PDPA amendments could spur innovation in Singapore

THE widely anticipated amendments of the Singapore Personal Data Protection Act were passed on Nov 2, 2020. The Singapore government, known for its rigour and openness, had run several consultations with the industry prior to making the changes. Why are the amendments significant?

The PDPA has traditionally been an Act that solely focused on protecting personal data. However, Singapore has introduced changes that provide companies with more flexibility to leverage customers' data for innovation purposes - therefore bringing in an element of the competitive use of personal data. There is a caveat that organisations are expected to provide safeguards for the use of personal data under consent exceptions or deemed consent, as emphasised by Minister S Iswaran in Parliament.

Beyond the consent exceptions or deemed consent changes, the amendments introduced a new obligation - data portability. The concept of data portability was first introduced in the EU regulation General Data Protection Regulation (GDPR) as a data subject right. The aim was to provide data subjects with greater autonomy to determine how their personal data can be reused or transferred to another data controller. While Europe was the first to introduce the concept, its implementation has been limited because policymakers have not mandated technical standards. In contrast, Singapore is taking a more concrete approach. According to its public consultation document, the Personal Data Protection Commission (PDPC) intends to develop a "white list" of data categories to which the Data Portability Obligation applies, as well as provide the technical and procedural details.