Hansard, Monday, 2 November 2020

1 Dr Tan Wu Meng asked the Minister for Education (a) how are soft skills inculcated, nurtured and evaluated in our education system; (b) how is the impact of e-learning and digitalisation on soft skills acquisition being assessed; and (c) what measures are being taken to ensure that soft skills continue to be learned amidst COVID-19 safe distancing measures including in higher education.

Mr Speaker, soft skills like critical and inventive thinking, collaboration and information skills, civic literacy and interpersonal skills, are part of what educators around the world commonly term as 21st Century Competencies, or 21CC. MOE strives to develop 21CC in every student to enable them to thrive in a fast-changing and increasingly inter-connected world. These competencies are developed through both curricular and co-curricular activities.

For example, through group work, students learn communication and collaboration skills and how to manage relationships with peers. In learning humanities, students develop stronger global awareness and cross-cultural understanding. In learning sciences, students are exposed to the inquiry process and inventive thinking of scientists. Beyond the classroom, co-curricular and Values-in-Action activities are platforms that enable students to deepen their mastery of 21CC through rich and authentic learning opportunities.

When students progress to the Institutes of Higher Learning or IHLs, they continue to develop soft skills through their course programmes and applied learning opportunities such as industry attachments, internships and community service programmes. In addition, the IHLs are enhancing their curriculum to provide students with more multi-disciplinary and inter-disciplinary exposure. This will help broaden students’ perspectives and encourage trans-disciplinary thinking and approaches to problem-solving.

Schools and institutions gauge the impact on student outcomes through regular programme reviews as well as student feedback. In recent times, with greater use of technology and digital platforms, soft skills can be nurtured through online and offline learning experiences that reinforce each other. For example, students learn interpersonal and collaboration skills through both in-person group work and through the use of online collaboration tools.

Even with safe management measures in place, our schools and IHLs seek to ensure that students spend sufficient time in face-to-face interactions, be it in classrooms, CCAs or other activities, so that they can benefit from a more holistic education experience. For example, schools will be allowed to further resume activities that are held outside of school and those that involve fixed inter-mingling of students across schools, during their post-exam period. IHLs have also progressively increased the number of students allowed back on campus for in-person learning. Classes and consultations, previously conducted online, are allowed to resume, with no more than 50 persons per class.

MOE is taking incremental steps to resume more of such in-person activities safely in schools and IHLs. We will continue to help ensure that our students and graduates are future-ready by progressively developing their soft skills at each stage of the education journey.

Dr Tan Wu Meng.

Mr Speaker, I thank the Minister for his answer and I would like to put two supplementary questions to the Minister for Education. Firstly, I would like to ask the Minister what measures are in place to identify students who may benefit from additional coaching and support in the development of soft skills, in the same way that today, for more technical skills or curriculum-related material, students who need extra help are being identified. So, how are students who need extra development in soft skills identified?

The second question, Mr Speaker, if I may ask the Minister, what measures are being taken to ensure that students from less advantaged backgrounds, students who are starting with less, that these students continue to have good opportunities to build social networks, to build social capital and to develop soft skills in a variety of domains? I raise this, Mr Speaker, because there is a good body of evidence from researchers such as David Deming or Catherine Weinberger on the role of soft skills synergising with technical skills. And this is all the more important today in our uncharted new 21st century COVID-19 world.

Mr Speaker, with regard to the first question, this is an on-going process. The teachers in the classrooms continue to identify students who are weaker and who may need more help, and will pay more attention to them. This applies, of course, to their mastery of subjects, but it also applies to soft skills.

For example, students that may benefit from more coaching when it comes to communication skills – that is something that the teachers would really be able to identify and they can provide more help, be it through their lessons in class or by giving them more opportunities.

The importance of the 21CC, which I highlighted just now, is integral to the teaching and learning process in schools. The school leaders and educators are fully aware of this and will continue to make sure they identify students who are weaker, who will need more help and can benefit from more help.

