Data protection guidelines proposed for more sectors

SINGAPORE — With the increasing amount of personal and often sensitive information being used in healthcare, education, social services and photography, the Personal Data Protection Commission (PDPC) has proposed data protection advisory guidelines for these four sectors.

“These are some of the sectors which typically have to handle personal data in high volumes,” a PDPC spokesman said yesterday. The guidelines are based on sector-specific scenarios that may happen on a regular basis.

The guidelines, worked on together by the Ministry of Health, Ministry for Social and Family Development and Ministry of Education, will be open for public consultation until June 6. This comes as businesses and organisations prepare themselves for the Personal Data Protection Act (PDPA) that will kick in on July 2.

In the area of healthcare, this includes obtaining consent from individuals for medical care or referrals. It also covers scenarios where patients wish to access or amend their data.

For instance, when a general practitioner recommends that his patient be referred to a specialist, he or she should document the consent required to disclose the personal data needed for the referral.

However, some see this requirement as onerous.

Dr Jonathan Pang, a GP who runs Evergreen Family Clinic and Surgery, said: “If a patient needs to be referred for the medical treatment, he needs it, period. I don’t see why there should be any additional, unnecessary steps to obtain consent. This is additional burden on manpower as well. Besides, patient confidentiality already applies in our field.”

For the social services sector, the guidelines aim to oversee the collection, use or disclosure of welfare recipients’ personal data for purposes such as coordinating service delivery, especially in cases where they receive help from more than one voluntary welfare organisation (VWO). It has been proposed that VWOs obtain consent for recipients’ information to be shared.

Ms Rachel Lee, senior assistant director of Fei Yue Family Service Centres, welcomed the guidelines, saying the benefits outweigh any extra work that needed to be done. “Clients and agencies would benefit, because if consent is given to share data across agencies, it would expedite the application of various financial schemes,” she said.

However, the Asian Women’s Welfare Association felt that compliance would be a challenge, as it would be “impossible” for any guidelines and training sessions to “cover the full breadth and depth specific to each VWO as they are very different”.

---

In education, guidelines have been drafted to protect students or minors under 13 years — which the PDPC yesterday also announced as the legal age to give consent under the Act. A person has to be at least 13 years old to give consent for the use of his or her personal data for marketing purposes.

For photography, consent is deemed to have been given if people voluntarily pose for photos. A company that hires a photographer to take pictures at an event would be responsible for complying, instead of the photographer.

This round of public consultation follows an earlier, similar process for the real estate and telco industries, as well as a few new guidelines not set out previously. One of these include telcos now being required to ask customers for their consent for marketing materials to be included with their bills.

New regulations have also been released for three key areas to support the provisions of the PDPA.

Individuals who wish to access their information stored with any company can do so for data dating back one year, but the organisation has the right to charge a reasonable fee and must provide the data within 30 days.

The right to manage the information of deceased individuals has been given to immediate family members, such as the spouse, a parent or sibling.

For the transfer of data out of Singapore, the individual must give consent, but exceptions apply, such as when tour agents need to send customers’ particulars to hotels overseas.

A Memorandum of Intent has also been signed with the Consumers Association of Singapore and Singapore Mediation Centre to facilitate the resolution of complaints related to personal data protection.