Channel NewsAsia

Sector-specific data protection guidelines up for public feedback

Proposed guidelines for the education, social services, healthcare and photography sectors were released for public consultation on Friday. The guidelines are to help organisations interpret and apply the Personal Data Protection Act (PDPA).

SINGAPORE: The education, social services, healthcare and photography sectors will have new guidelines to help them interpret and apply the Personal Data Protection Act (PDPA).

Proposed guidelines for these sectors were released by the Personal Data Protection Commission (PDPC) for public consultation on Friday.

This follows finalised guidelines for the telecommunications and real estate sectors which the PDPC released, also on Friday, after they were opened for consultation early this year.

The Personal Data Protection Act takes effect in phases starting with the provisions relating to the formation of the Personal Data Protection Commission on 2 January 2013.

Provisions relating to the Do Not Call Registry came into effect on 2 January 2014 and the main data protection rules will come into force on 2 July 2014.

This allows time for organisations to review and adopt internal personal data protection policies and practices, to help them comply with the Act.

Your doctor recommends you visit a specialist and you verbally agree.

Can he share your particulars with the specialist for the purpose of the referral?

The answer is "yes".

This and other scenarios will be addressed in guidelines to be worked on for the healthcare, education, social service and photography sectors to provide greater clarity on their obligations under the Personal Data Protection Act.

Communications and Information Minister Dr Yaacob Ibrahim announced this when he opened the Personal Data Protection Seminar on Friday.

Dr Yaacob said the guidelines will address sector-specific matters, such as the collection of personal data from patients seeking medical care as well as the collection, use and disclosure of personal data for admission into schools and coordination of timely provision of social services.

The new sectors were picked as they handle high volumes of personal data.

Leon Luai, head of clinical services and wellness at NTUC Unity's Family Medicine Clinic, said: "When we send blood samples to laboratories for test, we include quite a lot of information such as a patient's name, NRIC number, address and sex.

"With the implementation of this Act, we need to be mindful of the information we are sharing with external parties.

"Hence this is something we hope the commission can provide clearer guidelines on."

To comply with the Personal Data Protection Act, NTUC Unity will also implement non-disclosure forms, to be signed by all medical group staff and laboratories partners, and consent forms for patients.

There are also concerns about the capability of Small and Medium Enterprises (SMEs) to cope with the Act.

Stephen Lim, Singapore Chinese Chamber of Commerce and Industry's chairman of technology committee, said: "SMEs, especially, face tight labour force - releasing people for training and also assigning people to continue implementing these processes.

"Of course, big companies have no problems. If they are a big organisation, they must have implemented such procedures in many of their operations as well.

"Even though SMEs are aware, the amount of help is not that available."

The Personal Data Protection Commission will also introduce a two-day course to walk companies through key points under the Personal Data Protection Act.

The first run of the course is expected to start soon.

Recently finalised guidelines for the telecommunication and real estate sectors were released on Friday, with new scenarios added, following feedback.

An example is the marketing of potential en-bloc sale.

Estate agents, who have compiled a contact list from various sources including the Management Corporation to market a potential en-bloc sale, are required to obtain consent from the individuals on or before collecting and using their personal data, unless exceptions apply.

Those with personal data-related complaints can consult the Consumers Association of Singapore (CASE) and the Singapore Mediation Centre.

A Memorandum of Intent on this was signed on Friday by the Personal Data Protection Commission, CASE and the Singapore Mediation Centre.

Tweet Photos, Videos and Update on this Story to  #cna