§ 48E — Improper use of personal data

48E.—(1) If —(a)

an individual makes use of personal data in the possession or under the control of an organisation or a public agency;

(b)

the use is not authorised by the organisation or public agency, as the case may be;

(c)

the individual does so —(i)

knowing that the use is not authorised by the organisation or public agency, as the case may be; or

(ii)

reckless as to whether the use is or is not authorised by the organisation or public agency, as the case may be; and

(d)

the individual, as a result of that use —(i)

obtains a gain for the individual or another person;

(ii)

causes harm to another individual; or

(iii)

causes a loss to another person,

the individual shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 2 years or to both.

[40/2020]

(2) In proceedings for an offence under subsection (1), it is a defence to the charge for the accused to prove, on a balance of probabilities, any of the following:(a)

that —(i)

the personal data in the possession or under the control of the organisation or public agency (as the case may be) that was used was, at the time of the use, publicly available; and

(ii)

where the personal data was publicly available solely because of an applicable contravention, the accused did not know, and was not reckless as to whether, that was the case;

(b)

that the accused used the personal data in the possession or under the control of the organisation or public agency, as the case may be —(i)

as permitted or required by or under an Act or other law (apart from this Act);

(ii)

as authorised or required by an order of court;

(iii)

in the reasonable belief that, and was not reckless as to whether, the accused had the legal right to do so; or

(iv)

in any other circumstances, or for any other purpose, prescribed.[40/2020]

(3) To avoid doubt, subsection (2) does not affect any obligation or limitation imposed on, or prohibition of, the use of personal data in the possession or under the control of an organisation or a public agency (as the case may be) by or under any other written law or other law.[40/2020]

(4) In this section, “applicable contravention” means a contravention of any of the following:(a)

section 48D(1) or 48F(1);

(b)

section 7(1) or 8(1) of the Public Sector (Governance) Act 2018;

(c)

section 14A(1) or 14C(1) of the Monetary Authority of Singapore Act 1970.[40/2020]

—(1) If —(a)

an individual makes use of personal data in the possession or under the control of an organisation or a public agency;

(b)

the use is not authorised by the organisation or public agency, as the case may be;

(c)

the individual does so —(i)

knowing that the use is not authorised by the organisation or public agency, as the case may be; or

(ii)

reckless as to whether the use is or is not authorised by the organisation or public agency, as the case may be; and

(d)

the individual, as a result of that use —(i)

obtains a gain for the individual or another person;

(ii)

causes harm to another individual; or

(iii)

causes a loss to another person,

the individual shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 2 years or to both.

[40/2020]

(2) In proceedings for an offence under subsection (1), it is a defence to the charge for the accused to prove, on a balance of probabilities, any of the following:(a)

that —(i)

the personal data in the possession or under the control of the organisation or public agency (as the case may be) that was used was, at the time of the use, publicly available; and

(ii)

where the personal data was publicly available solely because of an applicable contravention, the accused did not know, and was not reckless as to whether, that was the case;

(b)

that the accused used the personal data in the possession or under the control of the organisation or public agency, as the case may be —(i)

as permitted or required by or under an Act or other law (apart from this Act);

(ii)

as authorised or required by an order of court;

(iii)

in the reasonable belief that, and was not reckless as to whether, the accused had the legal right to do so; or

(iv)

in any other circumstances, or for any other purpose, prescribed.[40/2020]

(3) To avoid doubt, subsection (2) does not affect any obligation or limitation imposed on, or prohibition of, the use of personal data in the possession or under the control of an organisation or a public agency (as the case may be) by or under any other written law or other law.[40/2020]

(4) In this section, “applicable contravention” means a contravention of any of the following:(a)

section 48D(1) or 48F(1);

(b)

section 7(1) or 8(1) of the Public Sector (Governance) Act 2018;

(c)

section 14A(1) or 14C(1) of the Monetary Authority of Singapore Act 1970.[40/2020]