Case Details
- Citation: [2020] SGPDPC 3
- Court: Personal Data Protection Commission
- Date: 2020-01-31
- Judges: Tan Kiat How, Commissioner
- Plaintiff/Applicant: -
- Defendant/Respondent: SPH Magazines Pte Ltd
- Legal Areas: Data Protection – Protection obligation
- Statutes Referenced: -
- Cases Cited: [2016] SGPDPC 3, [2020] SGPDPC 3
- Judgment Length: 6 pages, 1,384 words
Summary
In this case, the Personal Data Protection Commission (PDPC) found that SPH Magazines Pte Ltd, the operator of the HardwareZone online forum, had breached its obligation under the Personal Data Protection Act (PDPA) to make reasonable security arrangements to protect the personal data of its forum members. The breach occurred when the account of a senior moderator was compromised, allowing an unauthorized hacker to access the personal profiles of over 685,000 forum members. The PDPC imposed a financial penalty of $26,000 on SPH Magazines for its failure to implement adequate password security measures for the senior moderator accounts.
What Were the Facts of This Case?
SPH Magazines Pte Ltd (the "Organisation") operates the HardwareZone online forum, where members are required to provide personal data such as usernames, email addresses, and passwords during registration. The forum also allows members to optionally include additional personal information in their user profiles, such as year of birth, gender, education, occupation, and income range.
The Organisation appointed senior moderators from among the forum members to review and moderate the discussion threads, and granted these senior moderators access to view the personal data in members' user profiles. However, the Organisation did not have adequate password security requirements in place for the senior moderator accounts. The password used by the relevant senior moderator had not been changed in 10 years and did not meet the Organisation's own password complexity standards.
On 20 February 2018, the Organisation notified the PDPC that the senior moderator's account had been accessed by an unknown hacker, who used the senior moderator's credentials to retrieve the personal data of forum members. The Organisation's investigations revealed that the senior moderator's email address and password had been published on a credential leak database on 5 December 2017, which the hacker likely used to gain unauthorized access.
The Organisation's investigations further showed that the compromised senior moderator account was used to attempt to view the personal profiles of 704,764 forum members between 22 September 2017 and 30 September 2017, suggesting a widespread and systematic attempt to access members' personal data without authorization.
What Were the Key Legal Issues?
The key legal issue in this case was whether SPH Magazines had breached its obligations under Section 24 of the PDPA to protect the personal data of its forum members by making reasonable security arrangements.
Specifically, the PDPC had to determine whether the Organisation's failure to implement and enforce adequate password security requirements for the senior moderator accounts, as well as its lack of comprehensive security testing for the forum website, amounted to a breach of the protection obligation under the PDPA.
How Did the Court Analyse the Issues?
The PDPC noted that Section 24 of the PDPA requires an organisation to protect personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks.
In this case, the PDPC found that the Organisation had failed to implement reasonable password security requirements for the senior moderator accounts. While the Organisation had a Password Policy in place that required employees to use passwords of a certain length and complexity, and to change their passwords regularly, these requirements did not apply to the senior moderators.
The PDPC highlighted that the password used by the relevant senior moderator had not been changed in 10 years and did not meet the Organisation's own password complexity standards. Furthermore, the senior moderators were given the ability to set password expiry rules and password history settings, but were not compelled to do so. This lack of mandatory password security requirements for the senior moderator accounts was a significant gap in the Organisation's security arrangements.
The PDPC also noted that the Organisation did not perform any security testing of the forum website, and therefore did not have a comprehensive understanding of the website's security needs. This failure to assess the website's security vulnerabilities was another factor that contributed to the breach of the protection obligation under the PDPA.
What Was the Outcome?
Based on its findings, the PDPC directed SPH Magazines to pay a financial penalty of $26,000 for its breach of the protection obligation under Section 24 of the PDPA.
In determining the appropriate penalty, the PDPC considered several mitigating factors, such as the Organisation's voluntary notification of the incident, its prompt implementation of remedial measures, and its cooperation with the PDPC's investigation. However, the PDPC also noted aggravating factors, such as the fact that the compromised password had not been changed for 10 years and the Organisation's inability to detect the unauthorized access for around 2 years.
No additional directions were imposed on the Organisation, as the PDPC was satisfied that the remedial measures taken by SPH Magazines, such as implementing two-factor authentication for senior moderator accounts, revising the password policy, and removing certain personal data fields, were sufficient to address the identified security gaps.
Why Does This Case Matter?
This case highlights the importance of organizations implementing and enforcing robust password security measures, particularly for accounts with elevated privileges or access to sensitive personal data. The PDPC's decision underscores that a failure to do so can constitute a breach of the PDPA's protection obligation, even if the organization has not experienced a data breach.
The case also emphasizes the need for organizations to proactively assess the security of their systems and applications through regular security testing and vulnerability assessments. Relying solely on reactive measures, such as responding to incidents, may not be sufficient to meet the PDPA's requirements for reasonable security arrangements.
For practitioners, this case provides valuable guidance on the PDPC's approach to evaluating an organization's compliance with the protection obligation under the PDPA. It demonstrates that the PDPC will closely scrutinize an organization's password security policies and practices, and that a lack of mandatory password security requirements for privileged accounts can be a significant compliance gap, even if no actual data breach has occurred.
Legislation Referenced
- Personal Data Protection Act (PDPA)
Cases Cited
- [2016] SGPDPC 3
- [2020] SGPDPC 3
Source Documents
This article analyses [2020] SGPDPC 3 for legal research and educational purposes. It does not constitute legal advice. Readers should consult the full judgment for the Court's complete reasoning.