Case Details
- Citation: [2019] SGPDPC 33
- Court: Personal Data Protection Commission
- Date: 2019-08-30
- Judges: Tan Kiat How, Commissioner
- Plaintiff/Applicant: -
- Defendant/Respondent: Amicus Solutions Pte. Ltd. & Anor.
- Legal Areas: Data protection – Consent obligation, Data protection – Continued disclosure of personal data collected before appointed day
- Statutes Referenced: Data Protection Act, Personal Data Protection Act, Personal Data Protection Act 2012
- Cases Cited: [2018] SGPDPC 1, [2018] SGPDPC 15, [2018] SGPDPC 3, [2019] SGPDPC 33
- Judgment Length: 27 pages, 7,262 words
Summary
This case concerns the unauthorized collection, use, and disclosure of personal data by Amicus Solutions Pte. Ltd. ("Amicus") and Mr. Ivan Chua Lye Kiat ("Mr. Chua"). The Personal Data Protection Commission ("PDPC") found that Amicus and Mr. Chua breached the Personal Data Protection Act 2012 ("PDPA") by selling and using personal data without the consent of the individuals involved. The case highlights the importance of complying with data protection laws, even for data collected before the PDPA came into effect.
What Were the Facts of This Case?
Amicus is a company that provides business and consultancy services, including the sale of a database of 1.8 million contacts that it claims are PDPA-compliant. Mr. Chua is a financial adviser director at an independent life insurance brokerage company. He engaged telemarketers to make cold calls to potential customers, and he purchased telemarketing leads from Amicus both before and after the PDPA came into effect on July 2, 2014 (the "Appointed Day").
The PDPC investigated complaints about the unauthorized collection and use of personal data for telemarketing purposes. During the investigation, Mr. Chua provided two datasets that he claimed to have purchased from Amicus after the Appointed Day. These datasets contained partial NRIC numbers, partial dates of birth, gender, and mobile phone numbers of over 21,000 individuals.
Amicus admitted to selling these datasets to Mr. Chua, as well as a separate dataset containing age, gender, and mobile phone numbers of 1,200 individuals to another individual. However, Amicus denied any wrongdoing, arguing that the information in the datasets was not personal data and was collected from publicly available sources before the PDPA came into effect.
What Were the Key Legal Issues?
The key legal issues in this case were:
- Whether the information disclosed in the datasets constituted "personal data" under the PDPA.
- Whether Amicus had collected, used, and/or disclosed personal data without the consent and/or notification of the individuals involved.
- Whether Mr. Chua had used and/or disclosed the personal data without the consent and/or notification of the individuals involved.
How Did the Court Analyse the Issues?
On the first issue, the PDPC found that the information in the datasets, including partial NRIC numbers, partial dates of birth, gender, and mobile phone numbers, constituted "personal data" under the PDPA. The PDPC rejected Amicus' argument that the information was not personal data, as the data could be used to identify specific individuals.
On the second issue, the PDPC found that Amicus had breached the PDPA by collecting, using, and disclosing the personal data without the consent and/or notification of the individuals involved. The PDPC noted that Amicus was unable to provide a satisfactory explanation for the source of the information in the datasets, and that its conduct in requiring cash payments from Mr. Chua was "less than straightforward".
On the third issue, the PDPC found that Mr. Chua had also breached the PDPA by using and disclosing the personal data obtained from Amicus without the consent and/or notification of the individuals involved. The PDPC noted that Mr. Chua had cooperated with the investigation and was forthcoming about his actions.
What Was the Outcome?
Based on its findings, the PDPC ordered Amicus and Mr. Chua to cease the collection, use, and disclosure of the personal data obtained without consent, and to destroy all copies of the datasets in their possession. The PDPC also imposed a financial penalty of S$16,000 on Amicus and S$6,000 on Mr. Chua for their respective breaches of the PDPA.
Why Does This Case Matter?
This case is significant for several reasons:
- It reinforces the broad definition of "personal data" under the PDPA, which can include partial identifiers such as partial NRIC numbers and dates of birth.
- It demonstrates that the PDPA applies to personal data collected before the Appointed Day, and that organizations must obtain consent and provide notification for the continued use or disclosure of such data.
- It highlights the importance of maintaining proper documentation and transparency in data collection and sales activities, as the PDPC was critical of Amicus' lack of satisfactory explanations and its requirement for cash payments from Mr. Chua.
- It underscores the PDPC's willingness to take enforcement action against both organizations and individuals who breach the PDPA, even if the individuals are not employees of the organization.
This case serves as a cautionary tale for organizations and individuals involved in the collection, use, and disclosure of personal data, emphasizing the need to comply with the PDPA's requirements, even for data collected before the law came into effect.
Legislation Referenced
- Data Protection Act
- Personal Data Protection Act
- Personal Data Protection Act 2012
Cases Cited
- [2018] SGPDPC 1
- [2018] SGPDPC 15
- [2018] SGPDPC 3
- [2019] SGPDPC 33
Source Documents
This article analyses [2019] SGPDPC 33 for legal research and educational purposes. It does not constitute legal advice. Readers should consult the full judgment for the Court's complete reasoning.