16 July 2014
The Personal Data Protection Regulations 2014 ("PDP Regulations") elaborates on the various ways in which a transfer of personal data out of Singapore may be effected in compliance with the transfer obligation of the Personal Data Protection Act 2012 ("PDPA"). One of the ways - the individual's consent - is (in my view) circular, and ultimately ineffective in practice.
Under the PDP Regulations, a Transferor must take appropriate steps to ensure that the Recipient is bound by legally enforceable obligations to provide a comparable standard of protection to the personal data being transferred. (PDP Regulations, s. 9(1)(b))
"Legally enforceable obligations" is defined to include any law, contract to protect the transfer of data ("Data Transfer Agreement", or "DTA"), binding corporate rules or any other legally binding instrument. (PDP Regulations, s. 10(1))
The requirement for legally enforceable obligations can also be satisfied in a few other ways. One way is that the obligation will be deemed satisfied if the individual consents to the Transferor's transfer of the personal data to the Recipient in that country or territory. (PDP Regulations, s. 9(3)(a))
However the individual will not be deemed to have consented if, amongst other things, the individual was not given a reasonable summary in writing of the extent to which the personal data to be transferred to that country or territory will be protected to a standard comparable to the protection under the Act. (PDP Regulations, s. 9(4)(a))
Having set out that background, here is where individual consent becomes circular and ineffective:
On more than one occasion I have encountered Transferors asking whether they can rely on individual consent to avoid having to enter into a DTA with Recipients but, as it stands, "individual consent" does not appear to be a viable way of avoiding entering into a DTA.
Associate Director, BR Law Corporation
Post date. Edit this to change the date post was posted. Does not show up on published site. 16/7/2014
The materials in these articles have been prepared for general informational purposes only and are not legal advice or a substitute for legal counsel. If you require legal advice for your particular circumstances, please consult a suitably qualified legal counsel. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. You should not rely or act upon this information without seeking professional counsel. Whilst we endeavour to ensure that the information in these articles is correct, no warranty, express or implied, is given as to its accuracy and we do not accept any liability for error or omission.
Subscribe to our Newsletter
Subscribe to our quarterly newsetter to keep up to date with a wealth of insights from the BR Law, BR Family Assets and BR Corporate services team.