16 July 2014
The Personal Data Protection Regulations 2014 ("PDP Regulations") elaborates on the various ways in which a transfer of personal data out of Singapore may be effected in compliance with the transfer obligation of the Personal Data Protection Act 2012 ("PDPA"). One of the ways - the individual's consent - is (in my view) circular, and ultimately ineffective in practice.
Under the PDP Regulations, a Transferor must take appropriate steps to ensure that the Recipient is bound by legally enforceable obligations to provide a comparable standard of protection to the personal data being transferred. (PDP Regulations, s. 9(1)(b))
"Legally enforceable obligations" is defined to include any law, contract to protect the transfer of data ("Data Transfer Agreement", or "DTA"), binding corporate rules or any other legally binding instrument. (PDP Regulations, s. 10(1))
The requirement for legally enforceable obligations can also be satisfied in a few other ways. One way is that the obligation will be deemed satisfied if the individual consents to the Transferor's transfer of the personal data to the Recipient in that country or territory. (PDP Regulations, s. 9(3)(a))
However the individual will not be deemed to have consented if, amongst other things, the individual was not given a reasonable summary in writing of the extent to which the personal data to be transferred to that country or territory will be protected to a standard comparable to the protection under the Act. (PDP Regulations, s. 9(4)(a))
Having set out that background, here is where individual consent becomes circular and ineffective:
On more than one occasion I have encountered Transferors asking whether they can rely on individual consent to avoid having to enter into a DTA with Recipients but, as it stands, "individual consent" does not appear to be a viable way of avoiding entering into a DTA.
Associate Director, BR Law Corporation
Post date. Edit this to change the date post was posted. Does not show up on published site. 16/7/2014
Subscribe to our Newsletter
Subscribe to our quarterly newsetter to keep up to date with a wealth of insights from the BR Law, BR Family Assets and BR Corporate services team.
The posts found in this Law Blog are not legal advice, nor are they given for the purpose of providing legal advice.
You should contact your lawyer for legal advice if you need legal assistance.