or otherwise) as the licensing officer may require. |
(3) If a licensee —| (a) | knowingly makes a record that —| (i) | is false or misleading; or | | (ii) | omits any matter or thing without which the record is misleading; and |
| | (b) | furnishes the record to the licensing officer following a requirement under subsection (2), |
| the licensee shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $10,000 or to imprisonment for a term not exceeding 12 months or to both. |
|
| (4) Subsection (3) does not apply if the record is not false or misleading in a material particular. |
|
| Revocation or suspension of licence |
30.—(1) Subject to subsection (4), the licensing officer may by order revoke any licence if the licensing officer is satisfied that —| (a) | the licensee has failed to comply with any condition to which the licence is subject; | | (b) | the licence had been obtained by fraud or misrepresentation; | | (c) | a circumstance existed at the time the licence was granted or renewed that the licensing officer was unaware of, which would have required or permitted the licensing officer to refuse to grant or renew the licensee’s licence if the licensing officer had been aware of the circumstance at that time; | | (d) | the licensee has ceased to carry on in Singapore the business for which the licensee is licensed; | | (e) | the licensee has been declared bankrupt or has gone into compulsory or voluntary liquidation other than for the purpose of amalgamation or reconstruction; | | (f) | the licensee has been convicted of an offence under this Act, or an offence involving fraud, dishonesty or moral turpitude; | | (g) | the licensee is no longer a fit and proper person to continue to hold the licence; or | | (h) | it is undesirable in the public interest for the licensee to continue to carry on the business of a licensee. |
(2) Subject to subsection (4), the licensing officer may, in any case in which the licensing officer considers that no cause of sufficient gravity for revoking any licence exists, by order —| (a) | suspend the licence for a period not exceeding 6 months; | | (b) | censure the licensee concerned; or | | (c) | impose such other conditions as the licensing officer considers appropriate. |
|
(3) The licensing officer must give the licensee written notice of —| (a) | the licensing officer’s intention to exercise any power under subsection (1) or (2); and | | (b) | the date on which the licensing officer intends to exercise the power. |
|
| (4) The licensing officer must not, during a period of 14 days after the licensing officer informs the licensee of such intention, exercise any power under subsection (1) or (2) unless the licensee concerned is given an opportunity to be heard, whether in person or by a representative and whether in writing or otherwise. |
| (5) Where the licensing officer has by order revoked a licence under subsection (1) or made any order under subsection (2) in respect of a licensee, the licensing officer must serve on the licensee concerned a notice of the order. |
(6) An order under subsection (1) or (2) by the licensing officer revoking or suspending a licence —| (a) | takes effect immediately upon service of the notice of the order under subsection (5), in a case where the licensing officer states in the order that it is undesirable in the public interest for the licensee to continue to carry on the licensee’s business as a licensee; and | | (b) | in any other case, takes effect at the end of 14 days after the service of the notice of the order on the licensee under subsection (5). |
|
| (7) In any proceedings under this section consequent upon the conviction of a licensee for a criminal offence, the licensing officer must accept the licensee’s conviction as final and conclusive. |
| (8) In deciding for the purposes of this section whether a licensee is a fit and proper person to continue to hold a licence, the licensing officer may take into account any matter the licensing officer considers relevant, including any matter mentioned in section 26(8). |
|
| Unlicensed cybersecurity service provider not to recover fees, etc. |
| 31. Any person who provides any licensable cybersecurity service is not entitled to bring any proceeding in any court to recover any commission, fee, gain or reward for the service provided unless, at the time of providing the service, the person is the holder of a valid cybersecurity service provider’s licence. |
32.—(1) This section applies where a licensee —| (a) | contravenes a provision of this Part, which contravention is not an offence; or | | (b) | fails to comply with any condition imposed by the licensing officer on the licence. |
| (2) On the occurrence of a contravention or failure to comply mentioned in subsection (1), the licensing officer may, in addition to or instead of taking any action under section 30(1) or (2), order the licensee to pay a financial penalty of an amount not exceeding $10,000 for each contravention or failure to comply, but not exceeding in the aggregate $50,000. |
| (3) The order mentioned in subsection (2) must specify the date by which the financial penalty is to be paid. |
|
| Licensing officer to give opportunity to make representations before ordering financial penalty |
33.—(1) Subsections (2) to (6) apply before the licensing officer makes an order under section 32(2).(2) The licensing officer must give the licensee written notice of —| (a) | the licensing officer’s intention to make the order under section 32(2); and | | (b) | the date on which the licensing officer intends to make the order. |
|
| (3) The date mentioned in subsection (2)(b) must not be earlier than 21 days after the date of the written notice in subsection (2). |
| (4) The licensee may make representations to the licensing officer at any time before the date mentioned in subsection (2)(b). |
| (5) The licensing officer must consider any representation made by the licensee before the date mentioned in subsection (2)(b). |
| (6) The licensing officer must, on or after the date mentioned in subsection (2)(b), give the licensee written notice of the licensing officer’s final decision. |
|
| Recovery of financial penalties |
34.—(1) Any person who fails to pay any financial penalty imposed by the licensing officer by the date specified in the order under section 32(2) or where there is an appeal to the Minister, by the date specified by the Minister, is liable to pay to the licensing officer interest on the amount unpaid at the same rate as for a judgment debt.| (2) Any financial penalty payable pursuant to an order under section 32(2), and any interest under subsection (1), is recoverable by the licensing officer, or any person duly authorised by the licensing officer to act on his or her behalf, as a debt due to the Government. |
| (3) The licensing officer may, in any case in which the licensing officer thinks fit, waive, remit or refund in whole or in part any financial penalty imposed or any interest due on any financial penalty. |
| (4) Any financial penalty and any interest on any financial penalty collected under this section must be paid into the Consolidated Fund. |
| (5) In any proceedings for the recovery of any financial penalty or interest due on any financial penalty which any person is liable to pay, a certificate purporting to be under the hand of the licensing officer certifying the amount of the financial penalty or interest due on the financial penalty that is payable by the person is prima facie evidence of the facts stated in the certificate. |
|
35.—(1) Any person whose application for a licence or for the renewal of a licence has been refused by the licensing officer may, within the relevant period after being notified of such refusal, appeal against the refusal in the prescribed manner to the Minister.| (2) Where a licence is granted or renewed by the licensing officer subject to conditions or where any condition is added or modified under section 27(3), the licensee concerned may, within the relevant period after being notified of such conditions, addition or modification, appeal against the conditions in the prescribed manner to the Minister. |
| (3) If the licensing officer has made any order under section 30(1) or (2) in respect of any licensee, the licensee may, within the relevant period after being served with the notice of the order, appeal against the order in the prescribed manner to the Minister. |
| (4) Any person aggrieved by the licensing officer’s order under section 32(2) may, within the relevant period after being notified of the order, appeal against the order in the prescribed manner to the Minister. |
| (5) In any appeal under this section against an order of the licensing officer made consequent upon the conviction of the licensee for a criminal offence, the Minister must accept the licensee’s conviction as final and conclusive. |
| (6) An appeal under this section against a decision of the licensing officer (except an order mentioned in section 30(6)(b) or 32(2)) does not affect the effect of the decision appealed against or prevent the taking of action to implement the decision and the decision appealed against must be complied with until the determination of the appeal. |
| (7) The decision of the Minister on an appeal under this section is final. |
| (8) In this section, “relevant period” means 14 days or such longer period as the Minister allows in a particular case, whether allowed before or after the end of the 14 days. |
|
|
