Singapore PDPC Data Protection Decisions

PDPC Decision on Institute of Mental Health Data Consent

The Singapore Personal Data Protection Commission (PDPC) amended a previous decision concerning the Institute of Mental Health (IMH). The amendment clarifies the factual background regarding IMH's use of patient data for research study recruitment, specifically addressing implied consent and the visibility of a notification to patients.

Goldheart Jewelry Data Breach Decision

Singapore's Personal Data Protection Commission has issued a decision against Goldheart Jewelry Pte. Ltd. for a data breach affecting 41,379 individuals. The breach resulted from insufficient security measures, including a failure to implement adequate patch management and access controls, leading to unauthorized access and disclosure of personal data.

PDPC Decision on Data Protection and Accountability

Singapore's Personal Data Protection Commission (PDPC) issued a decision against Air Sino-Euro Associates Travel Pte. Ltd. for failing to protect customer data, resulting in unauthorized access and disclosure. The organization also failed to appoint a data protection officer and implement internal policies.

Marina Bay Sands Data Breach Penalty Decision

Singapore's Personal Data Protection Commission has issued a decision against Marina Bay Sands Pte. Ltd. for a data breach affecting approximately 665,495 members. The breach resulted from insufficient security arrangements and a failure to mitigate risks of human error, leading to unauthorized access and disclosure of personal data. A financial penalty has been imposed.

PDPC Decision on Data Protection Breach by People Central Pte. Ltd.

Singapore's Personal Data Protection Commission (PDPC) issued a decision against People Central Pte. Ltd. for breaching data protection obligations. The company experienced an unauthorized access and deletion of client employee data due to insufficient security arrangements, including SQL injection vulnerabilities and weak access controls. The decision was handled under an expedited procedure due to the organization's admission of facts and breach.