3 August 2017
A "data intermediary" is defined in the Personal Data Protection Act 2012 ("PDPA") as an organization which processes personal data on behalf of another organization but does not include an employee of that organization. In practice, it generally refers to a third party that executes a function for your organization as though it were part of your organization. An example of this is a web hosting service such as Amazon Web Services ("AWS").
It's clear that organizations have data protection obligations as data controllers because they are responsible, at the very least, for the personal data of their employees. It's also clear that organizations acting as data intermediaries only need to comply with the protection and retention obligations under the PDPA in respect of the personal data they process on behalf of the instructing organization.
But it's also increasingly looking (to me at least) as though a data intermediary may be both a data controller and a data intermediary in respect of the same personal data, depending on what's being done with the personal data. The Personal Data Protection Commission ("Commission") has not addressed this issue yet, but allow me to explain why I think this must be the case.
Going back to AWS as an example, and indeed, the reason I picked it: AWS provides web hosting services. AWS allows organizations to store personal data on cloud-based server, and make that data accessible via the internet, such as through websites. An organization that engages AWS to provide cloud-based web hosting engages AWS in its capacity as a data intermediary - AWS has no control over what personal data is uploaded to its server, nor does it deal with the personal data in any way beyond simply storing it, as is its function. The organization that engages AWS to provide the web hosting services is the data controller in respect of that personal data.
However AWS has physical servers supporting its cloud-based services around the world, including the US, Brazil, Europe, East Asia, Australia and Singapore. To provide its cloud-based services, AWS transfers personal data out of Singapore to whichever country/countries physically store(s) the data. The AWS client has no control over which country the personal data is being transferred to.
Therefore, although AWS, in its capacity as a service provider, acts as a data intermediary in respect of its client's personal data, it acts as a data controller in respect of that same personal data in relation to AWS's own internal business processes.
Service providers who find themselves in similar scenarios should be aware that they may ultimately need to comply with 2 sets of obligations in relation to that one set of personal data.
The first is the complete set of data protection obligations that a data controller must comply with, and this arises in relation to how the service provider treats the personal data internally, vis a vis its own work processes. The second set comprises only the protection and retention obligations that a data intermediary must comply with, and this arises in relation to how the service provider treats the personal data externally, i.e., in its capacity as a service provider processing the personal data for a client.
Associate Director, BR Law Corporation
Post date. Edit this to change the date post was posted. Does not show up on published site. 3/8/2017
We're Here To Help
Our team welcome any comments or questions and will gladly assist you with your enquiry. You can call us on +65 6899 9888 or fill out our simple contact form.
The materials in these articles have been prepared for general informational purposes only and are not legal advice or a substitute for legal counsel. If you require legal advice for your particular circumstances, please consult a suitably qualified legal counsel. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. You should not rely or act upon this information without seeking professional counsel. Whilst we endeavour to ensure that the information in these articles is correct, no warranty, express or implied, is given as to its accuracy and we do not accept any liability for error or omission. The authors of the articles are or were employees of BR Law Corporation at the time of publication, but may no longer be, now or in the future, in the employ of the firm.
Subscribe to our Newsletter
Subscribe to our quarterly newsetter to keep up to date with a wealth of insights from the BR Law, BR Family Assets and BR Corporate services team.
Leave a Reply.