Search for:
Singapore

Singapore: Healthcare services provider and its vendor fined after data leak

By 4 Mins Read

In brief

A Singapore-based healthcare services provider and its vendor have been fined a total of SGD 68,000 following a data breach incident which led to patients’ data being put up for sale on the dark web in 2021.

Key takeaways

  • Even if a data intermediary or vendor is engaged to implement necessary data protection measures, the data controller bears the responsibility of exercising reasonable oversight of the vendor. A data controller may be found in breach of the Personal Data Protection Act 2012 (PDPA) even if its data intermediary or vendor is not.
  • With the immense value of health data, companies in the healthcare and life sciences space should conduct periodic security reviews of their IT systems.

In more detail

In October 2021, a healthcare services provider became aware that its customer data was being offered for sale on a dark web forum. The cybersecurity consultants it engaged thereafter made contact with the purported seller of the data, who claimed that he had exfiltrated the healthcare services provider’s online drive.

As a result of the data breach, the personal data of more than 150,000 patients and employees of the healthcare services provider’s corporate clients were accessed without authorisation. The personal data included identity numbers, financial details such as bank account numbers and codes, as well as health information.

The Personal Data Protection Commission (PDPC) found that the healthcare services provider had exacerbated the situation by inadvertently disclosing unnecessary sensitive personal data, which was only intended for its employees’ internal use, onto the online drive shared with the vendor. This included sensitive financial information and health information such as codes for surgical procedures done in hospitals. These datasets were not required by the vendor.

In assessing the penalties that the healthcare services provider and its vendor should be subject to, the PDPC took into account the following mitigating factors:

  • The healthcare services provider and its vendor were cooperative during the investigations.
  • The healthcare services provider and its vendor voluntarily admitted to their breaches under the PDPA.
  • The healthcare services provider and its vendor took prompt remedial actions following discovery of the incident.

The PDPC also took into account that the vendor’s breaches of the PDPC were more causally proximate to the unauthorised access and disclosure of personal data in the incident, but the healthcare services provider’s inadvertent disclosure of financial and health related data resulted in the impact of the incident being amplified. Further, the healthcare services provider, as data controller, also bore the responsibility of exercising due diligence and reasonable supervision over its vendor.

Against these factors and also considering the difference between both companies’ annual turnovers, where the healthcare services provider’s annual turnover was almost 50 times higher than that of its vendor, the PDPC imposed a fine of SGD 58,000 on the healthcare services provider and SGD 10,000 on its vendor.

The maximum amount that a company can be fined for being in breach of the PDPA is 10 per cent of its annual turnover in Singapore (for companies whose annual turnover in Singapore exceeds SGD 10 million) or SGD 1 million.

* * * * *

LOGO_Wong&Leow_Singapore

© 2023 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “principal” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.

Categories:
Author

Andy Leck is the head of the Intellectual Property and Technology (IPTech) Practice Group and a member of the Dispute Resolution Practice Group in Singapore. He is a core member of Baker McKenzie's regional IP practice and also leads the Myanmar IP Practice Group. Andy is recognised by reputable global industry and legal publications as a leader in his field. He was named on "The A-List: Singapore's Top 100 lawyers" by Asia Business Law Journal 2018. In addition, Chambers Asia Pacific notes that Andy is "a well-known IP practitioner who is highlighted for his record of handling major trade mark litigation, as well as commercial exploitation of IP rights in the media and technology sectors. He's been in the industry for a long time and has always been held in high regard. He is known to be very fair and is someone you would like to be in the trenches with you during negotiations." Furthermore, Asian Legal Business acknowledges Andy as a leading practitioner in his field and notes that he “always gives good, quick advice, [is] client-focused and has strong technical knowledge for his areas of practice.” Andy was appointed by the Intellectual Property Office of Singapore (IPOS) as an IP Adjudicator to hear disputes at IPOS for a two-year term from April 2021. He has been an appointed member of the Singapore Copyright Tribunal since May 2010 and a mediator with the WIPO Arbitration and Mediation Center. He is also appointed as a Notary Public & Commissioner for Oaths in Singapore. He previously served on the International Trademark Association’s Board of Directors and was a member of the executive committee.

Author

Ren Jun Lim is a principal with Baker McKenzie Wong & Leow. He represents local and international clients in both contentious and non-contentious intellectual property matters. He also advises on a full range of healthcare, as well as consumer goods-related legal and regulatory issues. Ren Jun co-leads Baker McKenzie Wong & Leow's Healthcare as well as Consumer Goods & Retail industry groups. He sits on the Law Society of Singapore IP Committee and on the Executive Committee of the Association of Information Security Professionals. He is also a member of the Vaccines Working Group, Singapore Association of Pharmaceutical Industries, a member of the International Trademark Association, as well as a member of the Regulatory Affairs Professionals Association. Ren Jun is ranked in the Silver tier for Individuals: Enforcement and Litigation and Individuals: Prosecution and Strategy, and a recommended lawyer for Individuals: Transactions by WTR 1000, 2020. He is also listed in Asia IP's Best 50 IP Expert, 2020, recognised as a Rising Star by Managing IP: IP Stars, 2019 and one of Singapore's 70 most influential lawyers aged 40 and under by Singapore Business Review, 2016. Ren Jun was acknowledged by WTR 1000 as a "trademark connoisseur who boasts supplementary knowledge of regulatory issues in the consumer products industry." He was also commended by clients for being "very responsive to enquiries and with a keen eye for detail, he is extremely hands-on. His meticulous and in-depth approach to strategising is key to the excellent outcomes we enjoy."

Related Posts