On the second point, we are also mindful that there will be students from certain backgrounds who may lack the exposure and the opportunities. That is why schools also pay a lot of attention to this segment of students to try and uplift them and provide them with more opportunities. This is work in progress. Certainly, we will continue to try to do better at this – provide more systematic uplifting programmes, more exposure, more opportunities for these students. It is a continuing process.

We already allocate more resources to help these students. We make sure that there are more programmes in place to help these students and we will continue to do so. And I would say that this effort cannot be done by schools alone. We also need help from the community, we need help from industry, so that together, we can provide maximum opportunities to help students who can benefit from such help.

2 Miss Cheryl Chan Wei Ling asked the Minister for Sustainability and the Environment as we move towards further easing measures in the community, how will the social distancing ambassadors be aided to enforce rules on the ground as there will be more grey areas on when and how to mask on.

Mr Speaker, since the start of the circuit breaker period, agencies have continued to deploy Safe Distancing Ambassadors and Enforcement Officers to advise the public and enforce on safe distancing measures. These measures are critical to safeguarding public health and protect ourselves and each other, even as we gradually open up our economy and social settings.

Even though caseloads are currently low, we must not let our guard down. We will need to stay nimble and calibrate our measures appropriately. For example, we recently lifted the odd or even entry restrictions at the four popular markets but stepped up our enforcement at F&B hotspots.

In line with this, our Safe Distancing Ambassadors and Enforcement Officers are regularly updated on the safe distancing measures, including the rules of engagement with premises operators and members of the public. They are briefed by their team leaders and supervisors on adjustments to the measures and provided reference material through their mobile devices. They are also deployed in teams of at least two, where a more experienced officer will be partnered with a newer one to provide support and guidance.

Mask wearing will remain an important measure for public health to protect ourselves and those we come into contact with. Mask wearing will remain mandatory for anyone leaving their homes. A recent study by A*STAR found that small particles from a person’s cough could travel more than one metre within eight seconds if no mask was worn. On the other hand, wearing a mask would help reduce the spread of the virus, by significantly reducing the droplets and aerosols ejected from a person’s nose and mouth. Everyone should put on your mask at all times, including putting your mask back on immediately after activities such as eating, drinking or engaging in strenuous exercise. You should also keep your mask on when seated before you start consuming your food or drink or before you begin your workout.

We have been able to contain the COVID-19 situation with the co-operation of the community and business operators. I urge everyone to continue to play your part in adhering to these safe distancing measures and to co-operate with the Safe Distancing Ambassadors and Enforcement Officers, so that we continue to keep community transmission of COVID-19 under control.

Mr Speaker, I thank the Minister for her response. I think we are not disputing the need to put on masks and also to have safe distancing. But I suppose the hardest part is the duty of the safe Distancing Ambassadors because everybody has to play their part. But I have already received quite some feedback from residents, for example, at a very popular hawker centre in the market. The point is, the Safe Distancing Ambassadors use judgement to give advsiories, for example, when exactly must they put on the mask. It is a matter of timing. Some people say immediately; once they put down their chopsticks and utensils, they need to immediately put on the mask; and there were Safe Distancing Ambassadors who told them as such. There are others who used their discretion and felt that some people can some conversation before they put on the mask.

As a result of these varying differences, I think it makes it very challenging on the ground, especially as we move towards Phase 3 – I am not sure when that is – and you increase the number of people who can come out to dine. I think this is the biggest challenge that people would face on the ground, including those in exercise corners as well.

I just wanted to ask the Minister what other measures can be done to aid the Safe Distancing Ambassadors and also for the public not to make things difficult for the Safe Distancing Ambassadors.

Mr Speaker, I thank the Member for that supplementary question. I agree that sometimes, it is difficult for the work of the Safe Distancing Ambassadors to enforce all the rules.

The rules are quite clear – which is, immediately after you have finished eating, you should put on a mask. But of course, the Safe Distancing Ambassadors are not everywhere at all times to ensure that. So, a lot depends on all of us, as customers, as patrons at hawker centres to do our part.

