Case Details
- Citation: [2023] SGPDPC 14
- Court: Personal Data Protection Commission
- Date: 2023-12-29
- Judges: Wong Huiwen Denise, Deputy Commissioner
- Plaintiff/Applicant: -
- Defendant/Respondent: Lee Chee Meng
- Legal Areas: Data Protection – Consent obligation, Data Protection – Notification obligation
- Statutes Referenced: Estate Agents Act, Personal Data Protection Act, Respondent of the Personal Data Protection Act
- Cases Cited: [2018] SGPDPC 1, [2019] SGPDPC 33, [2021] SGPDPC 12, [2022] SGPDPC 8, [2023] SGPDPC 14
- Judgment Length: 16 pages, 3,199 words
Summary
In this case, the Personal Data Protection Commission (PDPC) found that Mr. Lee Chee Meng, a registered salesperson under the Estate Agents Act, had breached the consent and notification obligations under the Personal Data Protection Act 2012 (PDPA). Mr. Lee had purchased personal data of approximately 420,000 individuals from an unknown third-party seller and used the data for targeted telemarketing purposes without obtaining the individuals' consent or properly notifying them of the purposes of collection and use.
What Were the Facts of This Case?
The Respondent, Mr. Lee Chee Meng, is a registered salesperson under the Estate Agents Act 2010 and is appointed by ERA Realty Network Pte Ltd to engage in estate agency work and promote the company's business. Mr. Lee admitted that he had been purchasing personal data from unknown third parties for telemarketing purposes for approximately 10 years since 2013.
In 2021, Mr. Lee purchased 5 sets of personal data amounting to about 420,000 records (the "Purchased Data") from an individual with a foreign phone number known to him only as "Ali". The Purchased Data included individuals' names, email addresses, contact numbers, addresses, and partial credit card numbers. After receiving the data, Mr. Lee would sort through it and use the personal information to send targeted marketing emails and SMS messages to the individuals.
Mr. Lee stated that he did not use the Purchased Data for any other purpose and included an unsubscribe function in his marketing emails. He also claimed that he would check the contact numbers against the Do Not Call (DNC) Registry and would not send marketing SMS messages to any DNC-registered numbers. The PDPC found no evidence to contradict these statements.
What Were the Key Legal Issues?
The key legal issues in this case were whether Mr. Lee had breached the consent obligation and the notification obligation under the PDPA.
The consent obligation requires an organization to obtain the individual's consent before collecting, using, or disclosing their personal data. The notification obligation requires an organization to inform the individual of the purposes for which their personal data is being collected, used, or disclosed.
The central question was whether Mr. Lee had fulfilled these obligations when he purchased the personal data from the third-party seller and used it for his telemarketing activities.
How Did the Court Analyse the Issues?
The PDPC first determined that Mr. Lee was bound by the data protection obligations in Parts 3 to 6A of the PDPA, as he was acting in the capacity of an "organization" and not in a personal or domestic capacity.
Regarding the consent obligation, the PDPC found that Mr. Lee had breached this obligation by failing to ascertain that the individuals' consent had been obtained before he purchased their personal data from the third-party seller and used it for telemarketing. The PDPC relied on its previous decisions in Re Sharon Assya Qadriyah Tang and Re Amicus Solutions Pte. Ltd., which established that purchasing personal data from a third-party seller constitutes the collection of personal data under the PDPA, and that data buyers must perform due diligence to ensure the individuals' consent has been properly obtained.
The PDPC found that Mr. Lee did not perform any such due diligence, as he admitted that he did not know whether the seller had obtained the individuals' consent, and he did not contact the individuals directly to obtain their consent. The PDPC concluded that Mr. Lee was negligent in purchasing and using the personal data without verifying the consent of the affected individuals.
Regarding the notification obligation, the PDPC also found that Mr. Lee had breached this obligation by failing to inform the individuals of the purposes for which their personal data was being collected, used, and disclosed. The PDPC noted that an individual cannot be said to have given consent unless they have been provided with the information required under the notification obligation.
What Was the Outcome?
Based on its findings, the PDPC concluded that Mr. Lee had breached sections 13 (consent obligation) and 20 (notification obligation) of the PDPA. The PDPC did not impose any financial penalty on Mr. Lee, as the Commission found no evidence that he had re-sold the Purchased Data or was involved in the seller's business in any capacity other than as a buyer.
Why Does This Case Matter?
This case is significant for several reasons:
Firstly, it reinforces the PDPC's position that individuals acting in a business capacity, and not just corporate entities, are subject to the data protection obligations under the PDPA. This case demonstrates that individual agents, such as real estate salespersons, must comply with the consent and notification requirements when collecting and using personal data for their commercial activities.
Secondly, the case provides further guidance on the due diligence expected of data buyers when purchasing personal data from third-party sellers. The PDPC has made it clear that data buyers cannot simply rely on assurances from sellers about the legality of the data source and the individuals' consent. Buyers must undertake rigorous checks to verify the consent and notification process followed by the sellers.
Lastly, this case highlights the importance of organizations and individuals being proactive in their compliance with the PDPA. The PDPC's findings serve as a reminder that the improper collection and use of personal data, even if done inadvertently, can still result in regulatory action and potential reputational damage.
Legislation Referenced
Cases Cited
Source Documents
This article analyses [2023] SGPDPC 14 for legal research and educational purposes. It does not constitute legal advice. Readers should consult the full judgment for the Court's complete reasoning.