In brief
In a recent decision by the Personal Data Protection Commission (PDPC) in Re Fullerton Healthcare Group Pte Limited and Agape CP Holdings Pte Ltd [2023] SGPDPC 5, the PDPC found that the respondents breached the protection obligation under the Personal Data Protection Act (PDPA) and ordered each of them to pay a financial penalty.
Key takeaways
This is not the first PDPC decision where the PDPC emphasized the need for organizations to conduct periodic security reviews of their IT systems, and the need for organizations to exercise reasonable oversight of their vendors. Organizations should take heed of these reminders from the PDPC. The PDPC also commented that in quantifying the financial penalties to be imposed on an organization, it is immaterial that the organization is a social enterprise — the standard of security arrangements expected under the protection obligation will depend on the volume and nature of personal data in the organization’s possession or control, regardless of whether the organization is a for-profit business, a charity or a social enterprise.
In more detail
The first respondent, Fullerton Healthcare Group Pte Limited (FHG), provides healthcare services to individuals and employees of its corporate clients. It engaged the second respondent, Agape CP Holdings Pte Ltd. (“Agape“), a business process outsourcing provider and social enterprise, to provide call center and appointment booking services for its customers. Agape thus acted as FHG’s data intermediary.
To carry out the services, FHG provided Agape with access to the personal data of its customers via Microsoft SharePoint, a cloud-based document management system. Agape downloaded FHG’s customer data onto a computer and reuploaded the customer data onto an internet-facing file server (“Online Drive“) for use by Agape’s agents.
In October 2021, FHG became aware that its customer data, including their name, NRIC number, date of birth, financial information and health information, was being offered for sale on a dark web forum. After investigations, it was discovered that the seller had exfiltrated FHG’s customer data from Agape’s Online Drive.
The PDPC found that Agape had contravened its protection obligation under the PDPA, as it failed to conduct reasonable periodic security reviews and assess the Online Drive’s security implications and risks. At the time of the incident, the password for Agape’s Online Drive had been inadvertently disabled for an estimated 20 months (since December 2019), the cause of which could not be established. This caused the Online Drive to become an open directory listing on the internet with no password protection, and highly vulnerable to unauthorized access, modification and similar risks over an excessive period.
The PDPC also found that similarly, FHG had breached its protection obligation under the PDPA. FHG failed to make sufficient enquiries as to how Agape was storing, transmitting and retaining its customer data, thereby failing to exercise reasonable oversight of Agape’s data processing activities. FHG also failed to implement robust measures to ensure that only personal data necessary for performance of the services was shared with Agape, and inadvertently disclosed personal data only intended for its employees’ internal use, onto the SharePoint system shared with Agape.
Following the incident, FHG and Agape voluntarily implemented measures to prevent a recurrence of the incident or similar events.
The PDPC ordered FHG to pay a financial penalty of SGD 58,000, and Agape to pay a financial penalty of SGD 10,000. In particular, the PDPC observed that in quantifying the financial penalties imposed, no weight was placed on Agape’s status as a social enterprise. The PDPC commented that the standard of security arrangements expected under the protection obligation will depend on the volume and nature of personal data in the organization’s possession or control, regardless of whether the organization is a for-profit business, a charity or a social enterprise.
* * * * *
For further information and to discuss what this might mean for you, please get in touch with your usual Baker McKenzie contact.
* * * * *
© 2023 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “principal” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
