ENHANCED DATA PROTECTION AFTER RECENT REPORTS OF SALE OF PERSONAL INFORMATION

ENHANCED DATA PROTECTION AFTER RECENT REPORTS OF SALE OF PERSONAL INFORMATION

11.

Er Lee Bee Wah asked the Minister for Information, Communications and the Arts in view of reports of offers to sell personal and contact information of key officers in various Government Ministries (a) how many companies are engaged in this business of data-mining; (b) what are the steps taken to develop the data protection model that can best address privacy concerns, commercial requirements and national interest; and (c) how many companies or individuals have been booked for unsolicited spam mails in 2009 and 2010 under the Spam Control Act.

RAdm [NS] Lui Tuck Yew: The question posed by the Member relates to connected issues on data mining, spam and data protection.

Data mining is the process of extracting and identifying patterns from data. Though it is more commonly used in marketing for customer relationship management, data mining is also widely used by businesses, organisations and individuals as a part of research, trend analysis and other legitimate profiling purposes.

Given the pervasive usage of data mining as a business tool, data mining activities are not classified as a standalone category in the Singapore Standard Industrial Classification (SSIC). There are therefore no reliable statistics on the number of businesses engaged in such activities.

The Member also asked how many companies or individuals have been charged for sending unsolicited electronic messages in 2009 and 2010 under the Spam Control Act.

The Spam Control Act currently employs a civil-based regime for enforcement. This means that any aggrieved party can sue the sender in Court for an injunction, statutory damages, or actual monetary damages suffered. Due to the civil nature of the remedies, enforcement under the Spam Control Act does not involve a Government Ministry or statutory body.

A preliminary check with the Supreme and Subordinate Courts have revealed that, since the Act came into effect on 15th June 2007, no one has yet brought a civil suit to the Courts in relation to spam.

The House was previously informed that a study was underway to review the need for a data protection regime in Singapore and to develop a model that can best address consumers’ concerns, business requirements and national interests. The review has been completed. The Government has concluded that it would be in Singapore’s overall interests to put in place a data protection regime in order to protect individuals’ personal data against unauthorised use and disclosure for profit.

Column: 2621

The Government will be introducing a data protection law that will provide a baseline standard for data protection in Singapore. The proposed law is intended to curb excessive and unnecessary collection of individuals’ personal data by businesses, and include requirements such as obtaining the consent of individuals to disclose their personal information. It will also enhance Singapore’s overall competitiveness and strengthen our position as a trusted hub for businesses and a choice location for global data management and processing services.

Given that data protection is a multi-faceted issue that affects many stakeholders, we will need to undertake further consultation and work closely with the relevant stakeholders in the public, private and people sectors to address their concerns. In this regard, I have tasked the Infocomm Development Authority to coordinate this effort. The proposed legislation is expected to be introduced for consideration by Parliament in early 2012. We envisage that a Data Protection Council will be set up subsequently to oversee the implementation of the legislation.

**

**