Impact of Data Privacy Laws on Consumer Data and Data Residency

Mr Zaqy Mohamad asked the Minister for Information, Communications and the Arts whether the impact on local Internet Service Providers and the Government's promotion of cloud services has been assessed in his Ministry's development of data privacy laws on consumer data and data residency and tighter data regulations for sectors such as banking.

Assoc Prof Dr Yaacob Ibrahim: The development of a data protection law for Singapore was motivated by two key considerations – enhanced protection of consumers' personal data against misuse, and the potential economic benefits for Singapore.

A data protection law will strengthen Singapore's position as a trusted and secure hub for businesses. It will also enhance Singapore's attractiveness as a location for global data management activities, such as cloud computing and business analytics.

The proposed data protection law, which will be called the Personal Data Protection Act (PDPA), will recognise that several sectors are presently governed by respective sectoral laws and regulations that may accord higher standards for the protection of personal data. The PDPA will, thus, be a baseline law that will operate concurrently with existing sectoral laws and regulations.

Page: 554

The Government has also been mindful of the need to keep compliance costs of the PDPA manageable for businesses. A series of consultations were conducted between September 2011 to April 2012 to seek public and industry feedback. These have been taken into consideration and will be incorporated in the proposed law, where possible. For instance, one feedback received highlighted the need to cater to organisations that have little or no control over the processing of personal data. This applies to organisations that may merely play an intermediary role, such as the Internet Service Providers (ISPs) in relation to the Internet traffic they carry on behalf of their users. Taking such organisations into consideration, the proposed PDPA will impose fewer obligations on "data intermediaries", which are organisations that merely process personal data on behalf of another party.

Overall, the proposed PDPA aims to strike a balance between the protection of consumers' interests and the need to keep compliance costs manageable for businesses. The proposed data protection is, therefore, expected to provide greater protection for consumers, while reaping economic benefits for Singapore by creating a conducive environment for global data management and processing industries, such as cloud computing, to thrive in Singapore.