Ultimately, the rules are really to support our own health, to support our neighbours' health, our family's health. So, my point is, the Safe Distancing Ambassadors are there to remind people. Very often, we would like to see that with some advice and with some reminders, patrons will put back their masks and the majority of them do. I just want to reiterate that the rules are quite clear. As informed by science, the more we are able to protect ourselves through masks, the safer we are. So, it is advised that everybody put on your mask as much as you can, as soon as you can.

However, the Safe Distancing Ambassadors are there to remind; sometimes to enforce. We hope that reminders will work; if not, then in some cases, after repeated reminders, we may have to enforce. Hopefully, such circumstances will reduce over time. Even as we relax and as more activities are being allowed, I think the wearing of masks is still important for us to observe.

3 Ms Joan Pereira asked the Minister for Manpower whether the Ministry can require career coaches to handhold jobseekers, especially our low-wage workers, till they find jobs as it is reassuring to jobseekers knowing that there are employment professionals they can turn to who can provide guidance and support to them.

4 Mr Desmond Choo asked the Minister for Manpower in view of the slowdown in the aviation sector, how will the Ministry help students majoring in aerospace, aviation and hospitality who are graduating in 2021.

5 Mr Sharael Taha asked the Minister for Manpower by the end of the Job Redesign Grant in March 2020 (a) what is the total number of applications received and how many jobs have been successfully redesigned for elderly workers; and (b) what are the lessons learnt that have been incorporated into the Job Growth Incentive to increase the participation of companies to redesign jobs for the elderly.

Mr Speaker, may I have your permission to take Question Nos 3, 4 and 5 together, Sir.

Yes, please.

Mr Speaker, I thank Members for their concerns about different groups of workers and jobseekers in the current economic climate.

The Government is providing substantial employment support to help Singaporeans stay in work, such as through the Jobs Support Scheme and programmes to help them be re-skilled and redeployed to new roles.

Through the National Jobs Council, we have curated about 117,500 jobs and skills opportunities under the SGUnited Jobs and Skills Package to help local jobseekers acquire new skills to move into new careers or sectors. Around 33,100 jobseekers have been placed thus far and the efforts are continuing. In this period of weakness in the job market, these efforts have been a very useful supplement to the normal recruitment activities that take place on their own.

Ms Joan Pereira asked whether more personalised support can be given to jobseekers, especially low-wage workers. We appreciate this is not an easy time for jobseekers. To help them in their search, we have very quickly expanded the touchpoints to be readily accessible in every HDB town.

When they first visit our touchpoints, jobseekers are provided with basic career advisory and job search assistance, and are also invited to take an assessment on their career readiness. Jobseekers may be assessed to require more intensive support before they are ready to start the job search, or may request for more support even if they are assessed to be ready. Such jobseekers are provided with one-to-one career coaching.

Our career coaches provide tailored support to these jobseekers, which may include referring them to supplementary programmes, such as motivational or interview training workshops. At an appropriate time, career coaches will help them be matched to suitable opportunities. This process takes longer for some jobseekers than others. Our career coaches will hand-hold the jobseekers while helping them find their footing and gain independence. Post-placement, our career coaches conduct check-ins to ensure that they are settling well into their new workplaces.

WSG has also been proactively reaching out to all applicants for the COVID-19 Support Grant or CSG and, together with the MSF and the People's Association, to families living in rental housing. Households that need employment assistance are referred to WSG. Through these targeted outreach efforts, about 6,000 individuals have taken up our career matching services, which may include one-to-one coaching for those less job-ready.

Mr Sharael Taha asked how many senior workers have benefited from the WorkPro Job Redesign Grant or JRG. From scheme enhancement in July 2016 to grant closure in March 2020, the JRG benefited over 2,500 companies and 24,000 senior workers.

With employers today having a better appreciation of job redesign to create more inclusive workplaces, we have discontinued WorkPro JRG. This does not mean there is no longer a need for job re-design, but it can be equally well-supported through the Enterprise Development Grant and Productivity Solutions Grant or PSG. In fact, the PSG will be further expanded later this year to support job redesign consultancy services, on top of companies' own job redesign efforts.

