PERSONAL DATA PROTECTION

Column: 1215

PERSONAL DATA PROTECTION: 13.

Ms Denise Phua Lay Peng asked the Acting Minister for Information, Communications and the Arts what measures are there to ensure organisations in the private, public and people sectors do not divulge personal particulars of individuals without their permission, for commercial or non-commercial purposes.

The Acting Minister for Information, Communications and the Arts (RAdm [NS] Lui Tuck Yew): Mr Speaker, Sir, Ms Denise Phua asked what measures are there to ensure organisations in the private, public and people sectors do not divulge personal particulars of individuals without their permission.

Currently, we have in place provisions in our sectoral laws, such as the Banking Act and codes for medical professionals to protect sensitive financial and health information. There are also other industry codes of practice, such as in the telecommunications sector, that prevent the unauthorised use of personal information.

To complement the sectoral laws, we have a Model Data Protection Code that was introduced in 2002 for voluntary adoption by any organisation in the private and people sectors. The principles of this Code have been adopted by many organisations, including those engaged in e-commerce under the TrustSg initiative. Some organisations, including charitable and non-profit organisations, that collect and use personal information, have also put in place their own data protection policies.

Column: 1216

Within the public sector, the Government takes protection of personal data very seriously. The public sector's data protection policy encompasses the principles of the Model Data Protection Code and is incorporated in the Government Instruction Manual. It requires that public agencies put in place processes and procedures to ensure that data acquired by the public sector is properly managed and protected.

There are also statutory provisions in many of our Acts that regulate the collection, use and disclosure of information by the public sector. Some examples include the Census Act, Income Tax Act, IRAS Act and Official Secrets Act. These serve to ensure that public agencies and officials, in carrying out their statutory functions, are subject to responsibilities to maintain confidentiality and limit the disclosure of personal information.

We recognise that an effective data protection regime is a critical factor in building trust between consumers and businesses, and in strengthening Singapore's global competitiveness and position as a trusted IT hub.

An inter-Ministry effort has been on-going to examine this issue in detail and determine the best data protection model for Singapore that would address consumers' data protection concerns, business considerations and national interests. Going forward, we will be working closely with the relevant stakeholders in the public, private and people sectors to address their data protection needs and concerns.

Ms Denise Phua Lay Peng (Jalan Besar): Thank you, Minister, for a very comprehensive response. There is a growing concern that personal information, especially those captured when one signs up or purchases services, is being used liberally, for example, for telemarketing,

Column: 1217

sometimes in the form of overseas telemarketing calls by overseas call centres as far as China. What are the plans that the Ministry has to (i) educate more aggressively both businesses and consumers on a proper and ethical handling of such personal data; (ii) to enforce and introduce consequences for such intrusions of privacy; and (iii) what are the courses by which aggrieved parties can seek redress?

RAdm [NS] Lui Tuck Yew: Mr Speaker, Sir, I understand the Member's concerns and they are indeed very valid ones. Firstly, as I mentioned, we have various sectoral laws and voluntary practices in place that put the onuses on the businesses and entities, including the public sector, to adopt the right modes of behaviour. But it is also important I think for the individuals to take the right precautions and not to reveal too much of their personal data, especially if it is unnecessary. The Inter-Ministry Cyber Wellness Taskforce will take this up more aggressively to try to educate and encourage people to be more aware of the pitfalls of releasing too much of their own personal data. For aggrieved parties, because there is as yet no over-arching body that looks after data protection in Singapore, it is for them to go to the sectoral champions to air their grievances and to try to find recourse to their complaints. For example, if it is concerning a medical professional, they could take the case to the Medical Council which is responsible for the ethical behaviour of their members. If it is an alleged misdemeanour by one of the telcos, then they can bring this to the Infocommunication Development Authority who would be more than happy to look into the case for them.