DATA SECURITY AND CLIENT CONFIDENTIALITY IN GOVERNMENT MINISTRIES

DATA SECURITY AND CLIENT CONFIDENTIALITY IN GOVERNMENT MINISTRIES: 5.

Ms Denise Phua Lay Peng asked the Minister for Finance in light of the recent massive data security breach in Britain, what specific steps is the Government taking to protect the confidentiality of client data in each Ministry.

The Minister of State for Finance (Mrs Lim Hwee Hua) (for the Minister for Finance): Sir, I would like to assure Ms Denise Phua that the Government takes the protection of personal data very seriously, and has put in place policies and systems to safeguard the confidentiality of personal data.

The Government has a robust Public Sector Data Protection Policy, which was adapted from the National Internet Advisory Committee's Private Sector Model Data Protection Code. Apart from the usual need to seek the express consent of the individuals before disclosing any personal data to a third party, the handling of personal data is subject to stringent protection.

In the recent case in the UK that Ms Denise Phua referred to, a large amount of personal data was sent from one Government department to another in the form of two non-encrypted discs. Our Government agencies transfer most data electronically through secured and encrypted electronic networks. In the few situations where data cannot be transferred electronically, we have

Column:214

required our public sector agencies to put in place systems and technological and physical measures to safeguard and protect the data. For example, only registered personnel are authorised to collect and deliver the media and they are locked in secured bags during deliveries. Personal data contained in media must also be electronically encrypted such that, should the media fall into the wrong hands, the contents would not be disclosed.

Government agencies also hold regular IT security awareness programmes to remind public officers that IT security is a personal responsibility of every officer. Further, the Government conducts audit checks to ensure agencies comply with the prescribed security policies and have robust systems in place. We will continue to review our security policies and procedures to keep pace with technological advances.

Ms Denise Phua Lay Peng (Jalan Besar): I thank the MOS for the assurance. I just want to ask MOS: when were the last audits conducted on the IT best practices she mentioned, and what do they reveal?

Mrs Lim Hwee Hua: Sir, these audits are conducted on a frequent and regular basis, so it is not one distinct exercise. Both the systems as well as the platforms are all reviewed on an on-going basis. The results are actually in a way reflected in the Auditor-General's Report each year as well.