In brief
On 31 July 2023, the Smart Nation and Digital Government Office (“SNDGO“) published the fourth annual update (“Fourth Annual Report“) on the government’s personal data protection efforts, detailing the government’s measures to strengthen the public sector data security regime between 1 April 2022 and 31 March 2023.
In more detail
The Public Sector Data Security Review Committee (“PSDRC“) was set up in 2019 following a series of cyber-security breaches, including the infamous June 2018 SingHealth breach where 1.5 million patients’ data were stolen and which is considered the worst cybersecurity attack in Singapore to date.
This Fourth Annual Report is part of the government’s ongoing effort to secure and protect citizens’ data.
Trends in number of government data incidents reported
There were 182 data incidents reported in FY2022, an increase of 2% from the 178 incidents reported in FY2021.
All incidents reported in FY2022 were of low to medium severity, and there had been no high-severity incidents for the past three years under the report’s five-tier classification system (ranging from low to very severe). High severity incidents were defined as those damaging to national security or public confidence. Of the cases between 1 April 2022 to March 31 2023, 136 were of low severity — incidents with “minimal impact” on agencies, individuals and businesses.
Government’s initiatives to strengthen data security
Launch of the Whole-of-Government (“WOG”) Central Privacy Toolkit
In March 2023, the inaugural WOG Central Privacy Toolkit was launched. The toolkit is a self-service portal that allows public officers to apply privacy-enhancing techniques to datasets while preserving the data’s value. This allows data to be shared within and outside of the public sector in a more rapid, confident and secure manner, while mitigating the risk of data leaks that stem from sharing datasets. To date, the toolkit has been used by over 80 government agencies.
Progressive roll-out of remaining technical measures to prevent data compromises
As of 31 March 2023, 22 of the 24 initiatives suggested by the PSDRC have been implemented in order to effectuate the five key recommendations, as follows, provided by the PSDRC:
- Enhance technology and processes to effectively protect data against security threats and prevent data compromises
- Strengthen processes to detect and respond to data incidents swiftly and effectively
- Improve culture of excellence around sharing and using data securely and raise public officers’ competencies in safeguarding data
- Enhance frameworks and processes to improve the accountability and transparency of the public sector data security regime
- Introduce and strengthen organizational and governance structures to drive a resilient public sector data security regime that can meet future needs
The government is on track to complete the implementation of all 24 initiatives by the end of FY2023. Some recent changes include the development of a Central Accounts Management solution, which has helped improve data access control and prevent data compromises by “promptly removing expired access rights.” Additionally, the WOG Central Privacy Toolkit was launched in March, allowing public officers, including those not trained, to apply “privacy enhancing techniques” to datasets, allowing for data to be shared more securely.
Enhancing competencies in public service
The government has undertaken exercises to build its competency to provide a coordinated and effective response to data incidents. The full FY2022 report can be found on the “A Secure Smart Nation” microsite (go.gov.sg/public-sector-data-security-review).
* * * * *
© 2023 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “principal” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
