§ 48J — Financial penalties

48J.—(1) Subject to subsection (2), the Commission may, if it is satisfied that —(a)

an organisation has intentionally or negligently contravened any provision of Part 3, 4, 5, 6, 6A or 6B; or

(b)

a person has intentionally or negligently contravened —(i)

any provision of Part 9; or

(ii)

section 48B(1),

require, by written notice, the organisation or person (as the case may be) to pay a financial penalty.

[40/2020]

(2) Subsection (1) does not apply in relation to any contravention of a provision of this Act, the breach of which is an offence under this Act.[40/2020]

(3) A financial penalty imposed on an organisation under subsection (1)(a) must not exceed the maximum amount to be prescribed, which in no case may be more than the following:(a)

in the case of a contravention on or after the date of commencement of section 24 of the Personal Data Protection (Amendment) Act 2020 by an organisation whose annual turnover in Singapore exceeds $10 million — 10% of the annual turnover in Singapore of the organisation;

(b)

in any other case — $1 million.[Act 40 of 2020 wef 01/10/2022]

(4) A financial penalty imposed on a person under subsection (1)(b)(i) must not exceed the maximum amount to be prescribed, which in no case may be more than the following:(a)

in the case of an individual — $200,000;

(b)

in any other case — $1 million.[40/2020]

[Act 40 of 2020 wef 01/10/2022]

(4A) A financial penalty imposed on a person under subsection (1)(b)(ii) must not exceed the maximum amount to be prescribed, which in no case may be more than the following:(a)

in the case of an individual — $200,000;

(b)

in the case of a contravention on or after the date of commencement of section 24 of the Personal Data Protection (Amendment) Act 2020 by a person whose annual turnover in Singapore exceeds $20 million — 5% of the annual turnover of the person in Singapore;

(c)

in any other case — $1 million.[Act 40 of 2020 wef 01/10/2022]

(5) For the purposes of subsections (3) and (4), different maximum amounts may be prescribed in respect of contraventions of different provisions of this Act.[40/2020]

(5A) For the purposes of subsections (3)(a) and (4A)(b), the annual turnover in Singapore of an organisation or a person (as the case may be) is the amount ascertained from the most recent audited accounts of the organisation or person available at the time the financial penalty is imposed on that organisation or person.[Act 40 of 2020 wef 01/10/2022]

(6) The Commission must, in determining the amount of a financial penalty imposed under subsection (1), have regard to, and give such weight as the Commission considers appropriate to, all of the following matters:(a)

the nature, gravity and duration of the non‑compliance by the organisation or person, as the case may be;

(b)

the type and nature of the personal data affected by the non‑compliance by the organisation or person, as the case may be;

(c)

whether the organisation or person (as the case may be), as a result of the non‑compliance, gained any financial benefit or avoided any financial loss;

(d)

whether the organisation or person (as the case may be) took any action to mitigate the effects and consequences of the non‑compliance, and the timeliness and effectiveness of that action;

(e)

whether the organisation or person (as the case may be) had, despite the non‑compliance, implemented adequate and appropriate measures for compliance with the requirements under this Act;

(f)

whether the organisation or person (as the case may be) had previously failed to comply with this Act;

(g)

the compliance of the organisation or person (as the case may be) with any direction given under section 48I or 48L(4) in relation to remedying or mitigating the effect of the non‑compliance;

(h)

whether the financial penalty to be imposed is proportionate and effective, having regard to achieving compliance and deterring non‑compliance with this Act;

(i)

the likely impact of the imposition of the financial penalty on the organisation or person (as the case may be), including the ability of the organisation or person to continue the usual activities of the organisation or person;

(j)

any other matter that may be relevant.[40/2020]

—(1) Subject to subsection (2), the Commission may, if it is satisfied that —(a)

an organisation has intentionally or negligently contravened any provision of Part 3, 4, 5, 6, 6A or 6B; or

(b)

a person has intentionally or negligently contravened —(i)

any provision of Part 9; or

(ii)

section 48B(1),

require, by written notice, the organisation or person (as the case may be) to pay a financial penalty.

[40/2020]

(2) Subsection (1) does not apply in relation to any contravention of a provision of this Act, the breach of which is an offence under this Act.[40/2020]

(3) A financial penalty imposed on an organisation under subsection (1)(a) must not exceed the maximum amount to be prescribed, which in no case may be more than the following:(a)

in the case of a contravention on or after the date of commencement of section 24 of the Personal Data Protection (Amendment) Act 2020 by an organisation whose annual turnover in Singapore exceeds $10 million — 10% of the annual turnover in Singapore of the organisation;

(b)

in any other case — $1 million.[Act 40 of 2020 wef 01/10/2022]

(4) A financial penalty imposed on a person under subsection (1)(b)(i) must not exceed the maximum amount to be prescribed, which in no case may be more than the following:(a)

in the case of an individual — $200,000;

(b)

in any other case — $1 million.[40/2020]

[Act 40 of 2020 wef 01/10/2022]

(4A) A financial penalty imposed on a person under subsection (1)(b)(ii) must not exceed the maximum amount to be prescribed, which in no case may be more than the following:(a)

in the case of an individual — $200,000;

(b)

in the case of a contravention on or after the date of commencement of section 24 of the Personal Data Protection (Amendment) Act 2020 by a person whose annual turnover in Singapore exceeds $20 million — 5% of the annual turnover of the person in Singapore;

(c)

in any other case — $1 million.[Act 40 of 2020 wef 01/10/2022]

(5) For the purposes of subsections (3) and (4), different maximum amounts may be prescribed in respect of contraventions of different provisions of this Act.[40/2020]

(5A) For the purposes of subsections (3)(a) and (4A)(b), the annual turnover in Singapore of an organisation or a person (as the case may be) is the amount ascertained from the most recent audited accounts of the organisation or person available at the time the financial penalty is imposed on that organisation or person.[Act 40 of 2020 wef 01/10/2022]

(6) The Commission must, in determining the amount of a financial penalty imposed under subsection (1), have regard to, and give such weight as the Commission considers appropriate to, all of the following matters:(a)

the nature, gravity and duration of the non‑compliance by the organisation or person, as the case may be;

(b)

the type and nature of the personal data affected by the non‑compliance by the organisation or person, as the case may be;

(c)

whether the organisation or person (as the case may be), as a result of the non‑compliance, gained any financial benefit or avoided any financial loss;

(d)

whether the organisation or person (as the case may be) took any action to mitigate the effects and consequences of the non‑compliance, and the timeliness and effectiveness of that action;

(e)

whether the organisation or person (as the case may be) had, despite the non‑compliance, implemented adequate and appropriate measures for compliance with the requirements under this Act;

(f)

whether the organisation or person (as the case may be) had previously failed to comply with this Act;

(g)

the compliance of the organisation or person (as the case may be) with any direction given under section 48I or 48L(4) in relation to remedying or mitigating the effect of the non‑compliance;

(h)

whether the financial penalty to be imposed is proportionate and effective, having regard to achieving compliance and deterring non‑compliance with this Act;

(i)

the likely impact of the imposition of the financial penalty on the organisation or person (as the case may be), including the ability of the organisation or person to continue the usual activities of the organisation or person;

(j)

any other matter that may be relevant.[40/2020]