Case Details
- Citation: [2019] SGPDPC 8
- Court: Personal Data Protection Commission
- Date: 2019-06-03
- Judges: Yeong Zee Kin, Deputy Commissioner
- Plaintiff/Applicant: Father of student AB
- Defendant/Respondent: German European School Singapore (GESS)
- Legal Areas: Data protection – Consent obligation
- Statutes Referenced: Misuse of Drugs Act, Personal Data Protection Act, Personal Data Protection Act 2012, Trade Marks Act
- Cases Cited: [2017] SGDC 143, [2019] SGPDPC 8
- Judgment Length: 22 pages, 6,198 words
Summary
This case concerns a complaint made by the father of a student at the German European School Singapore (GESS) regarding the school's collection and use of the student's personal data without valid consent. The central issue was whether GESS had obtained the necessary consent under the Personal Data Protection Act 2012 (PDPA) when it conducted a random drug test on the student. GESS asserted that it had obtained valid consent, while the complainant argued that the consent was not valid. The Personal Data Protection Commission had to determine whether GESS had complied with the consent requirements under the PDPA.
What Were the Facts of This Case?
On 6 December 2017, a student named AB was selected by GESS staff for a random drug test and asked to provide a hair sample. When the student's father, the complainant, found out about this, he immediately contacted the school principal to object to the test being done on his son. The drug test could not be conducted on AB's hair sample as it had not been stored correctly after being sent to the overseas testing laboratory.
Following email correspondence and a meeting between the complainant, his wife, and GESS staff, the school informed the parents that AB would be subject to immediate expulsion if he did not provide a hair sample for the drug test on his first day back at school in January 2018, or if the results of the test were positive. The complainant eventually permitted AB to give the second hair sample, albeit under protest.
On 11 January 2018, the complainant submitted a complaint to the Personal Data Protection Commission (PDPC), alleging that GESS had collected and used AB's personal data without consent, in contravention of the PDPA. GESS sought to rely on agreements with the parents and their correspondence to assert that consent had been provided.
What Were the Key Legal Issues?
The key legal issue in this case was whether GESS had obtained valid consent from the student or his parents for the collection and use of the student's personal data in the form of the hair sample for the drug test, as required under the PDPA.
The complainant argued that GESS did not have valid consent, while GESS asserted that it had obtained consent through the agreements and correspondence with the parents.
How Did the Court Analyse the Issues?
The Deputy Commissioner first addressed the question of what personal data was the subject of the complaint. He determined that the hair sample collected for the drug test, and the resulting test report, constituted the personal data in question, as this information could be used to identify whether the student had consumed controlled drugs.
The Deputy Commissioner then examined the requirements for obtaining consent under the PDPA. He noted that consent may be express or implied, and that for either form of consent to be valid, the individual must have been notified of the purposes for the collection, use, or disclosure of their personal data.
The Deputy Commissioner considered GESS's arguments that it had obtained consent through the agreements with the parents and their correspondence. However, he found that the agreements did not explicitly address the collection of personal data for drug testing, and the correspondence did not clearly demonstrate that the parents had been notified of the purposes for the collection and use of the personal data.
The Deputy Commissioner also examined the concept of "deemed consent" under the PDPA, where an individual is deemed to have consented by voluntarily providing their personal data for a specific purpose. However, he found that this did not apply in this case, as the PDPA requires that the individual must have known or ought to have known the purpose for which their personal data was being collected.
What Was the Outcome?
The Deputy Commissioner concluded that GESS had not obtained valid consent, either express, implied, or deemed, for the collection and use of AB's personal data in the form of the hair sample and drug test results. Therefore, GESS had contravened sections 13 and 14 of the PDPA.
Why Does This Case Matter?
This case provides important guidance on the consent requirements under the PDPA. It clarifies the distinction between express, implied, and deemed consent, and the specific conditions that must be met for each form of consent to be valid.
The case highlights that organisations cannot simply rely on general agreements or correspondence to establish that they have obtained valid consent. They must ensure that individuals have been clearly notified of the specific purposes for which their personal data will be collected, used, and disclosed.
This decision reinforces the high standard of consent required under the PDPA, and the need for organisations to carefully consider and document their consent processes to ensure compliance. It serves as a cautionary tale for schools and other organisations that may seek to collect sensitive personal data, such as for drug testing, without obtaining proper consent.
Legislation Referenced
- Misuse of Drugs Act
- Personal Data Protection Act
- Personal Data Protection Act 2012
- Trade Marks Act
Cases Cited
- [2017] SGDC 143
- [2019] SGPDPC 8
Source Documents
This article analyses [2019] SGPDPC 8 for legal research and educational purposes. It does not constitute legal advice. Readers should consult the full judgment for the Court's complete reasoning.