Conflicts between the PDPA and other Singapore laws

03 August 2018

Dharma Sadasivan

​On 02 August 2018, the Singapore Personal Data Protection Commission (the "Commission") released its decision in Re: Management Corporation Strata Title Plan No. 4436 [2018] SGPDPC 18 ("Re: MCST 4436").
 
In this case, the Commission turned its attention to a conflict between section 21(3) of the Personal Data Protection Act 2012 (the "PDPA"), which prohibits organizations from releasing personal data under certain circumstances notwithstanding the individual's general right of access to their own personal data, and section 47 of the Building Maintenance and Strata Management Act ("BMSMA"), which requires management corporations to supply information to certain classes of persons.

Briefly, the facts of this case are as follows. The management corporation of River Isles Condominium (the "MCST") provided CCTV footage to a subsidiary proprietor of the condominium in order to locate a missing cat. Two other subsidiary proprietors, concerned that there may be footage containing images of other individuals, complained that the first subsidiary proprietor should not have been permitted to view the CCTV footage, and that the footage could only be viewed by security guards, the managing agent's staff, or police. The MCST averred that the CCTV footage was provided pursuant to section 47 of the BMSMA.

Right of access to personal data and exceptions to this right
Section 21(1) of the PDPA provides individuals with a right of access to their own personal data. It is found in Part V of the PDPA, which provides individuals with access and correction rights relating to their personal data. Section 21(1) says:

21(1): Subject to subsections (2), (3) and (4), on request of an individual, an organisation shall, as soon as reasonably possible, provide the individual with (a) personal data about the individual that is in the possession or under the control of the organisation; and (b) information about the ways in which the personal data referred to in paragraph (a) has been or may have been used or disclosed by the organisation within a year before the date of the request. [Emphasis added]

As such, it is clear that the right of access is a general right which is not unfettered, but subject to certain exceptions.

The relevant exception in this case was section 21(3)(c), which states:

21(3)(c): An organisation shall not provide an individual with the individual’s personal data or other information under subsection (1) if the provision of that personal data or other information, as the case may be, could reasonably be expected to…(c) reveal personal data about another individual; … [Emphasis added]

Right of supply of information
Section 47 of the BMSMA provides particular classes of persons with a right to obtain information from the management corporation. The section reads:

47(1): A management corporation shall, upon application made to it in writing in respect of a lot which is the subject of the subdivided building concerned by a subsidiary management corporation, or by a subsidiary proprietor or mortgagee or prospective purchaser or mortgagee of that lot or by a person authorised in writing by such a subsidiary proprietor or mortgagee and on payment of the prescribed fee, do any one or more of the following things as are required of it in the application…(b) make available for inspection by the applicant or his agent…(viii) any other record or document in the custody or under the control of the management corporation…at such time and place as may be agreed upon by the applicant or his agent and the management corporation and, failing agreement, at the subdivided building at a time and on a date fixed by the management corporation under subsection (2). [Emphasis added]

This section compels the management corporation to supply such information upon an application in writing. It is trite law that video footage, including CCTV footage, is considered to be a record or document, and the party requesting the CCTV footage was a subsidiary proprietor – one of the classes of persons entitled under section 47 of the BMSMA to inspect records under the MCST's custody or control. Section 47 of the BMSMA therefore applied, and the CCTV footage in question fell within the scope of the section.

Conflict
The conflict arose because both section 21 of the PDPA and section 47 of the BMSMA applied to the facts of the case. Specifically, section 21(3)(c) prohibited the MCST from disclosing unmasked CCTV footage that would reveal personal data of other individuals, while section 47 of the BMSMA compelled the provision of the CCTV footage as a record or document in the MCST's custody or control.

Decision
The Commission examined section 4 of the PDPA, which concerns the application of the PDPA. Specifically, section 4(6) states:

4(6): Unless otherwise expressly provided in this Act — (a) nothing in Parts III to VI shall affect any authority, right, privilege or immunity conferred, or obligation or limitation imposed, by or under the law, including legal privilege, except that the performance of a contractual obligation shall not be an excuse for contravening this Act; and (b) the provisions of other written law shall prevail to the extent that any provision of Parts III to VI is inconsistent with the provisions of that other written law. [Emphasis added]

In other words, section 4(6) is a provision which subordinates Parts III to VI of the PDPA to other laws in the event of conflicts between Parts III to VI and those other laws. In view of this, the Commission held that section 47 of the BMSMA would prevail over section 21 of the PDPA.

How this affects you
The PDPA is not a stand-alone piece of legislation – this case vividly illustrates that there may be scenarios in which conflicts arise between the PDPA and other laws.

If in such cases the factual matrix gives rise to rights or obligations under other Singapore laws, your rights as an individual or obligations as an organization under the PDPA may be impacted because of the subordination provision at section 4(6) of the PDPA.

​Could the conflict in this particular case have been avoided? Potentially. If the CCTV footage had masked the identities of other individuals, it would not have fallen within the scope of section 21(3)(c) to begin with. The Commission has also released clear guidelines on how CCTV footage can be provided without disclosing the personal data of other individuals. Therefore, you should generally avoid relying on section 21(3)(c) as the basis for failing to release CCTV footage.

Contact us if you need assistance with personal data protection compliance.


Dharma Sadasivan
Associate Director, BR Law Corporation
dharma@brlawcorp.com