Dear, privacy pros.

First, congratulations to the Singapore Personal Data Protection Commission for wrapping up a week of well-attended presentations, discussions and workshops during Privacy Awareness Week 2020.

One of these events was, of course, the IAPP session “Managing Third-Party Vendor Risk: Tips for Protecting Your Business.” More than 300 participants attended the webinar, and we were treated to an insightful and practical sharing by the experienced panelists from the IAPP’s Asia Advisory Board. Many thanks once again to everyone for making the event a wonderful success.

The tips shared during the session were very timely, given the release of the PDPC’s "Guide on Managing Data Intermediaries," as announced during the DPO Symposium 21 Sept. In addition to the guide, a one-page primer is also available.

The other eagerly anticipated document released 21 Sept. was the PDPC’s annual "Personal Data Protection Digest." Besides thought-provoking perspectives, the digest contains a summary of recent decisions and findings by the PDPC. A quick scan of the cases summarized in the digest highlights the importance of ensuring that personal data held by companies is protected by adequate security measures.

In this regard, it is pertinent to note there has been a recent spate of data breaches highlighted in the local press, affecting high-profile homegrown companies, such as ShopBack, Razer and Grab. While these security lapses do not appear to have affected sensitive personal data, such as financial or card details, they do show that no company is immune from unauthorized data leaks. It is incumbent upon companies that collect and process sensitive personal data to prove to consumers and regulators they have reasonable security safeguards and oversight in place. This is particularly true for the latter two companies, which are vying for up to five digital banking licenses to be issued by the Monetary Authority of Singapore this year.

Besides private companies, however, it is fair to say that government agencies equally need to demonstrate compliance to the principles in the Personal Data Protection Act and reassure individual constituents that their personal data will be collected, processed and used in a reasonable way. While government bodies are not explicitly covered under the scope of the PDPA, the government has always maintained that it holds itself to similar, if not higher, standards. Not surprisingly, the recent news that the government is piloting facial identity verification checks on the SingPass system has raised some concerns.

SingPass is a national digital identity system widely used by residents in Singapore to access a wide range of public and private sector services, including logging into SafeEntry for gaining access to any mall, shop or establishment in this post-COVID-19 world. While it seems the current pilot is limited to kiosks at certain government agencies and is intended to be used by individuals who do not have access to a smartphone, it is not clear how the facial recognition technology will be deployed in the future. It is also not clear how the PDPC will view the use of consent to justify the collection, use and disclosure of personal data in this scenario if government agencies were subject to the same principles set out in the PDPA.

That said, it may be that the facial identity verification system has indeed been implemented in accordance with privacy-by-design principles. For example, it appears only the biometric template (as opposed to an underlying selfie) would be retained in the system. Perhaps if the system is to be rolled out to the general public in the future, the government would consider allowing users with mobile devices (which should be the overwhelming majority in Singapore) to leverage the built-in facial verification tool on their devices to provide the necessary digital “handshake” to minimize the amount of data that the government needs to collect to make this system work.

At the end of the day, I would suggest that all data users, whether from the private or public sector, need to ensure that privacy must not only be done, but also must be seen to be done. With that as food for thought, I leave you to digest the rest of this week’s articles.