THE MEANING AND SCOPE OF PERSONAL DATA UNDER THE SINGAPORE PERSONAL DATA PROTECTION ACT

• Published date: 01 December 2014
• Author: Warren B CHIK LLB (National University of Singapore), LLM (Tulane), LLM (UCL); Associate Dean and Associate Professor of Law, Singapore Management University School of Law. PANG Keep Ying Joey BSc (Economics) (Singapore Management University), JD (Singapore Management University); Practice Trainee, Rajah & Tann LLP.
• Date: 01 December 2014

It is important to examine and determine the meaning of “personal data” as it is the subject matter of the Singapore Data Protection regime. What constitutes “personal data” determines the scope of the Personal Data Protection Act. Although it is defined under the Act, the experience in other jurisdictions has shown that the elements of that (and other forms of) definition can still give rise to some difficulty in its application to specific cases. In this paper, the authors aim to provide some guidance and recommendations for the interpretation of “personal data” within the context of legislative intent and objective.

I. Introduction

1 The enactment of the Personal Data Protection Act 20121 (“PDPA”) on 20 November 2012 marks an important milestone for Singapore's technology law framework. It puts in place a comprehensive set of provisions that provides for baseline standards and requirements for the protection of personal information as well as a regime for the protection of the general public from unwanted voice, fax and text messages. All private organisations are subjected to the data protection obligations under the Act; although it is noteworthy that, unlike some other jurisdictions, public agencies are exempted.2 The PDPA fills the lacuna in Singapore's data protection regime that prior to the Act comprised only sector-specific legislation and regulations.3

2 With the data protection provisions of the PDPA4 due to enter into force on 2 July 2014, there is increased attention and interest on the meaning of the various data protection provisions under the Act. The provisions define the parameters of a private organisation's data protection obligations and the concomitant rights of the individual to the protection of his or her personal information. Central to this inquiry is the concept of “personal data” and what it encompasses, as the data protection obligations under the Act apply only when private organisations are dealing with personal data. In other words, “personal data” is the subject matter of the obligations under the personal data protection regime and determines the scope of its application. In contrast, the other exemptions contained within s 4 of the Act, including the public agency exemption, are exceptions to the PDPA regime; and the even more limited exceptions pursuant to s 17 and the relevant Schedules to the Act only relate to the consent, access and correction requirements.

II. Overview

3 This article will examine the possible meanings of “personal data” under the PDPA. Section 2(1) of the PDPA provides a statutory definition of “personal data” as “data, whether true or not, about an individual who can be identified from that data; or from that data and other information to which the organisation has or is likely to have access”. Nevertheless, different meanings of personal data can arise because of the different interpretive approaches that one can adopt for the various elements of the statutory definition.

4 In this regard, the interpretive approaches to deciphering the meaning of personal data, with reference to the purpose of the Act, will shed light on the various elements that define personal data under s 2(1) of the PDPA. Cases from other countries that have interpreted the same or similar definitions of personal data will also be helpful in predicting the likely scope and coverage of the Act, taking into consideration the political, cultural and socio-economic background of these jurisdictions.

5 In the first part of this article, the authors will identify the general purpose of the statute and consider the policy objectives of the PDPA by examining the purpose provision found in the Act against the backdrop of relevant extrinsic materials such as Parliamentary Reports relating to the passage of the Act, relevant foreign data protection

statutes that were referred to during the development of the Act as well as the advisory guidelines issued by the Personal Data Protection Commission (“PDPC”),5 which is the primary enforcement agency of the PDPA. It will be shown that the PDPA seeks to promote three main objectives: (a) to give individuals the right to data protection in a balanced manner that does not impose overly onerous compliance costs on private organisations; (b) to recognise the qualified right of private organisations to collect, use and disclose personal data so as to enhance Singapore's competitiveness and strengthen its position as a trusted business hub; and (c) to develop Singapore into a global data hub by ensuring that Singapore is on par with major economies that have data protection laws so as to facilitate cross-border data transfers.

