D a t a P r o t e c t i o n U p d a t e

Transcription

1 D a t a P r o t e c t i o n U p d a t e J u n e A s s e s s i n g t h e i m p a c t o f t h e n e w p e r s o n a l d a t a p r o t e c t i o n l a w o n t h e t e l e c o m m u n i c a t i o n s e c t o r W u n R i z w i The advent of the new personal data protection law, the Personal Data Protection Act 2012 ( PDPA ), will have a significant impact on most industries and sectors in Singapore. The PDPA is the first major omnibus legislation that imposes, across almost all private sector organisations in Singapore, minimum standards governing the collection, use and disclosure of personal data in Singapore. The PDPA was enacted on 2 January 2013 to establish the Personal Data Protection Commission ( PDPC ), the regulatory authority tasked to oversee and implement the PDPA. The provisions relating to the Do Not Call ( DNC ) Registry came into effect on 2 January 2014 and the main provisions relating to data protection will be enforced from 2 July The PDPC has held several public consultations seeking feedback on the treatment and interpretation of the PDPA within specific sectors in Singapore. On 16 May 2014, the PDPC issued, amongst others, Advisory Guidelines for the Telecommunication Sector ( Advisory Guidelines ). On the same day, the Infocomm Development Authority of Singapore ( IDA ) announced amendments to the end user service information provisions in the Code of Practice for Competition in the Provision of Telecommunication Services 2012 ( Code of Practice ), which will take effect from 2 July This article seeks to examine the impact of these developments on the telecommunication sector, which arose as a result of the changes brought about by the PDPA. Overview of the PDPA and the DNC Registry Under the PDPA, organisations which collect personal data in Singapore must: appoint a dedicated person(s) to be responsible for implementing a personal data protection policy; protect the personal data using reasonable security arrangements; comply with the provisions relating to the collection, use, disclosure, protection and transfer (if any) of personal data under the PDPA; and comply with the obligations relating to the DNC Registry. Page 1

2 Certain types of data are not affected by the PDPA, notably business contact information ( BCI ), which is personal contact information not provided solely for personal purposes. The DNC Registry comprises three separate registers kept and maintained by the PDPC under s 39 of the PDPA (the DNC Registers ), which cover telephone calls, text messages and faxes. Users and subscribers can register a Singapore telephone number on one or more of the DNC Registers, depending on their preferences, with a view to blocking the receipt of marketing messages (defined as specified messages under the PDPA) through telephone calls, text messages or fax. Advisory Guidelines Before the Advisory Guidelines were issued on 16 May 2014, the PDPC conducted a public consultation in January 2014 where it sought to address a myriad of issues specific to the telecommunication sector and for telecommunication operators in Singapore. Care was taken to provide many examples of the application of the principles underpinning the PDPA to illustrate the position taken by the PDPC on typical industry practices within this sector. The key implications arising from the Advisory Guidelines are set out below. 1. Collection practice should be reviewed: The first obvious conclusion to be drawn is that Singapore telecommunication operators should review their practices at the point of collection of information from their customers. The PDPC has identified information that can be collected in a wide range of activities specific to the telecommunication sector which is capable of qualifying as personal data under the PDPA. Careful consideration should be given to obtaining the requisite consent for the purpose of complying with the PDPA. 2. Itemised bills: Even itemised bills, which may appear innocuous, would be affected by the PDPA. The PDPC considers the display of the complete record of all calls and/or messages made and/or received by a subscriber as a reproduction of the record of the subscriber s transactions carried out using the telecommunication operator s service. 1 Accordingly, where such call data is personal data, consent obtained by the subscriber to make a call or send a message, as well as consent given (or deemed to be given) by the other party with whom the subscriber communicates to make a call or send a message, would be required. Such consent would extend to the display of the call data in the subscriber s itemised bill. The interesting challenge would be for a Singapore telecommunication operator to secure the consent from the other party with whom the subscriber communicates, since in most circumstances that party would most likely not be a customer of another Singapore telecommunication operator. A practical solution would be to reach an understanding with the telecommunication operator of the home country of the other party. Page 2

3 3. Pre-paid mobile cards: The PDPC recognises the practice of collecting personal information from consumers of pre-paid mobile cards at the point of purchase. Singapore telecommunication operators (whether by themselves or through their resellers acting on their behalf) are required to provide adequate notice of the purposes for which such personal data would be collected and used. Some practical examples were provided Advertisements in invoices: Interestingly, the PDPC considers that a Singapore telecommunication operator that includes advertisements for specific products or services in invoices to customers will generally be considered to have used personal data for advertising purposes, even if the advertisements themselves are not addressed to the individual. 3 Therefore, when an individual withdraws consent for such purposes, the Singapore telecommunication operator must facilitate the withdrawal according to the PDPA. 5. DNC Provisions: The PDPC noted that the DNC Provisions will apply when a sender of a specified message (as defined under the PDPA) is present in Singapore when the message is sent, or the recipient is present in Singapore when the specified message is accessed. 4 The challenge, especially for senders from overseas, is to collect clear and unambiguous consent from recipients in Singapore. 6. International Calls: The position taken by the PDPC in relation to inbound roaming is simple and sensible. In most cases, it would be reasonable to presume that a Singapore telecommunication operator is acting as a data intermediary for a foreign telecommunication operator concerning personal data that is collected, used and or disclosed. If the Singapore telecommunication operator is acting as a data intermediary when processing personal data of inbound roamers, it is only obliged to comply with the Protection Obligation and Retention Limitation Obligation. On the other hand, if the Singapore telecommunication operator is collecting personal data of inbound roamers, and is not acting as a data intermediary, all the PDPA provisions will apply to the operator unless there are applicable exceptions in the PDPA. In this regard, the IDA is considering creating an additional exception to allow telecommunication licensees to collect, use or to disclose personal data of inbound roamers to offer them roaming-related information. 5 For outbound roaming, the PDPC assumes that Singapore telecommunication operators will rely on interconnection agreements with their counterparts in other countries to ensure compliance with international data transfers. 6 To this end, the PDPC has issued regulations to update the position on international data transfers. 7 Page 3

