Case Details
- Citation: [2019] SGPDPC 1
- Court: Personal Data Protection Commission
- Date: 2019-01-03
- Judges: Tan Kiat How, Commissioner
- Plaintiff/Applicant: -
- Defendant/Respondent: Bud Cosmetics Pte Ltd
- Legal Areas: Data Protection – Protection Obligation, Data Protection – Transfer Obligation, Data Protection – Openness obligation
- Statutes Referenced: -
- Cases Cited: [2017] SGPDPC 17, [2017] SGPDPC 14, [2017] SGPDPC 15, [2017] SGPDPC 17, [2018] SGPDPC 8, [2018] SGPDPC 9, [2019] SGPDPC 1
- Judgment Length: 16 pages, 4,288 words
Summary
In this case, the Personal Data Protection Commission (PDPC) investigated a complaint regarding the publication of a list of approximately 2,300 members of Bud Cosmetics Pte Ltd (the Organisation) on the internet. The PDPC found that the Organisation had breached its obligations under the Personal Data Protection Act (PDPA) by failing to develop and implement adequate data protection policies and practices, and by failing to ensure that personal data transferred outside of Singapore was subject to comparable legal protections.
What Were the Facts of This Case?
Bud Cosmetics Pte Ltd is an organic and natural skincare retailer with retail outlets in Singapore and an online store. Since 2007, the Organisation has been collecting customer information for membership registration. At the time of the incident, all customers who wished to purchase items from the Organisation's website were required to set up a membership account.
The Organisation maintained two separate membership databases - an "Online Database" for customers who registered online, and an "Offline Database" for customers who registered in person at the retail outlets. These databases were not consolidated, and personal data from the Offline Database was not stored on the website.
As part of its marketing strategy, the Organisation would generate customer mailing lists by extracting email addresses from both the Online and Offline Databases. The mailing lists and associated image folders were managed by the owner of the Organisation.
On or around 6 April 2017, a complainant discovered a URL link to a list of approximately 2,300 members (the "Member List") containing their personal data, including names, dates of birth, contact numbers, email addresses, and residential addresses. The Member List was located in an image folder for a newsletter sent out in 2012, which was hosted on a server in Australia.
What Were the Key Legal Issues?
The key legal issues in this case were:
- Whether the Organisation complied with its obligations under section 12(a) of the PDPA to develop and implement data protection policies and practices, and communicate these to its staff.
- Whether the Organisation breached section 24 of the PDPA by failing to protect the personal data in its possession.
- Whether the Organisation complied with its transfer limitation obligation under section 26 of the PDPA when transferring personal data outside of Singapore.
How Did the Court Analyse the Issues?
On the first issue, the PDPC found that the Organisation did not have any data protection policies or practices in place at the time of the incident. While the Organisation had a privacy policy on its website, this only notified customers about how their personal data would be used, and did not set out any procedures or practices for handling and protecting the data.
The PDPC noted that even though the Member List contained personal data collected before the PDPA came into full force, the Organisation was still obligated to take proactive steps to comply with the PDPA's requirements in respect of all personal data in its possession or control. As highlighted in a previous case, "if there were no security arrangements previously to protect the existing personal data the organisation was holding, the organisation has a positive duty to put in place security arrangements after the Appointed Day."
On the second issue, the PDPC found that the Organisation had failed to implement reasonable security arrangements to protect the personal data in its possession. The Member List was accessible through a publicly available URL link, which search engines were able to index and make available on the internet.
The PDPC was not convinced by the Organisation's hypothesis that the Member List was inadvertently published as a result of a 2012 cyber-attack incident. The PDPC noted that the number of members in the list exceeded the number of online-registered members in 2012, and the Organisation had not linked its Offline Database to the website in a way that would have allowed the Offline Database to be accessed through the cyber-attack.
On the third issue, the PDPC found that the Organisation had breached its transfer limitation obligation under section 26 of the PDPA. By hosting the Member List on a server in Australia, the Organisation had failed to ascertain and ensure that the recipient of the personal data was bound by legally enforceable obligations to provide a comparable standard of protection as required under the PDPA.
What Was the Outcome?
Based on its findings, the PDPC determined that the Organisation had breached its obligations under sections 12(a), 24, and 26 of the PDPA. The PDPC directed the Organisation to:
- Develop and implement data protection policies and practices, and communicate these to its staff;
- Conduct a comprehensive review of its personal data protection practices and implement reasonable security arrangements to protect the personal data in its possession or control; and
- Ensure that any transfer of personal data outside of Singapore is in compliance with section 26 of the PDPA.
The PDPC also required the Organisation to provide a compliance report within three months of the decision.
Why Does This Case Matter?
This case is significant as it underscores the importance of organisations having robust data protection policies, practices, and security measures in place, even for personal data collected prior to the PDPA coming into full force. The PDPC made it clear that organisations have a "positive duty" to implement appropriate safeguards for all personal data in their possession or control, regardless of when that data was collected.
The case also highlights the PDPC's strict interpretation of the PDPA's transfer limitation obligation. Organisations must ensure that any transfer of personal data outside of Singapore is subject to legally enforceable obligations that provide a comparable standard of protection as required under the PDPA.
This decision serves as a valuable precedent for organisations in Singapore, underscoring the need to proactively review and strengthen their data protection practices to ensure compliance with the PDPA. It also demonstrates the PDPC's willingness to take enforcement action against organisations that fail to meet their data protection obligations.
Legislation Referenced
- Personal Data Protection Act (PDPA)
Cases Cited
- [2017] SGPDPC 17 (Re Social Metric Pte Ltd)
- [2017] SGPDPC 14
- [2017] SGPDPC 15
- [2017] SGPDPC 17
- [2018] SGPDPC 8
- [2018] SGPDPC 9
- [2019] SGPDPC 1 (Bud Cosmetics Pte Ltd)
Source Documents
This article analyses [2019] SGPDPC 1 for legal research and educational purposes. It does not constitute legal advice. Readers should consult the full judgment for the Court's complete reasoning.