Clause 43

by deleting subsection (2) and substituting the following subsection:“(2) In proceedings for an offence under subsection (1), it is a defence for the defendant to prove, on a balance of probabilities, any of the following:

the information under the control of the Singapore public sector agency was, at the time of its disclosure by the defendant, generally available information;

the defendant disclosed or caused the disclosure of information under the control of a Singapore public sector agency —

as permitted or required by or under an Act or other law (apart from this Act);

as authorised or required by an order of court; or

in any other circumstances, or for any other purpose, prescribed.”;

by deleting subsections (3) and (4) and substituting the following subsections:“(3) If —

an individual makes use of information under the control of a Singapore public sector agency (A);

the use is not authorised by any data sharing direction given to A;

the individual is a relevant public official of A or another Singapore public sector agency at the time of the use;

the individual does so —

knowing that the use is not in accordance with such a data sharing direction; or

reckless as to whether the use is or is not in accordance with such a data sharing direction; and

the individual as a result of that use —

obtains a gain for the individual or another person;

causes harm to another individual; or (iii)causes a loss to another person,the individual shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 2 years or to both.(3A) If —

an individual makes use of information (other than personal data) under the control of a Singapore public sector agency (A);

the use is not authorised by A;

the individual is —

a contractor supplying goods or services to A or to another Singapore public sector agency; or

an employee of a person who is a contractor supplying goods or services to A or to another Singapore public sector agency;

the individual does so —

knowing that the use is not authorised by A; or

reckless as to whether the use is or is not authorised by A; and

the individual, as a result of that use —

obtains a gain for the individual or another person;

causes harm to another individual; or

causes a loss to another person,the individual shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 2 years or to both.(4) In proceedings for an offence under subsection (3) or (3A), it is a defence for the defendant to prove, on a balance of probabilities, any of the following:

that the information under the control of A that was used was, at the time of its use, generally available information;

the defendant used the information under the control of A —

as permitted or required by or under an Act or other law (apart from this Act);

as authorised or required by an order of court; or

in any other circumstances, or for any other purpose, prescribed.(4A) To avoid doubt, subsection (2) or (4) does not affect any obligation or limitation imposed on, or prohibition of, the disclosure or use of information under the control of a Singapore public sector agency by or under any other written law or other law.”; and

by inserting, immediately after the definition of “generally available information” in subsection (5), the following definitions:“ “harm”, in relation to an individual, means —

any physical harm; or

harassment, alarm or distress caused to the individual;“loss” means —

a loss in property or a supply of services, whether temporary or permanent; or

a loss of an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of remuneration,but excludes, in relation to an individual, the loss of personal data about the individual;“personal data” has the meaning given by section 2(1) of the Personal Data Protection Act 2012 (Act 26 of 2012);”.

by deleting the word “or” at the end of subsection (2)(a);

by deleting the word “or” at the end of subsection (2)(b)(i);

by deleting the full‑stop at the end of sub‑paragraph (ii) of subsection (2)(b) and substituting the word “; or”, and by inserting immediately thereafter the following sub‑paragraph:“(iii)in any other circumstances, or for any other purpose, prescribed; or”;

by inserting, immediately after paragraph (b) of subsection (2), the following paragraph:“(c)the accused —

reasonably believed that the re‑identification was for a specified purpose; and

notified either of the following agencies of the re‑identification as soon as was practicable:

the Singapore public sector agency;

the Government Technology Agency.”;

by inserting, immediately after subsection (2), the following subsection:“(2A) To avoid doubt, subsection (2) does not affect any obligation or limitation imposed on, or prohibition of, the re‑identification of anonymised information under the control of a Singapore public sector agency by or under any other written law or other law.”;

by inserting, immediately after the definition of “anonymised information” in subsection (3), the following definitions:“ “Government Technology Agency” means the Government Technology Agency established by section 3 of the Government Technology Agency Act 2016 (Act 23 of 2016);“personal data” has the meaning given by section 2(1) of the Personal Data Protection Act 2012;”; and

by deleting the full‑stop at the end of the definition of “relevant public official” in subsection (3) and substituting a semi‑colon, and by inserting immediately thereafter the following definition:“ “specified purpose” means any purpose specified in the Eleventh Schedule to the Personal Data Protection Act 2012.”.