The widely anticipated amendments of the Singapore Personal Data Protection Act were passed on Nov 2, 2020. The Singapore government, known for its rigour and openness, had run several consultations with the industry prior to making the changes. Why are the amendments significant?
The PDPA has traditionally been an Act that solely focused on protecting personal data. However, Singapore has introduced changes that provide companies with more flexibility to leverage customers’ data for innovation purposes – therefore bringing in an element of the competitive use of personal data. There is a caveat that organisations are expected to provide safeguards for the use of personal data under consent exceptions or deemed consent, as emphasised by Minister S Iswaran in Parliament.
Beyond the consent exceptions or deemed consent changes, the amendments introduced a new obligation – data portability. The concept of data portability was first introduced in the EU regulation General Data Protection Regulation (GDPR) as a data subject right. The aim was to provide data subjects with greater autonomy to determine how their personal data can be reused or transferred to another data controller. While Europe was the first to introduce the concept, its implementation has been limited because policymakers have not mandated technical standards. In contrast, Singapore is taking a more concrete approach. According to its public consultation document, the Personal Data Protection Commission (PDPC) intends to develop a “white list” of data categories to which the Data Portability Obligation applies, as well as provide the technical and procedural details.
Governments around the world recognise the value of data, especially in the digital economy. Many digital companies that have emerged in the last few decades benefited from their ability to harness personal data and provide tailored solutions. The Covid-19 pandemic also demonstrated to governments around the world the resilience of the digital economy. Therefore, their interests are in the right place. Moreover, Singapore is not alone in the pursuit of policies that facilitate some form of data sharing between organisations. Australia’s Consumer Data Right framework, which allows customers to share data with other financial service providers, has caught the attention of global policymakers. Meanwhile, India’s upcoming frameworks on personal data and non-personal data are also likely to touch on data sharing.
But are the changes made to the PDPA in Singapore sufficient to spur greater innovation among companies? It depends on the implementation. Mandating requirements that are too stringent may raise several concerns. For smaller companies, requirements that are too onerous may discourage them from leveraging the tool. For the market leaders, worries over the potential infringement of proprietary data may make them less motivated to engage in R&D. Of course, this is a simple way of describing the potential outcome. The situation is much more complex. Trust would have to be fostered between organisations and consumers, and policymakers would have to work through the implementation to ensure that the public benefits outweigh the costs. Costs may include those of companies implementing the technical measures, that of potentially deterring future investments in Singapore, and others.
STABLE POLICIES
It is, however, highly unlikely that the data portability rules alone would drive innovative companies out of the country. While its market size is small, Singapore offers stable and sound policies that continue to attract companies to set up their headquarters here. Hyundai’s decision to set up its innovation centre here is a testament that Singapore has much to offer to companies that are venturing into emerging technology.
Singapore’s motivation to drive the digital economy and innovation was especially evident at the onset of the Covid-19 pandemic. Its stimulus packages were very focused on encouraging digitalisation among SMEs and skills upgrading among its people. Moreover, Singapore remains open to skilled talents. For companies that are embarking on digital innovation, having access to a pool of skilled talents is one of the primary driving factors. Moreover, at a time when Covid-19 has created a lot of uncertainties around supply chains, coupled with the ongoing US-China tensions, Singapore offers the much-needed certainty for companies to deepen their roots in the country and invest in R&D.
All in all, the data portability rules, if implemented well, could help Singapore make its mark as an innovation hub. It could also set an exemplary framework for other countries that are also looking to implement a data-sharing framework. To achieve this, the PDPC would have to work very closely with all stakeholders and develop a nuanced approach. The least ideal situation is one where the data portability rules become an elephant in the room and do not achieve its original intent.
This article was originally published at Business Times on 5 November 2020.
