Singapore Government
Link to Homepage
Home | About Us | Browse | Advanced Search | Results | My Preferences | FAQ | Help | PLUS
 
Contents  

Long Title

Enacting Formula

Part I PRELIMINARY

Part II PERSONAL DATA PROTECTION COMMISSION AND ADMINISTRATION

Part III GENERAL RULES WITH RESPECT TO PROTECTION OF PERSONAL DATA

Part IV COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA

Division 1 — Consent

Division 2 — Purpose

Part V ACCESS TO AND CORRECTION OF PERSONAL DATA

Part VI CARE OF PERSONAL DATA

Part VII ENFORCEMENT OF PARTSĀ III TO VI

Part VIII APPEALS TO DATA PROTECTION APPEAL COMMITTEE, HIGH COURT AND COURT OF APPEAL

Part IX DO NOT CALL REGISTRY

Division 1 — Preliminary

Division 2 — Administration

Division 3 — Specified message to Singapore telephone number

Part X GENERAL

FIRST SCHEDULE Repealed

SECOND SCHEDULE Collection of personal data without consent

THIRD SCHEDULE Use of personal data without consent

FOURTH SCHEDULE Disclosure of personal data without consent

FIFTH SCHEDULE Exceptions from access requirement

SIXTH SCHEDULE Exceptions from correction requirement

SEVENTH SCHEDULE Constitution and proceedings of Data Protection Appeal Panel and Data Protection Appeal Committees

EIGHTH SCHEDULE Exclusion from meaning of "specified message"

NINTH SCHEDULE Powers of investigation of Commission and Inspectors

 
Slider
Left Corner
Print   Link to Viewed VersionLink to In-Force Version
 
On 22/11/2017, you requested the version in force on 22/11/2017 incorporating all amendments published on or before 22/11/2017. The closest version currently available is that of 02/10/2016.
Slider
FOURTH SCHEDULE
Sections 2, 17(3) and 21(4)
Disclosure of personal data without consent
1.  An organisation may disclose personal data about an individual without the consent of the individual in any of the following circumstances:
(a)
the disclosure is necessary for any purpose which is clearly in the interests of the individual, if consent for its disclosure cannot be obtained in a timely way;
(b)
the disclosure is necessary to respond to an emergency that threatens the life, health or safety of the individual or another individual;
(c)
subject to the conditions in paragraph 2, there are reasonable grounds to believe that the health or safety of the individual or another individual will be seriously affected and consent for the disclosure of the data cannot be obtained in a timely way;
(d)
the personal data is publicly available;
(e)
the disclosure is necessary in the national interest;
(f)
the disclosure is necessary for any investigation or proceedings;
(g)
the disclosure is to a public agency and such disclosure is necessary in the public interest;
(h)
the disclosure is necessary for evaluative purposes;
(i)
the disclosure is necessary for the organisation to recover a debt owed by the individual to the organisation or for the organisation to pay to the individual a debt owed by the organisation;
(j)
the disclosure is necessary for the provision of legal services by the organisation to another person or for the organisation to obtain legal services;
(k)
the personal data is disclosed by a member of a credit bureau to the credit bureau for the purpose of preparing credit reports, or in a credit report provided by a credit bureau to a member of the credit bureau in relation to a transaction between the member and the individual;
(l)
the personal data about the current or former students of the organisation, being an education institution, is disclosed to a public agency for the purposes of policy formulation or review;
(m)
the personal data about the current or former patients of a healthcare institution licensed under the Private Hospitals and Medical Clinics Act (Cap. 248) or any other prescribed healthcare body is disclosed to a public agency for the purposes of policy formulation or review;
(n)
the personal data is disclosed to any officer of a prescribed law enforcement agency, upon production of written authorisation signed by the head or director of that law enforcement agency or a person of a similar rank, certifying that the personal data is necessary for the purposes of the functions or duties of the officer;
(o)
the disclosure is for the purpose of contacting the next‑of‑kin or a friend of any injured, ill or deceased individual;
(p)
subject to the conditions in paragraph 3, the personal data —
(i)
is disclosed to a party or a prospective party to a business asset transaction with the organisation;
(ii)
is about an employee, customer, director, officer or shareholder of the organisation; and
(iii)
relates directly to the part of the organisation or its business assets with which the business asset transaction is concerned;
(q)
subject to the conditions in paragraph 4, the disclosure is for a research purpose, including historical or statistical research;
(r)
the disclosure is for archival or historical purposes if a reasonable person would not consider the personal data to be too sensitive to the individual to be disclosed at the proposed time; or
(s)
subject to the conditions in paragraph 5, the personal data —
(i)
was collected by the organisation in accordance with section 17(1); and
(ii)
is disclosed by the organisation for purposes consistent with the purpose of that collection.
2.  In the case of disclosure under paragraph 1(c), the organisation shall, as soon as may be practicable, notify the individual whose personal data is disclosed of the disclosure and the purposes of the disclosure.
3.—(1)  The conditions in this paragraph shall apply to personal data disclosed under paragraph 1(p).
(2)  In the case of disclosure to a prospective party to a business asset transaction —
(a)
the personal data must be necessary for the prospective party to determine whether to proceed with the business asset transaction; and
(b)
the organisation and prospective party must have entered into an agreement that requires the prospective party to use or disclose the personal data solely for purposes related to the business asset transaction.
(3)  If the organisation enters into the business asset transaction, the employees, customers, directors, officers and shareholders whose personal data is disclosed shall be notified that —
(a)
the business asset transaction has taken place; and
(b)
the personal data about them has been disclosed to the party.
(4)  In this paragraph and paragraph 1(p) —
“business asset transaction” means the purchase, sale, lease, merger or amalgamation or any other acquisition, disposal or financing of an organisation or a portion of an organisation or of any of the business or assets of an organisation other than the personal data to be disclosed under paragraph 1(p);
“party” means another organisation that enters into the business asset transaction with the organisation.
4.  Paragraph 1(q) shall not apply unless —
(a)
the research purpose cannot reasonably be accomplished without the personal data being provided in an individually identifiable form;
(b)
it is impracticable for the organisation to seek the consent of the individual for the disclosure;
(c)
the personal data will not be used to contact persons to ask them to participate in the research;
(d)
linkage of the personal data to other information is not harmful to the individuals identified by the personal data and the benefits to be derived from the linkage are clearly in the public interest; and
(e)
the organisation to which the personal data is to be disclosed has signed an agreement to comply with —
(i)
this Act;
(ii)
the policies and procedures relating to the confidentiality of personal data of the organisation that collected the personal data;
(iii)
security and confidentiality conditions of the organisation disclosing the personal data;
(iv)
a requirement to remove or destroy individual identifiers at the earliest reasonable opportunity; and
(v)
a requirement not to use the personal data for any other purpose or to disclose the personal data in individually identifiable form without the express authorisation of the organisation that disclosed the personal data.
5.  For the avoidance of doubt, personal data collected before the appointed day in the circumstances and conditions set out in the Second Schedule shall satisfy paragraph 1(s) notwithstanding that section 17(1) was not in force at the time of the collection.