PRIVACY OF PERSONAL INFORMATION (Safeguards to protect)

Column: 2405

PRIVACY OF PERSONAL INFORMATION:

(Safeguards to protect): 3.

Prof. Ivan Png Paak Liang asked the Minister for Information, Communications and the Arts whether his Ministry will introduce legislation to safeguard privacy of personal information and, if so, when.

The Minister for Information, Communications and the Arts (Dr Lee Boon Yang): Mr Speaker, Sir, Prof. Png asked whether my Ministry will introduce legislation to safeguard privacy of personal information. The Government recognises the increasing importance and

Column: 2406

impact of personal information or personal data protection in Singapore. We also recognise the need to protect personal data and prevent the possibility of misuse of personal information or even identity theft. This is especially critical when infocomm technologies can be misused to obtain and distribute personal data, with potentially adverse impact on the individuals concerned. Currently, we have in place strict provisions in our sectoral laws, such as our Banking Act and codes for medical professionals, to protect sensitive financial and health information.

However, MICA appreciates the need to take a wider perspective on data protection. We recognise that an effective data protection regime will be an important pillar to develop Singapore's position as a trusted IT-hub. It will also be a critical factor in building trust between consumers and businesses for the adoption of new technologies and services (such as electronic transactions, biometrics and Radio Frequency Identification). MICA, together with IDA, started examining this issue in November 2004. On 26th October 2005, MICA convened an inter-ministry sub-committee under the National Infocomm Security Committee to review Singapore's data protection regime and assess the suitability of various data protection regulatory models. A total of 16 Government agencies, including MTI, MOF, MOH, MHA, MAS and AGC, are represented on this committee. The committee aims to submit its recommendations by the middle of this year.

Assoc. Prof. Ong Soh Khim: Sir, with respect to safeguarding the privacy of personal information like, for example, RFID technology, as the Minister has said, there is a rising trend of manufacturers and businesses using the RFID technique and incorporating such tags into our daily consumer products, and this could be potentially exploited to track and identify an individual. So I would like to ask the Minister if the Government has any plans to introduce legislation in the very near

Column: 2407

future to protect the information and privacy of consumers in this regard.

Dr Lee Boon Yang: Mr Speaker, Sir, I am not going into great details at this juncture. But as I said, we are aware of the potential for abuse and also the beneficial use that technology such as RFID can be applied to. Our committee looking at data protection will certainly study the various aspects and possibilities. In coming out with its recommendations, it would address all these concerns.

Prof. Ivan Png Paak Liang (Nominated Member): Mr Speaker, Sir, may I ask the hon. Minister four supplementary questions.

First, does Singapore currently comply with the European Union data protection directive?

Second, if we do not comply with this directive, to what extent does this non-compliance affect the future development of call centre and data centre businesses in Singapore?

Third, the Minister mentioned the inter-ministerial sub-committee. May I ask the Minister whether this sub-committee is charged with recommending legislation or just providing guidance and some principles that will not be binding?

Finally, may I ask the Minister if he is aware of the tremendous public concern over the privacy of ICs and IC numbers, as was shown in the considerable number of letters to the Straits Times last year and, if so, how does the Ministry plan to address these concerns?

Dr Lee Boon Yang: Mr Speaker, Sir, as I said, we do not have a formal mechanism or formal legislative framework specifically for the protection of privacy of personal information. Whether we comply with the European

Column: 2408

Union standards or not should be viewed in the context of our laws. I think one study showed that about 100 different Acts already have some provisions dealing with the protection of personal information or data. I would say that, as of now, we have not experienced any difficulty with regard to outsourcing or call centre business purely as a result of our lack of a specific law to deal with protection of personal information.

On whether this inter-ministerial sub-committee on data protection's terms of reference would include recommending legislation, I would say, yes, that is one of the specific areas that they are looking into. In fact, just last month, members of the inter-ministerial sub-committee on data protection visited two countries. They went to Australia and Canada to study their legislative model, how they implement legal protection for personal information and how it impacts on the economy and the various organisations in the public, private and people sectors. So, it shows you how seriously we are studying this issue and that we will address all the concerns, including the need to have a specific piece of legislation for protection of personal information.

Last but not least, is the hon. Member's point on the public's concern with the publication of NRIC numbers. Arising from various expressions of concern on the publication of full NRIC numbers, we have conveyed this concern to the media and reiterated to them that they should, as responsible organisations, play their part to ensure that personal information would not be abused. I understand that the media have generally been very cooperative and they have not published the full NRIC numbers. They have only published a part of it, maybe the first three or four digits, just to facilitate identification. So, it shows that our media in Singapore are generally very responsive. If there is in fact a real problem, they will certainly initiate the

Column: 2409

measures to address this concern. Even though there is no specific law at the moment that will compel them to do so, they have shown to be helpful in many ways.

Prof. Ivan Png Paak Liang: Mr Speaker, Sir, to follow up on the Minister's response, I do agree. Yes, the media have been most forward-looking in agreeing to not to publish full NRIC numbers. As far as I can see, the only non-complying body now is the Official Assignee, who still insists on publishing a huge number of people's full names and NRIC numbers. Would the Minister please work with the Minister for Law to have that corrected?

Secondly, would the Minister agree that, going forward, when we look at the regulatory framework for privacy and even legislation for privacy, we should be neutral and make no distinction between on-line and off-line dissemination and use of information? So, there should be the same robust protection for off-line information as well as on-line information.

Dr Lee Boon Yang: Mr Speaker, Sir, we will certainly convey the hon. Member's sentiments to the Official Assignee, and I am sure the Official Assignee will take into consideration the concerns about protection of personal information.

With regard to the regulatory framework, we will certainly look at various options. It is quite consistent with our approach in terms of regulating such matters to adopt a technology-neutral approach.