Whether through the JRG or other programmes, the Government will provide a higher level of support to employers of seniors to help such workers stay in work.

For example, the recently announced Jobs Growth Incentive provides employers of new hires aged 40 and above double the wage support for other new local hires. The Government will underwrite 50% of their salaries, up to the first $5,000, for 12 months. This comes on top of the Special Employment Credit for workers aged 55 and above.

Where seniors need skills top-ups to be recruited or retraining to support business transformation, the level of funding is generally higher. Employers that formalise a higher retirement age or part-time re-employment in their HR policies can also enjoy grant support.

These initiatives together help to address employers' concerns about the cost of seniors in their workforce and the practical adjustments they must make to have age-friendly workplaces. In every way possible, we will try to enhance the attractiveness of seniors so they can keep working if they wish.

Mr Desmond Choo is looking ahead to next year. He asks what is being done to prepare students majoring in aerospace-, aviation- and hospitality-related disciplines who are graduating in 2021.

Like Mr Choo, we are closely monitoring the employment outcomes of graduating students. MOE's Graduate Employment Survey for graduates in 2020 will be published in the first quarter of 2021. This will give some indication as to the prospects for the cohort graduating in 2021.

In the meantime, the Institutes of Higher Learning or IHLs have started comprehensive career guidance and assistance programmes to prepare students who are graduating next year. In particular, they will get help to navigate adjacent career opportunities. Meaning, those that are not specifically targeted at their disciplines but adjacent to it. We are organising career fairs that feature job openings in adjacent sectors which will make good use of the graduates' education and skills. The IHLs are also introducing new electives for students to equip them with emerging cross-sector skills such as data analytics and visualisation, programming as well as digital marketing – skills which are sought after generally.

As a pre-emptive move to supplement job availability, the Government introduced the SGUnited Traineeships Programme which has curated more than 21,000 traineeship places from about 3,300 host organisations. In general, employers are open to accepting good candidates across a range of disciplines. Candidates will also have better opportunities if they are open to trying out positions outside of the disciplines they are trained in, or look beyond positions that many applicants have focused on. We will continue to watch the situation closely and adjust the programme accordingly.

Mr Speaker, I understand the challenges that workers and jobseekers are facing at this time. Advance estimates for the third quarter show a rebound in local employment. Although there may still be retrenchments and job losses, it is not all gloom and doom.

Pockets of businesses are recovering and hiring, and we will make every effort to help affected Singaporeans get back to work. This is what they usually want and central to how we sustain support for Singaporeans on an on-going basis.

Ms Joan Pereira.

I thank the Minister for her reply. I have two supplementary questions. First, could MOM supplement the SGUnited jobs initiative with more manned hotlines, where jobseekers can dial in for career advice and job-matching? This would be very helpful for our workers. Second, again to help our older low-income workers, it would be helpful if the Ministry makes provision for career coaches to be conversant in the mother tongue languages and even dialects, if this is not already done.

Mr Speaker, I thank Ms Pereira for her two questions. The second one, our career coaches are already equipped with a number of languages. So, if they come across a client whom they have difficulty conversing with because of the language barrier, they will certainly refer the client to another colleague, in order to be able to provide the requisite assistance to the jobseeker.

To the question of hotlines, WSG has manned phone lines for jobseekers who would like to dial in for more information or who wish to seek further assistance. These are available from Mondays to Fridays between 8.30 am and 5.30 pm, as well as on Saturdays from 8.30 am to 1 pm. Jobseekers may also submit their enquiries via WSG's feedback portal.

But I would like to thank Ms Pereira for her suggestion and that is to make this line more readily known so that jobseekers know that this is an avenue that they can also look for. So, I thank her for the suggestions and I will work with WSG to see how best to do so.

Mr Shareal Taha.

