Singapore Weighs Data Portability and Breach Notification Updates to Its Privacy Law

Singapore's data privacy regulators suggested in early 2019 that the country's privacy law needed two additions: a requirement to notify people of data breaches, and a right for residents to move their data between providers. Malwarebytes Labs examined the proposals and what lies behind them.

Both measures are common in privacy laws elsewhere, above all in the European Union's General Data Protection Regulation (GDPR), the wide-ranging set of protections that took effect two years before the analysis was written. If Singapore adopts them, it will join a long list of countries that have brought their own privacy rules into line with GDPR.

The incentive is plain. A country whose law closely tracks GDPR stands a better chance of receiving an "adequacy determination" from the European Commission, which allows data to be transferred legally between that country and the EU.

D. Reed Freeman Jr., co-chair of the cybersecurity and privacy practice at the Washington, D.C. law firm Wilmer Cutler Pickering Hale and Dorr, told Malwarebytes Labs that such a transfer regime is essential to taking part in the modern economy. Seen that way, moving towards GDPR is as much an economic choice as a question of privacy rights. "The world's economy depends on data flows, and the more restrictive the data flows are, the better," Freeman said, adding that multinational organisations in Singapore would like to have an adequacy determination.

What the PDPA already covers

Singapore passed its Personal Data Protection Act (PDPA) on October 15, 2012, setting rules for how personal data is collected, used and disclosed. The Act also set up a national "Do Not Call" register and created the Personal Data Protection Commission (PDPC), the country's main data protection authority.

The PDPC has spent years issuing warnings to organisations that break the law and publishing its decisions for anyone to read. It is also the body behind the current effort to update the Act.

Singaporeans already have some of the same rights as people in the EU, and even in California. They can ask an organisation to hand over the personal data it holds about them, and they can have that data corrected if they find mistakes or gaps. The law also limits how organisations collect, use and disclose Singaporeans' personal data.

Under the PDPA, organisations need consent before collecting, using or disclosing personal data. They are bound by purpose limitations too: they may handle a person's data only for purposes a reasonable person would find appropriate in the circumstances and, where applicable, that the individual has been told about. Organisations must tell people in advance how their data will be collected, used and disclosed, and the data they hold must be accurate.

Any personal data an organisation holds must be protected with "reasonable security arrangements" against unauthorised access, collection, use, disclosure, copying, modification, disposal and similar risks. Once the purpose for which the data was collected has ended, the organisation must either stop keeping documents that contain it or remove whatever links the data to specific individuals.

These rules resemble GDPR, but there are differences, consent being one of them. Under the PDPA, no consent is needed to collect personal data that is publicly available, that is required for broadly defined "evaluative purposes", or that is gathered only for "artistic or literary purposes". EU law has no equivalent exceptions. The other two gaps are the ones the proposals target: Singapore's law has neither data portability nor breach notification.

The two proposed additions

On February 25, 2019, the PDPC published a discussion paper setting out the benefits of adding data portability to the PDPA. In a press release, the commission said that letting users authorise the movement of their personal data between organisations could increase data flows and support more data sharing in the digital economy, within sectors and across them.

A portability right lets a person ask an organisation for their personal data in a format that can be moved to another provider and used there straight away. Malwarebytes Labs likened it to taking email contacts from one provider to another, only on a far bigger scale and possibly with less benefit, since old Facebook status updates from 2008 are of little use on Twitter today.

Less than a week after the discussion paper came out, the PDPC announced plans to make breach notification mandatory. Under its proposal, organisations whose breach could harm individuals would have to inform both those individuals and the PDPC. Where a breach posed no likely harm but affected the personal data of more than 500 people, the PDPC would still have to be told.

After public consultation, the portability requirement was received well.

Why Singapore is moving now

Bringing national law closer to GDPR is not new, and several countries are doing it at the same time. Singapore's timing, though, may be traced to another GDPR development in early January 2019, when the European Commission granted Japan an adequacy determination.

Freeman thinks Singapore probably looked at Japan and wanted the same outcome. Singapore competes in Asian and global markets, he said, and he suspects its leaders saw what happened in Japan, asked the right people at the Commission what it would take, and were told that bringing the PDPA close to GDPR would give them a good chance.

In recent practice, Freeman explained, adequacy has turned on whether a country's law is similar to GDPR. Over time, he said, "adequacy" has come to be understood informally as something close to "equivalent".

The stakes are high, in his account. Under GDPR, a multinational that wants to move data between its home country and the EU needs an adequacy determination; without one, there is no lawful way to take part in that part of the world economy. A company with staff and customers in Europe that wants to store their data at its head office in Singapore needs a legal basis for doing so, and adequacy provides it. Freeman added that an adequacy determination is much harder to reverse than a bilateral arrangement such as the one between the EU and the United States that the Court of Justice of the European Union struck down.

Borrowing what already works

Singapore has not set a timetable for finalising the portability right and the breach notification rule. It has also not said what the regulations will look like, how long the PDPC will wait before enforcing them, or what enforcement will involve.

Freeman's advice is that when the government firms up its proposals, it should study other jurisdictions that have already worked through the same questions. On portability, he noted that many large companies have found it hard to comply with GDPR and the California Consumer Privacy Act. The difficulty is not a lack of ability, he said, but that giving people such detailed access means knowing every place their data might sit: stored locally, on servers in various locations, in email, in instant messages or in posts.

On breach notification, he sees little sense in building a new regime from scratch that adds fresh obligations for multinationals already meeting the notification rules of GDPR and all 50 US states. The better course, he said, is to find what works now and borrow it.