LEGISLATION TO PROTECT PRIVACY OF COMPUTER USERS

Assoc. Prof. Chin Tet Yung asked the Minister for Communications and Information Technology whether, in the light of incidents such as the surreptitious scanning of users' computers by an Internet service provider or by others, legislation protecting the privacy of computer users will be enacted, which will in turn also serve to encourage the greater use of the Internet for e-commerce.

The Minister of State for Communications and Information Technology (Mr Lim Swee Say) (for the Minister for Communications and Information Technology): Mr Speaker, Sir, our assessment is that it is not necessary at this point in time to enact separate legislation to protect the privacy of computer users. We have in place legislation, such as the Official Secrets Act, Computer Misuse Act and Banking Act, to protect the confidentiality of data held by the Government, statutory boards and financial institutions. In the private sector, several professions such as the medical and legal fields already have strict codes of conduct in place to ensure proper handling of data.

In light of the scanning incident, as mentioned by Prof. Chin, IDA issued a set of guidelines on the conduct of preventive security scanning by the Internet Access Service Providers. It will assure Internet subscribers that security scanning by the IASPs will be guided by a code of ethical practices to respect users' privacy.

Moving ahead, we are developing a model set of self-regulation code of practices on the protection of personal information for reference by the industry. We will encourage industry associations and various business and professional bodies to adapt the code for application in their respective sectors. This is to strike a right balance between consumer protection and business efficacy, and not lead to excessive business compliance costs which will ultimately be paid for by the consumers.

Assoc. Prof. Chin Tet Yung (Sembawang): Two supplementary questions, Sir. Can the Minister of State confirm that credit card companies actually are not caught by any of the pieces of legislation he had mentioned? Credit card companies, for example, are not caught by the Official Secrets Act. What is there to stop credit card companies, for example, processing data of users of credit cards and selling them to other companies doing business? And the second question is: Is it the Ministry's view that the code of practices would be sufficient to regulate the whole industry?

Mr Lim Swee Say: Mr Speaker, Sir, basically, in my reply, I mentioned that there are codes of conduct in the industry. In the survey conducted at the end of last year, we asked Internet users, who were not transacting on the Net, what were the reasons for not going on e-commerce. In fact, only 6.7% of them cited privacy as a concern, meaning that for the majority of the users who are not transacting on the Net, the main reason is either they do not find the things they need on the Net, or they prefer not to shop on the Net for whatever reason.

Having said that, over time, we believe that for Internet users, two concerns will become more important in the future. Firstly, the protection of safety of children using the Net and, secondly, privacy. So the question is: What do we do with privacy? I understand the Member's point that in the case of credit card companies, for example, right now there is nothing to stop them under the law from doing that. But the question is whether enacting a legislation is the way to go. At this moment, countries adopt three approaches. Some countries decide not to do anything. Other countries enact new legislation. The third type goes for industry self-regulation. In view of the fast pace of change of the Internet world, we believe that at this moment, industry self-regulation is still the best way to go. Because, on the one hand, we make sure that the industry will respect the privacy of the users and yet at the same time, we allow the industry enough room for them to innovate. I hope these address the concerns of the Member.