Thank you, Mr Speaker. I thank Minister Teo for her reply. I appreciate the efforts of the Government in supporting re-employment and in redesigning jobs. While we have been encouraging companies to redesign job for seniors through various grants and schemes throughout the years, the pace at which companies are proactively redesigning jobs, I think that can be improved.

At present, with 16.8% of population above the age of 65, what more can we do to nudge companies to proactively redesign jobs to ensure gainful employment for our ageing population. And also, can both MOM and MTI consider including job redesign for seniors, including work-from-home, job-sharing, micro jobs as one of the key elements in the Industry Transformation Map. So, jobs for seniors become actively designed for the transforming industries.

Mr Speaker, I really thank Mr Sharael Taha for his concerns about our senior workers. They have been very much a focus of my Ministry's work. The hon Member mentioned that in the Industry Transformation Maps or ITMs, can we make special emphasis and give special consideration to this group of workers. In fact, the ITM has a very deliberate track called the jobs and skills track that looks at different segments of our workforce, whether they are the low-wage workers or seniors or PMEs or women. Actually, there are specific work programmes that are targeted at enabling each of these segments to stay productive at work and also to upskill them so that, if they so wish, they can remain in the workforce. There are specific work streams to address each of these workforce segments.

To his question about whether we can get the employers to step up their redesign efforts, it is very much aligned with the Government's thinking. Our experience is that for the companies that already have a very large segment of their workforce that are in their 40s, 50s and perhaps even older, these companies do recognise the need for them to step up in terms of redesigning the work. They know very well that when their seniors retire and if the seniors retire because not enough effort has been put into redesigning the workplace, then they stand to lose a very valuable part of the workforce. I have actually visited a lot of companies that are quite deliberate in how they go about doing so.

The issue is not so much willingness; the issue is much more about the ability to do so, which is why under the Productivity Solutions Grant, we decided to add in an additional element. Meaning that the companies need not only depend on their own understanding of how to do job redesign. We are actually prepared to fund a consultant coming on board to help them think through the job redesign process.

So, we will continue to look for opportunities to strengthen our companies' abilities to conduct job redesign because, if you look at our senior employment rate, it has actually improved over the decades. We want to make sure that we build on these gains. Seniors also tell us that they wish to continue working and job redesign is one part of it; skills enhancement is another part of it. And another very practical thing that seniors also tell us is that whilst they want to continue working, it may not be to the same intensity as before. So, in addition to job redesign, we have also invested in efforts to ask companies to see how those jobs can be designed in such a way that even on a part-time basis the seniors can continue.

So, we will continue to look out for more opportunities to enhance senior employment.

Mr Louis Ng.

Mr Speaker, I thank the Minister for sharing what the Government is doing in terms of the salaries for senior workers, but could I ask whether MOM has detected any pay gap between what a senior worker is getting for the same job as compared to a younger worker?

Mr Speaker, if at all, many employers are worried about the higher cost of keeping the seniors in their workforce simply because, over the years, as they have gained in experience and if the company has been doing reasonably well, usually, there are wage increases. It has tended to be more of that sort of nature of difficulties.

There are, of course, also certain reasons why some seniors may not be able to move on to jobs that pay higher. That could be a question of their skills deficits. And one of the things that we have noticed, for example, is that when we were carrying out the work for the Tripartite Workgroup on Older Workers, more so than other segments of the workforce, seniors are very dependent on what their employers indicate to them are training needs. And apart from what the employers indicate as training needs, seniors are less likely to initiate training on their own. That may be one reason why it has been harder for them to access a wider range of jobs. But for the same work, actually, the bigger risk has been that the seniors, not necessarily having a lot more skills and competencies, earn more.

So, we have, over the years, worked very hard to try and encourage companies to move towards a competency-based wage structure rather than a seniority-based wage structure. A seniority-based wage structure certainly gives an individual the sense of comfort that, as he advances with the company, he is being recognised. But it can also work against him later on when the companies then look at the entire workforce and find that, perhaps, compared to their younger colleagues, the senior workers are much more highly paid and, if they do not make a concerted effort to work with the unions to restructure the salary accordingly, then, later on, when it comes to continued employment, that actually could be a difficulty.

