Personal Data Protection Act 2012, PART 9A — DICTIONARY ATTACKS AND ADDRESS‑HARVESTING SOFTWARE (s 48A–s 48B) — Singapore Act

Interpretation of this Part

s 48A

48A.—(1) In this Part, unless the context otherwise requires —“address‑harvesting software” means software that is specifically designed or marketed for use for —(a) searching the Internet for telephone numbers; and (b) collecting, compiling, capturing or otherwise harvesting those telephone numbers; “applicable message” means a message with a Singapore link that is sent to any applicable telephone number; “applicable telephone number” means a telephone number that is generated or obtained through the use of —(a) a dictionary attack; or (b) address‑harvesting software; “dictionary attack” means the method by which the telephone number of a recipient is obtained using an automated means that generates possible telephone numbers by combining numbers into numerous permutations; “message”, “send”, “sender” and “Singapore telephone number” have the meanings given by section 36(1).[40/2020] (2) In this Part, an applicable message has a Singapore link in any of the following circumstances:(a) the message originates in Singapore; (b) the sender of the message —(i) where the sender is an individual — is physically present in Singapore when the message is sent; or (ii) in any other case —(A) is formed or recognised under the law of Singapore; or (B) has an office or a place of business in Singapore; (c) the telephone, mobile telephone or other device that is used to access the message is located in Singapore; (d) the recipient of the message —(i) where the recipient is an individual — is physically present in Singapore when the message is accessed; or (ii) in any other case — carries on business or activities in Singapore when the message is accessed; (e) if the message cannot be delivered because the telephone number to which the message is sent has ceased to exist (assuming that the telephone number existed), it is reasonably likely that the message would have been accessed using a telephone, mobile telephone or other device located in Singapore.[40/2020] (3) For the purposes of the definition of “applicable message” in subsection (1), it does not matter —(a) whether the telephone number to which the message is sent is a Singapore telephone number; (b) whether that telephone number exists; or (c) whether the message reaches its intended destination.[40/2020] (4) For the purposes of this Part, a telecommunications service provider that merely provides a service that enables an applicable message to be sent is, unless the contrary is proved, presumed not to have sent, caused to be sent or authorised the sending of the applicable message.[40/2020] (5) For the purposes of this Part, if, at the time an applicable message is sent, the telecommunications device, service or network from which it was sent was controlled by a person without the knowledge of the owner or authorised user of the telecommunications device, service or network (as the case may be), the owner or authorised user (as the case may be) is, unless the contrary is proved, presumed not to have sent, caused to be sent or authorised the sending of the applicable message.[40/2020] (6) In subsection (5), “control” means —(a) physical control; or (b) control through the use of software or other means.[40/2020] —(1) In this Part, unless the context otherwise requires —“address‑harvesting software” means software that is specifically designed or marketed for use for —(a) searching the Internet for telephone numbers; and (b) collecting, compiling, capturing or otherwise harvesting those telephone numbers; “applicable message” means a message with a Singapore link that is sent to any applicable telephone number; “applicable telephone number” means a telephone number that is generated or obtained through the use of —(a) a dictionary attack; or (b) address‑harvesting software; “dictionary attack” means the method by which the telephone number of a recipient is obtained using an automated means that generates possible telephone numbers by combining numbers into numerous permutations; “message”, “send”, “sender” and “Singapore telephone number” have the meanings given by section 36(1).[40/2020] (2) In this Part, an applicable message has a Singapore link in any of the following circumstances:(a) the message originates in Singapore; (b) the sender of the message —(i) where the sender is an individual — is physically present in Singapore when the message is sent; or (ii) in any other case —(A) is formed or recognised under the law of Singapore; or (B) has an office or a place of business in Singapore; (c) the telephone, mobile telephone or other device that is used to access the message is located in Singapore; (d) the recipient of the message —(i) where the recipient is an individual — is physically present in Singapore when the message is accessed; or (ii) in any other case — carries on business or activities in Singapore when the message is accessed; (e) if the message cannot be delivered because the telephone number to which the message is sent has ceased to exist (assuming that the telephone number existed), it is reasonably likely that the message would have been accessed using a telephone, mobile telephone or other device located in Singapore.[40/2020] (3) For the purposes of the definition of “applicable message” in subsection (1), it does not matter —(a) whether the telephone number to which the message is sent is a Singapore telephone number; (b) whether that telephone number exists; or (c) whether the message reaches its intended destination.[40/2020] (4) For the purposes of this Part, a telecommunications service provider that merely provides a service that enables an applicable message to be sent is, unless the contrary is proved, presumed not to have sent, caused to be sent or authorised the sending of the applicable message.[40/2020] (5) For the purposes of this Part, if, at the time an applicable message is sent, the telecommunications device, service or network from which it was sent was controlled by a person without the knowledge of the owner or authorised user of the telecommunications device, service or network (as the case may be), the owner or authorised user (as the case may be) is, unless the contrary is proved, presumed not to have sent, caused to be sent or authorised the sending of the applicable message.[40/2020] (6) In subsection (5), “control” means —(a) physical control; or (b) control through the use of software or other means.[40/2020]

Prohibition on use of dictionary attacks and address‑harvesting software

s 48B

48B.—(1) Subject to subsections (2) and (3), a person must not send, cause to be sent or authorise the sending of an applicable message.[40/2020] (2) Subsection (1) does not apply to an employee (P) who sends, causes to be sent or authorises the sending of an applicable message in good faith —(a) in the course of P’s employment; or (b) in accordance with instructions given to P by or on behalf of P’s employer in the course of P’s employment.[40/2020] (3) However, subsection (2) does not apply to a person (P) who, at the time the applicable message was sent, was an officer or a partner of the sender and it is proved that —(a) P knew or ought reasonably to have known that the telephone number is an applicable telephone number; and (b) the applicable message was sent with P’s consent or connivance, or the sending of the applicable message was attributable to any neglect on P’s part.[40/2020] (4) In this section —“corporation” has the meaning given by section 52(7); “officer” —(a) in relation to a corporation, has the meaning given by section 52(7); or (b) in relation to an unincorporated association (other than a partnership), has the meaning given by section 52A(7); “partner”, in relation to a partnership, has the meaning given by section 52A(7).[40/2020] —(1) Subject to subsections (2) and (3), a person must not send, cause to be sent or authorise the sending of an applicable message.[40/2020] (2) Subsection (1) does not apply to an employee (P) who sends, causes to be sent or authorises the sending of an applicable message in good faith —(a) in the course of P’s employment; or (b) in accordance with instructions given to P by or on behalf of P’s employer in the course of P’s employment.[40/2020] (3) However, subsection (2) does not apply to a person (P) who, at the time the applicable message was sent, was an officer or a partner of the sender and it is proved that —(a) P knew or ought reasonably to have known that the telephone number is an applicable telephone number; and (b) the applicable message was sent with P’s consent or connivance, or the sending of the applicable message was attributable to any neglect on P’s part.[40/2020] (4) In this section —“corporation” has the meaning given by section 52(7); “officer” —(a) in relation to a corporation, has the meaning given by section 52(7); or (b) in relation to an unincorporated association (other than a partnership), has the meaning given by section 52A(7); “partner”, in relation to a partnership, has the meaning given by section 52A(7).[40/2020]