Case Details
- Citation: [2021] SGPDPC 2
- Court: Personal Data Protection Commission
- Date: 2021-04-16
- Judges: Yeong Zee Kin, Deputy Commissioner
- Plaintiff/Applicant: N/A
- Defendant/Respondent: (1) Progressive Builders Private Limited; (2) Greatearth Corporation Pte. Ltd.
- Legal Areas: Data Protection – Consent obligation
- Statutes Referenced: Personal Data Protection Act 2012
- Cases Cited: [2021] SGPDPC 2
- Judgment Length: 8 pages, 2,123 words
Summary
This case involves the unauthorized collection, use, and disclosure of the personal data of 8 individuals (the "Complainants") by Greatearth Corporation Pte. Ltd. ("GCPL"). The Personal Data Protection Commission (the "Commission") found that GCPL contravened its obligations under the Personal Data Protection Act 2012 ("PDPA") by disclosing the Complainants' personal data without their consent. However, the Commission determined that Progressive Builders Private Limited ("PBPL") did not contravene the PDPA as its employee's disclosure of the Complainants' personal data was outside the course of his employment.
What Were the Facts of This Case?
The Complainants are tower crane operators engaged by Craneworks Pte Ltd ("the Subcontractor") to operate tower cranes for the Subcontractor's clients, including PBPL. PBPL is the main contractor for a housing project in Geylang (the "Geylang Project") and had collected the Complainants' personal data, including their full name, NRIC, contact number, and photograph, for the purposes of managing their roles as tower crane operators.
Between 12 and 18 July 2019, a series of incidents involving the Complainants and PBPL's staff occurred at the Geylang Project worksite. As a result, PBPL banned the Complainants from entering the worksite and directed its Workplace Safety & Health Officer ("WSHO") to compile a "Banned Operators List" containing the Complainants' personal data.
Unbeknownst to PBPL, its WSHO then sent the Banned Operators List to a private WhatsApp group comprising workplace safety professionals in Singapore. GCPL's WSHO, who was a member of this WhatsApp group, received the list and instructed GCPL's safety coordinator to print and paste a copy of it in the guard room of GCPL's Clementi Project worksite, so that the security guards could look out for the Complainants. However, the safety coordinator misunderstood the instructions and instead pasted the list on the external façade of the Clementi worksite, where it was visible to the public.
What Were the Key Legal Issues?
The key legal issues in this case were:
1. Whether PBPL was responsible for its WSHO's disclosure of the Banned Operators List, and if so, whether PBPL contravened its obligations under the PDPA.
2. Whether GCPL was responsible for its WSHO and safety coordinator's collection, use, and disclosure of the Banned Operators List, and if so, whether GCPL contravened its obligations under the PDPA.
How Did the Court Analyse the Issues?
Regarding PBPL's liability, the Commission found that PBPL's WSHO was not acting in the course of his employment when he disclosed the Banned Operators List to the WhatsApp group. The WSHO had disregarded his contractual obligations of confidentiality, and there was no evidence that PBPL had directed him to share the list. Therefore, the WSHO's actions could not be attributed to PBPL under section 53(1) of the PDPA, and PBPL did not contravene its data protection obligations.
In contrast, the Commission found that GCPL was responsible for its WSHO and safety coordinator's actions under section 53(1) of the PDPA. The WSHO was acting in the course of his employment when he instructed the safety coordinator to display the Banned Operators List, and the safety coordinator was also acting within the scope of his employment when he pasted the list on the external façade of the worksite.
The Commission then analyzed whether GCPL had contravened its obligations under the PDPA. Section 13 of the PDPA prohibits the disclosure of personal data without the individual's consent, unless the disclosure is authorized under the PDPA or other written law. The Commission found that the disclosure of the Complainants' personal data was not authorized, and GCPL had failed to obtain their consent. While the use of the list within the guardroom and restricted to security personnel may have been acceptable, the public display of the list on the worksite's external façade went beyond what a reasonable person would consider appropriate in the circumstances.
What Was the Outcome?
The Commission concluded that GCPL had contravened its obligations under the PDPA by disclosing the Complainants' personal data without their consent. However, the Commission determined that PBPL did not contravene the PDPA, as its employee's disclosure of the personal data was outside the course of his employment.
Why Does This Case Matter?
This case highlights the importance of organizations strictly adhering to the consent requirements under the PDPA when handling personal data. Even if an organization obtains personal data for a legitimate purpose, it must ensure that any subsequent use or disclosure of that data is authorized and complies with the PDPA.
The case also demonstrates the principle of vicarious liability under the PDPA, where an organization can be held responsible for the actions of its employees if they are carried out in the course of employment. Employers must have robust data protection policies and training in place to prevent unauthorized disclosures by their staff.
Lastly, the case provides guidance on the reasonableness of data handling practices. While the use of the Banned Operators List within the guardroom may have been acceptable, the public display of the list went beyond what a reasonable person would consider appropriate, even if the intent was to restrict the Complainants' access to the worksite.
Legislation Referenced
- Personal Data Protection Act 2012
Cases Cited
- [2021] SGPDPC 2
Source Documents
This article analyses [2021] SGPDPC 2 for legal research and educational purposes. It does not constitute legal advice. Readers should consult the full judgment for the Court's complete reasoning.