It is also why, instead of just raising the statutory minimum Retirement Age, we have chosen to complement it with the Re-employment Age because, in re-employment, you can get a person to stay in work but not necessarily in the same job and not necessarily at the same pay. This way, it allows for the employer and the senior workers to reset the terms upon which they can continue this employment.

Assoc Prof Jamus Lim.

Mr Speaker, I thank Minister Teo for clarifying the efforts by the Ministry to support our elderly jobseekers. If I may riff off the Member Mr Sharael Taha's question. I am wondering what the Ministry in particular has done to support older jobseekers who have lost their jobs at an age relatively close to retirement. So, perhaps something like in 61 or 62 but who still wish to continue working not so much in a different job which requires redesign but actually within the same job and they may be facing certain kinds of discriminatory practices because they are close to the retirement age.

Mr Speaker, if the Member, Assoc Prof Jamus Lim knows of instances where an older person has been discriminated against for jobs, I would encourage him to refer them to MOM. We will certainly investigate. By and large, if you look at how we help jobseekers, whether they are younger or not so young, if they want to get back into the same job role or same sector which has already seen quite a lot of displacements, then the barriers will be quite high because the fact that they were displaced does suggest that, in that particular sector, it is already not doing so well. So, it is not targeted specifically only at more senior jobseekers. All jobseekers will benefit from keeping an open mind and being willing to consider transiting into other sectors.

One thing that we have found to be quite encouraging is that where the senior workers are willing just like any other jobseeker or jobseekers of any other age and the employees can see the enthusiasm and the willingness to learn, actually, quite a large number of them have been able to take part in our conversion programmes and to enter new job roles or new sectors. I have very often encountered participants in our Professional Conversion Programmes or our Place-and-Train programme who are in their late 50s and even in their early 60s. The oldest participant in a PCP programme that I have encountered, if my memory serves me right, was something like 67 years old. So, more and more, we also find that employers recognise that if they are open to hiring people who bring with them very rich experiences, then, in fact, they serve as a mentor to the younger colleagues in the organisation and they actually work well together.

But having said that, I do recognise that seniors have concerns about ageism. And whenever there are cases where they felt that they were not fairly considered, we would encourage them to approach MOM and we will reach out to the employer to understand how to support them better so that all jobseekers know that they are being considered fairly.

Mr Desmond Choo.

I thank the Minister for the reply. I have just two points of clarification. For the students who are still studying, naturally, I think they are quite worried about the employment situation when they come out. Just two points.

One, for those who are still studying, they have reflected that there is a lack of internship and attachment opportunities. So, that might affect their employability when you come out. They are naturally worried that when they come out, would they still be able to have as good a set of skills in the marketplace and will going to adjacent sectors erode their competencies over time.

The second point is that they will come out in 2021, competing with existing workers with experience and they do not have those. I wonder if the Ministry can come up with programmes that will allow them to not only just maintain their current competency but also to catch up with their assisting peers in the industry so that we do lose our aviation, aerospace and hospitality competency over time.

Mr Speaker, I appreciate Mr Desmond Choo's concern. I was in MOT when we encouraged many Singaporean youths to take up opportunities in this sector because we considered the growth prospects to be very promising. Singapore is booming as an air hub and we are working very hard to allow our air hub to recover and I certainly hope that the situation stabilises to the point where there is better clarity to all the young people who have taken on opportunities in these sectors for training.

The situation is quite interesting. Since Mr Choo asked, I had also enquired what about internships right now as they give a useful indication as to the adaptation that we can make. If we take Aerospace Engineering, for example, for the current cohort that need to go for internships, about half have still been able to secure internships that are related to their discipline of study, meaning that they are interning in roles that are related to Aerospace Engineering. So, that is a good thing. Of course, it would be better if all of them were to be able to do so. But, given the circumstances where the companies' activities have gone down a lot, that would not be realistic. But half of them still being able to get such an internship is not bad. The other half, what have we done? We have not given up on helping them.