4 7. Blocked/unlisted numbers: Based on established market practice, the PDPC construes the choice of blocking a telephone number by a subscriber as withholding consent for identification at point of collection based on his conduct. 8 Conversely, a subscriber A, who chooses not to have an unlisted number and calls a friend B, will usually be aware that the telephone number would be collected, used or disclosed for the purpose of identifying A to B. 9 The PDPC also considers that A may be deemed to have consented to the collection, use and disclosure of his telephone number by B s telecommunication operator for the same purpose. Amendments to the Code of Practice Similarly, the IDA conducted a public consultation in January 2014 before finalizing the amendments to sub-sections and of the Code of Practice on 16 May 2014, which will take effect on 2 July These sub-sections concern the protection of end-user service information ( EUSI ) 10 and the provision of the End User Service Agreement ( EUSA ) between the licensed telecoms services provider ( the Telecoms Licensee ) and the end user, which governs the usage of EUSI. The purpose of the IDA s review was to streamline the EUSI provisions in the Code of Practice, given that the PDPA will be the primary personal data protection law, whose framework is similar to that within the Code of Practice governing EUSI. Three issues are pertinent: 1. EUSI would be further sub-divided into Residential EUSI and Business EUSI, with Residential EUSI generally viewed as personal data, whereas not all Business EUSI can be classified as personal data (for example, BCI). 2. There would be separate frameworks governing Residential EUSI and Business EUSI. A Telecoms Licensee may only collect, use or disclose Residential EUSI for the specific and limited purposes set out in the Code of Practice, and must follow the other provisions under the PDPA on the use of personal data for all other purposes. 11 On the other hand, a Telecoms Licensee may not use Business EUSI for any purposes other than those specifically set out in the Code of Practice and must further ensure that no Business EUSI has been provided for marketing purposes unless with relevant prior consent The EUSA must contain procedures regarding the Telecoms Licensee s use of a Business EUSI. 13 Page 4

5 Be it a Singapore or an overseas telecoms services provider, any organisation which intends to provide telecommunication services in Singapore would welcome these developments, as they provide clarity on the requirements for compliance with the new personal data protection regime in the Singapore telecommunication sector. 1 Paragraph 3.13 of the Advisory Guidelines. 2 Paragraph 3.20 of the Advisory Guidelines. 3 Paragraph 3.22 of the Advisory Guidelines. 4 Paragraph 5.2 of the Advisory Guidelines. 5 Paragraph 3.4 of the Advisory Guidelines. 6 Paragraph 3.6 of the Advisory Guidelines. 7 See the Personal Data Protection Regulations 2014, which were published on 19 May 2014 and will come into effect from 2 July Paragraph 3.10 of the Advisory Guidelines. 9 Paragraph 3.9 of the Advisory Guidelines. 10 EUSI consists of all information that a Telecoms Licensee obtains as a result of an end user s use of a telecommunication service provided by the Licensee. This includes the end user s usage patterns (including number of calls, times of calls, duration of calls and parties called), services as used, telephone number and network configuration, location information; and billing name, address and credit history. 11 Sub-section (c) and (d) of the amended Code of Practice as at 2 July Sub-section (a) and (b) of the amended Code of Practice as at 2 July Sub-section of the amended Code of Practice as at 2 July For more information, please contact: Wun Rizwi Partner, Intellectual Property and Technology Practice DID: (65) rizwi.wun@rhtlawtaylorwessing.com RHTLaw Taylor Wessing LLP 2014 This publication is intended for general information and to highlight issues. While we endeavour to ensure its accuracy and completeness, we do not represent nor warrant its accuracy and completeness and are not liable for any loss or damage arising from any reliance thereon. It is not intended to apply to specific circumstances or to constitute legal advice. RHTLaw Taylor Wessing LLP (UEN No. T11LL0786A) is registered in Singapore under the Limited Liability Partnerships Act (Chapter 163A) with limited liability. RHTLaw Taylor Wessing LLP is a Singapore law practice registered as a limited liability law partnership in Singapore ( The LLP ). It is a member of Taylor Wessing, a group which comprises a number of member firms which are separate legal entities and separately registered law practices in particular jurisdictions. The LLP is solely a Singapore law practice and is not an affiliate, branch or subsidiary of any of the other member firms of the Taylor Wessing group. A list of all Partners and their professional qualifications may be inspected at our main office at Six Battery Road #10-01, Singapore Page 5