Limitation of purpose and extent
18. An organisation may collect, use or disclose personal data about an individual only for purposes —(a) that a reasonable person would consider appropriate in the circumstances; and (b) that the individual has been informed of under section 20, if applicable.
Personal data collected before 2 July 2014
19. Despite the other provisions in this Part, an organisation may use personal data about an individual collected before 2 July 2014 for the purposes for which the personal data was collected unless —(a) consent for such use is withdrawn in accordance with section 16; or (b) the individual, whether before, on or after 2 July 2014, has otherwise indicated to the organisation that he or she does not consent to the use of the personal data.
Notification of purpose
20.—(1) For the purposes of sections 14(1)(a) and 18(b), an organisation must inform the individual of —(a) the purposes for the collection, use or disclosure of the personal data (as the case may be) on or before collecting the personal data; (b) any other purpose of the use or disclosure of the personal data of which the individual has not been informed under paragraph (a), before the use or disclosure of the personal data for that purpose; and (c) on request by the individual, the business contact information of a person who is able to answer on behalf of the organisation the individual’s questions about the collection, use or disclosure of the personal data. (2) An organisation, on or before collecting personal data about an individual from another organisation without the individual’s consent, must provide the other organisation with sufficient information regarding the purpose of the collection to allow that other organisation to determine whether the disclosure would be in accordance with this Act. (3) Subsection (1) does not apply if —(a) the individual is deemed to have consented to the collection, use or disclosure (as the case may be) under section 15 or 15A; or (b) the organisation collects, uses or discloses the personal data without the individual’s consent in accordance with section 17.[40/2020] (4) Despite subsection (3), an organisation must comply with subsection (5) on or before collecting, using or disclosing personal data about an individual for the purpose of or in relation to the organisation —(a) entering into an employment relationship with the individual or appointing the individual to any office; or (b) managing or terminating the employment relationship with or appointment of the individual.[40/2020] (5) For the purposes of subsection (4), the organisation must inform the individual of the following:(a) the purpose for which the organisation is collecting, using or disclosing (as the case may be) the personal data about the individual; (b) on request by the individual, the business contact information of a person who is able to answer the individual’s questions about that collection, use or disclosure (as the case may be) on behalf of the organisation.[40/2020] —(1) For the purposes of sections 14(1)(a) and 18(b), an organisation must inform the individual of —(a) the purposes for the collection, use or disclosure of the personal data (as the case may be) on or before collecting the personal data; (b) any other purpose of the use or disclosure of the personal data of which the individual has not been informed under paragraph (a), before the use or disclosure of the personal data for that purpose; and (c) on request by the individual, the business contact information of a person who is able to answer on behalf of the organisation the individual’s questions about the collection, use or disclosure of the personal data. (2) An organisation, on or before collecting personal data about an individual from another organisation without the individual’s consent, must provide the other organisation with sufficient information regarding the purpose of the collection to allow that other organisation to determine whether the disclosure would be in accordance with this Act. (3) Subsection (1) does not apply if —(a) the individual is deemed to have consented to the collection, use or disclosure (as the case may be) under section 15 or 15A; or (b) the organisation collects, uses or discloses the personal data without the individual’s consent in accordance with section 17.[40/2020] (4) Despite subsection (3), an organisation must comply with subsection (5) on or before collecting, using or disclosing personal data about an individual for the purpose of or in relation to the organisation —(a) entering into an employment relationship with the individual or appointing the individual to any office; or (b) managing or terminating the employment relationship with or appointment of the individual.[40/2020] (5) For the purposes of subsection (4), the organisation must inform the individual of the following:(a) the purpose for which the organisation is collecting, using or disclosing (as the case may be) the personal data about the individual; (b) on request by the individual, the business contact information of a person who is able to answer the individual’s questions about that collection, use or disclosure (as the case may be) on behalf of the organisation.[40/2020]
Provisions on this page are reproduced verbatim from official open data. See the attribution line.
Source: Singapore Statutes Online (Attorney-General's Chambers), © Government of Singapore.