Their skills in engineering are actually very widely usable in other sectors. In manufacturing. for example, there is great value in applying the disciplines of Aerospace Engineering. So, with the combined efforts of different agencies coming together, in fact, all of them have been able to secure internship positions, not all of them in Aerospace Engineering but, in the other areas, it is also very meaningful way for them to acquire experience before they graduate. This is on Aerospace Engineering.

In Aviation Management, not bad, too. About 60% have got useful skills that allow them to intern in roles that tap on their understanding of business management, for example. So, they have been able to get meaningful internship opportunities even if it is not directly involved in Aviation Management. So, that gives us a sense as to how the collective efforts of the agencies involved, together with the students' own willingness to step out of their comfort zone, they have been able to secure meaningful internships which, we believe, will enable them to be better positioned for the job market. And if jobs continue to be in short supply for such students then, certainly, we will look at how the SGUnited Traineeship Programmes can be continued. This is in relation to how these students can be taken care of.

Mr Desmond Choo had a second part of his question and, that is, subsequent to these opportunities, supposing these students would like to return to their areas of study or return to an area of work that is more related to their discipline, will there be opportunities to do so? I think our record has been that whenever the industry has a need and there are people who would like to join the industry, then we will make available career conversion programmes and, if there is a demand for such students to return to the sector and some top-up is required, then I would like to assure Mr Choo that every effort will be made to avail such programmes to them.

6 Ms Ng Ling Ling asked the Minister for Health what are the key drivers of cost increases in healthcare and what is the target to keep cost increases in the next five years to a publicly announced range.

Mr Speaker, Sir, several factors contribute to healthcare cost increases.

First, our population is ageing. Older patients tend to have more co-morbidities and complications, requiring more medical attention, more medications, procedures and longer hospital stays. For example, in 2019, the average stay in our public hospitals for those aged 65 and above was 6.9 days, compared to those who are below 65 where the average stay was about 3.9 days. So, it is almost a doubling of the number of days of stay.

Therefore, as we grow older, we are likely to spend more on healthcare. And collectively, as we have increasingly more older persons in our population, our overall expenditure on healthcare will also rise correspondingly. For example, MOH's expenditure on the long-term care sector increased from $296 million to $723 million between 2013 and 2018. Or if you work it out, it is a 20% increase per annum.

Second, with medical advancement, new treatments will become available. Previously untreated conditions may now become treatable. Older treatments that were less costly may now be replaced by better but more costly new treatments. These advances can improve life spans and the quality of life, but they come at a price. For example, Total Knee Replacement surgeries have become more prevalent among those aged 65 and above over the last 20 years, rising from 187 patients for every 100,000 people aged 65 and above in 1999, to 499 patients in 2019. That is a 2.7-times increase in the prevalence rate over that time period. Previously, when such procedures – this kind of total knee replacements – were not widely available, elderly suffering from knee conditions would have to bear with poor mobility, which can affect their quality of life.

Third, operating costs may increase over time. For example, manpower costs account for about 60% of healthcare costs. Healthcare workers who do important work, must be appropriately recognised and remunerated. Eventually, increases in manpower cost will translate into higher overall healthcare cost.

While these factors are likely to put pressure on healthcare cost, we can work together to moderate the increases to ensure our healthcare system remains affordable and sustainable. Managing healthcare cost has been a key priority of MOH. The three Beyonds – Beyond Healthcare to Health, Beyond Hospital to Community and Beyond Quality to Value – are key strategic planks that guide the transformation of our healthcare system to one that is future-ready and sustainable.

By looking after our health, we can avoid or delay the need for healthcare, reduce our healthcare bill, and more importantly, we can enjoy a better quality of life. For example, we declared the War on Diabetes, to get all of us, to not only better manage our chronic conditions, but to also choose healthier meals and more active lifestyles. We enhanced Screen for Life subsidies to encourage Singaporeans to go for regular health screenings, to detect and manage health conditions early. These efforts will help us to live long and live well, and avoid future complications that will require much more costly healthcare services.