6 The authors will explore the two possible approaches to the interpretation of personal data in the second part of the article: (a) a broad and expansive approach; or (b) a balance-of-interests approach. The different approaches stem from the two ways in which the purpose of the PDPA could be understood and promoted, and the authors will submit that a broad and expansive approach is to be preferred in order to better meet the purpose and policy objectives of the PDPA identified in part one and to provide conceptual clarity.

7 In the third and final part of this article, the authors will examine in detail the definition of personal data under the PDPA by analysing each element within its meaning under s 2, again by reference to relevant Parliamentary Reports, PDPC guidelines and materials from jurisdictions that were referred to during the development of the Act. This part will examine the meaning of each of the four key elements of “personal data” under the Act, which can be broken down into the following:

(a) “data”;

(b) “whether true or not”;

(c) “about an individual”; and

(d) “an individual who can be identified” (and the sources of data).

This exercise, using the proposed broad and expansive interpretative approach, is done with a view to clarifying the meaning and parameters of what should constitute personal data under the PDPA in Singapore. Hopefully, this can provide some guidance to the courts, the PDPC and

the primary stakeholders when the issue of compliance arises within their jurisdiction, mandate and practice respectively.

8 In the appendix to this article, the authors will specifically consider whether Internet protocol addresses (“IP addresses”), telephone numbers and e-mail addresses, should generally be recognised as personal data under the PDPA.

III. Purpose and policy objectives of the PDPA

9 Deciphering the purpose of the PDPA is an important and necessary step to determining the statutory meaning of personal data. Before we look at the objectives of the PDPA, it is apposite to make some brief observations on statutory interpretation and specifically the purposive approach to statutory interpretation.

A. Statutory interpretation in Singapore: The purposive approach

10 The Interpretation Act6 (“IA”) provides guidance for statutory interpretation in Singapore and mandates the purposive interpretation of statutory provisions. Specifically, s 9A(1) of the IA states that:

In the interpretation of a provision of a written law, an interpretation that would promote the purpose or object underlying the written law (whether that purpose or object is expressly stated in the written law or not) shall be preferred to an interpretation that would not promote that purpose or object.

With reference to the above provision, purposive interpretation hence entails the evaluation of the appropriateness of a statutory interpretation based on whether or not an interpretation would “promote the purpose or object” of the statute in question. Consequently, the determination of the purpose or object of a statute plays a key role in statutory interpretation.

11 As a matter of practice, such determinations can be made from the purpose provision of the statute (if there is one) as well as from the objectives that can be determined from reading the statute as a whole. Secondary materials such as policy and consultation papers as well as parliamentary debates and, in this case, PDPC guidelines can also be “capable of assisting in the ascertainment of the meaning of [a] provision” and due consideration may be given to them under the circumstances stated in s 9A(2) of the IA.

12 In line with s 9A, the Singapore judiciary has made the purposive approach the dominant, if not the paramount approach, to statutory interpretation. Since the enactment of s 9A in 1993, the courts have consistently ruled, on the basis of s 9A, that the purposive approach to statutory interpretation is to be preferred.7 More recently, this position was affirmed by Sundaresh Menon CJ in the Court of Appeal decision of Dorsey James Michael v World Sport Group Pte Ltd8 (“Dorsey James Michael”). In Dorsey James Michael, Menon CJ pronounced that “[i]n Singapore, any discussion on statutory interpretation must take place against the backdrop of s 9A of the Interpretation Act”.9 For the avoidance of doubt, the purposive reading of statutory provisions applies even when “on a plain reading, the words of the statutory provisions are unambiguous or do not produce unreasonable or absurd results”.10 The purposive approach is hence to be applied in every instance of statutory interpretation.

13 Adopting a purposive interpretation means that Singaporean courts can, when appropriate, deviate from the literal meaning of the provision examined. In Comptroller of Income Tax v GE Pacific Pte Ltd,11 Yong Pung How CJ stated in the Court of Appeal that “s 9A(1) clearly compels [the court] to put Parliament's intention into effect and allows [the court] to look beyond the words of [the statutory provision concerned]”.12 More recently, V K Rajah JA also stated in Public Prosecutor v Low Kok Heng13 (“Low Kok Heng”) that a purposive approach “allows the judge the latitude to look beyond the four corners of the statute, should he find it...