Parliament Sitting on 10 July 2018

QUESTION FOR WRITTEN ANSWER


908. Miss Cheng Li Hui: 
To ask the Minister for Communications and Information how can the authorities ensure the deletion of personal data collected by oBike in compliance of the Personal Data Protection Act especially since it claims to have around 1 million members.

Answer:

oBike, like any other business in Singapore, is required to comply with the data protection obligations under the Personal Data Protection Act (“PDPA”). If a business has no legal or business purpose for the personal data in its possession or control, the PDPA requires it to stop retaining such data.

2 The PDPA continues to apply to a company undergoing liquidation. Where a liquidator is appointed, the liquidator will also have to ensure that the company undergoing liquidation continues to comply with the PDPA. This includes the obligations to protect customer data during liquidation and expunging customer data at the end of the winding-up process if there is no legal or business purpose to retain it.

3 The personal data of customers in Singapore cannot be treated as assets and sold without their consent. In winding up a company, the company’s liquidator may sell the whole or part of the company, its assets, or business. If such a sale takes place, customer data that is directly relevant to the transaction may be transferred to the acquirer. However, under the PDPA, customers must be notified that their personal data has been transferred. If customers do not wish for the acquiring company to use their personal data, they can approach the acquiring company to withdraw their consent, whereupon the acquiring company shall then delete the personal data once there is no legal or business purpose to retain it.

4 The Personal Data Protection Commission (“PDPC”) expects oBike and its liquidators to continue complying with the PDPA even as it prepares to exit the market in Singapore. PDPC has reminded oBike of its obligations under the PDPA, and is monitoring the situation closely. PDPC will not hesitate to take further action to safeguard consumers’ interests if necessary.