Parliament Sitting on 10 January 2022


45. Mr Melvin Yong Yik Chye: To ask the Minister for Communications and Information (a) in the past five years, how many cases of unauthorised sale of consumers’ personal data did the Personal Data Protection Commission investigate; and (b) of the investigated cases, how many were successfully prosecuted.


1. Over the last five years, the Personal Data Protection Commission (PDPC) has investigated three cases of alleged data breaches involving unauthorised sales of personal data. 

2. Out of these, two cases were found to be in breach of the Personal Data Protection Act (PDPA) for failing to notify and obtain consent from individuals before selling their personal data to third parties for telemarketing purposes. One of the cases involved a company, which was fined $48,000. The other involved an individual who was fined $6,000. Both were directed to cease their actions and rectify their data protection practices. A third case involving a company was investigated but no breach was found. The company was advised on how to improve its data collection practices and how to communicate its Privacy Policy to users more effectively. 

3. PDPC takes a firm stance against the unauthorised sale of personal data, so as to safeguard against harms to the public, such as identity theft and unsolicited calls. Organisations purchasing contact lists must do their due diligence to ensure that the sale is authorised, and that the data is sufficiently accurate and updated for their purposes. 
Speech by Mrs Josephine Teo, Minister for Communications and Information, at Personal Data Protection Seminar on 20 July 2022 Speeches Personal Data 20 Jul 22
MCI response to PQ on Reasons for Recent Data Breach of Local Retail Website and Measures to Ensure Security and Protection of Customer Data Parliament QAs Personal Data, Cyber Security 04 Apr 22
Speech by Mrs Josephine Teo, Minister of Communications and Information, at the Ministry of Communications and Information Committee of Supply Debate on 4 March 2022 Speeches, Parliament QAs Public Comms, Personal Data, Libraries, Infocomm Media, Government Technology, Digital Readiness, Digital Defence, Cyber Security, Others 04 Mar 22
Building a Vibrant and Secure Digital Future, Together Press Releases Others, Cyber Security, Digital Defence, Digital Readiness, Government Technology, Infocomm Media, Libraries, Personal Data, Public Comms 04 Mar 22
MCI response to PQ on Cases of Unauthorised Sale of Personal Data Investigated by Personal Data Protection Commission in Past Five Years Parliament QAs Personal Data 10 Jan 22
MCI response to PQ on Measures in Place to Ensure Companies Engage Licensed and Certified Third- or Fourth-party IT vendors to Minimise Risk of Data Breaches and Leaks Parliament QAs Personal Data 10 Jan 22