I.C Privacy and data protection

Privacy and data protection are notions that may differ depending on regions and contexts. For the purposes of the checklist, privacy and data protection law is the law that sets the condition for the collection of, access to, use and transfer of data as well as for data storage and preservation. Often, that law establishes a dedicated authority for its enforcement.

The content of privacy and data protection laws may vary significantly. States may take inspiration from international standards. At the global level, the Organization for Economic Co-operation and Development (OECD) Guidelines on the Protection of Privacy and Transborder Flows of Personal Data 2013 offer a set of relevant principles. At the regional level, the Asia-Pacific Economic Cooperation (APEC) Privacy Framework 2015 also contains relevant principles that can be implemented through the APEC Cross-Border Privacy Rules (CBPR) System.

Privacy and data protection laws often protect a specific set of data, referred to as personal data, personal information or personally identifiable information. This set of data may include data relevant for paperless trade.

Privacy law may deal with the transfer of data (including data used in paperless trade) overseas. Often, exporting data is allowed only on the condition that the destination country provides equal data protection.

While Personal Data Protection Act 2012 is a baseline privacy legislation, it does not supersede other existing statues dealing with the protection of personal data such as the Banking Act 2008 (Cap. 19). Instead, it works in conjunction with them.

Section 26 of the Personal Data Protection Act 2012, Regulation 9 of the Personal Data Protection Regulations 2014 and Paragraph 19 of the Personal Data Protection Commission jointly provide a wide range of legal bases and mechanisms for transferring personal data to a country or territory outside Singapore. These measures include the use of contractual agreements to ensure that the recipient overseas is bound legally to provide a comparable standard of protection. The use of a contractual arrangement (bilaterally or regionally) is consistent with Article 7 of the Association of Southeast Asian Nations (ASEAN) Protocol to Establish and Implement ASEAN Single Window (ASW) 2015 (“Legal Framework”), to which Singapore is a party.

PART III to VI, Regulation 9(1)(a) and (b) of the Personal Data Protection Regulations 2014 sets out the requirements for transferring personal data outside Singapore and what constitutes a “legally enforceable obligation” that provides a standard of protection that is at least comparable to the protection under the Personal Data Protection Act 2012 to personal data transferred overseas pursuant to section 26.

Privacy and data protection in cross-border data transfer may also be governed by industry-specific agreements. For example, the privacy regime in the financial sector may be enforced by a delegated authority that regulates financial institutions and enforces the obligation under the laws governing financial transactions.

In some cases, laws are enacted to permit data flows from commercially significant partners. The European Union Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data – known as the General Data Protection Regulation, or “GDPR” – establishes a system for the transfer of data outside the European Union that may require such legislative action.

Cross-border provisions on privacy and data protection may also be contained in international agreements such as the electronic commerce chapters of free trade agreements. These provisions, which aim to ensure a level of legal uniformity, require States to develop privacy and data protection laws accordingly and may refer to international principles and guidelines.

International agreements may be bilateral or multilateral, of general application or sector specific.

The law may prescribe “data localization”, i.e. collection, processing and storage of data, or of certain types of data, in a particular jurisdiction. This may be done for security or other reasons. Data localization requirements may also be agreed upon in contracts. Data localization may significantly affect the design and operation of an information system; for instance, it may in practice impede the use of certain technology such as cloud computing.

Provisions on data localization may be found also in free trade agreements (FTA). However, in that case the provisions normally aim to limit the ability of states to require data localization, as this is seen as an obstacle to dataflows.

The notions of data integrity and data protection are usually used in different context. Data integrity has more to do with individual records: do I have a valid PKI certificate giving me assurance that this record has not been tampered with? Data protection has to do with protecting a database: do I have multifactor authentication to access my office email? Privacy is about limits to transfer data. As noted above (I.C.1), general privacy and data protection law could regulate all aspects of protecting personal information, including in paperless trade. However, sector specific laws (such as on banking or customs) may take precedence over general privacy laws. Contractual agreements (for example, with a single window operator) may also be relevant.

Commercial and trade-related documents may contain information, such as undisclosed know-how and trade secrets, that is confidential. Such information may be useful, for example, for marketing, supply-chain management or manufacturing purposes.

Confidentiality protects information from unauthorized access, use or disclosure that could be prejudicial to businesses’ interest. General laws on commercial confidentiality may apply to information in any form, including electronic. Specific laws on confidentiality of electronic information may also exist.

In Singapore, section 28 of the Electronic Transaction Act 2010 (Cap. 88) imposes confidentiality obligations where information is obtained in the performance of duties or exercise of powers under the Act.

Moreover, specific provisions may apply to certain instances, for example, disclosure of information submitted to an electronic single window. Australia has adopted a provision for protecting confidential information submitted in accordance with the Customs Act 1901 (Cth) from unauthorized disclosure, including information whose disclosure could prejudice the competitive position of the person providing the information.

Liability for disclosure of confidential information may arise from statutory or contractual provisions. Either civil or criminal liability is possible, or both.

Many countries have established general penalties against abusive access or alteration and other misuse of the information stored, communicated, or processed by a computer system or network. General cybercrime law could apply also to unauthorized access to information held in paperless trade systems.

In some cases, dedicated provisions may exist. Articles 30 to 33 of the Electronic Trade Facilitation Act 2015 of the Republic of Korea impose criminal sanctions for various abuses of the information of an electronic trade infrastructure business entity, which is an entity designated to manage an information system that “intermediates, keeps and certifies electronic trade documents by systematically interlinking traders with trade-related agencies through information and communications networks”.