Why an Individual's Consent to Personal Data Transfers May Not Work in Practice

16 July 2014

Dharma Sadasivan

The Personal Data Protection Regulations 2014 ("PDP Regulations") elaborates on the various ways in which a transfer of personal data out of Singapore may be effected in compliance with the transfer obligation of the Personal Data Protection Act 2012 ("PDPA"). One of the ways - the individual's consent - is (in my view) circular, and ultimately ineffective in practice.

Background
Under the PDP Regulations, a Transferor must take appropriate steps to ensure that the Recipient is bound by legally enforceable obligations to provide a comparable standard of protection to the personal data being transferred. (PDP Regulations, s. 9(1)(b))

"Legally enforceable obligations" is defined to include any law, contract to protect the transfer of data ("Data Transfer Agreement", or "DTA"), binding corporate rules or any other legally binding instrument. (PDP Regulations, s. 10(1))

The requirement for legally enforceable obligations can also be satisfied in a few other ways. One way is that the obligation will be deemed satisfied if the individual consents to the Transferor's transfer of the personal data to the Recipient in that country or territory. (PDP Regulations, s. 9(3)(a)) 

However the individual will not be deemed to have consented if, amongst other things, the individual was not given a reasonable summary in writing of the extent to which the personal data to be transferred to that country or territory will be protected to a standard comparable to the protection under the Act. (PDP Regulations, s. 9(4)(a)) 

Commentary
Having set out that background, here is where individual consent becomes circular and ineffective: ​

• The Transferor represents to the individual, by way of the reasonable summary in writing, that the personal data will be protected to a particular standard, as required under the PDP Regulations, s. 9(4)(a).
• To ensure that the Recipient upholds this standard that the Transferor has promised the individual, the Transferor in practice would look to enter into an agreement with the Recipient to make these standards contractually binding on the Recipient.
• This agreement is in substance a DTA. The Transferor would be better served by simply entering into a DTA in the first place, so that it does not need to provide every single individual (and this could be thousands of individuals if it's a large database) with a summary in writing.

On more than one occasion I have encountered Transferors asking whether they can rely on individual consent to avoid having to enter into a DTA with Recipients but, as it stands, "individual consent" does not appear to be a viable way of avoiding entering into a DTA.

​
Dharma Sadasivan
Associate Director, BR Law Corporation
[email protected]