When we go beyond Hospital to the Community, we ensure that we do not overuse expensive hospital care when we do not need it. We have therefore invested in raising capacity and capability in the primary care and the intermediate and long-term care sectors, so as to provide care that better meet the needs of patients. CHAS Green card was introduced last year and MediShield Life coverage to inpatient hospice care was also introduced in April this year, being part of this overall strategy.

Moving Beyond Quality to Value calls for all of us to be better informed and to be more discerning in how we consume healthcare. Are we stretching our healthcare dollars by choosing therapies that are cost-effective and well supported by clinical evidence? So, we established the Agency for Care Effectiveness or ACE to evaluate healthcare technologies and issue guidances on drugs and other technologies to share with both the public and private healthcare sectors. The Agency for Logistics Procurement and Supply or ALPS was set up to aggregate demand and secure better prices for drugs and other supplies, as well as streamline and reduce supply chain costs. We continue to put emphasis on raising productivity and tapping on technology where available.

We introduced fee benchmarks for common surgical procedures in November 2018 to guide private sector doctors and healthcare providers in charging appropriately and to enable patients to make better informed healthcare decisions. This complements MOH's annual publication of hospital bill sizes. Both the bill size publication and fee benchmarks are available at the MOH website.

Finally, we provide substantial subsidies to cushion the impact of healthcare cost on patients. To help patients pay for the remaining share of their costs, we have MediShield Life and MediSave. For Singaporeans who need extra help, there is MediFund. So, this constitutes our S plus 3M Framework – subsidies plus 3Ms.

As I have laid out, while there are measures we can take to manage healthcare cost, there is unfortunately, no silver bullet. We will need a sustained effort over many years and for all stakeholders to play their part and do so together. We will ensure that Singaporeans will always have access to good quality healthcare that is appropriate and affordable.

7 Ms Foo Mee Har asked the Minister for Health (a) what is the justification for the impending increase in MediShield Life premiums; and (b) what strategies are being deployed to control escalating healthcare costs.

8 Mr Liang Eng Hwa asked the Minister for Health (a) what is the basis for the increase in MediShield Life premiums; (b) how can the premiums be kept affordable especially for the seniors; and (c) what are the assistance schemes available to help seniors who are unable to afford the premiums.

9 Mr Gerald Giam Yean Song asked the Minister for Health whether the full actuarial report for the current MediShield Life scheme and the proposed MediShield Life scheme revisions, including actuarial assumptions used, can be made available.

10 Mr Xie Yao Quan asked the Minister for Health (a) in the last 20 years, how much have daily ward charges and daily treatment fees in public hospitals increased; (b) how much have prices of standard drugs, tests and investigations increased in the same period; and (c) based on the proposed revisions to MediShield Life, how much is the expected real increase in MediShield Life coverage, net of medical cost inflation.

11 Mr Leong Mun Wai asked the Minister for Health (a) what is the actuarial formula for the required reserves in the MediShield Life Fund; (b) whether it is unusual by international standards for a health insurance scheme to increase its premiums by 35% in a single adjustment; and (c) what is the total premium paid by a Singaporean for MediShield Life in his lifetime assuming the premiums are compounded at 2.5% interest and 4% interest respectively.

12 Mr Yip Hon Weng asked the Minister for Health in respect of the increase in premiums following the review of MediShield Life (a) what is the surplus or loss since introduction of MediShield Life in 2015; (b) whether the Ministry can introduce more flexibility so that premiums are paid based on choice of coverage and illnesses covered; and (c) how will the Government guarantee coverage of an elderly when they default on the premiums mid-way through medical treatment.

13 Ms Ng Ling Ling asked the Minister for Health for Singaporeans who are retrenched or self-employed with significantly reduced income during this period, both of whom will be concerned about their MediSave sufficiency to cover the increases in MediShield premiums for the years ahead, whether the Ministry will review and supplement targeted subsidies to ensure that there are no further financial hardship to these groups.

14 Mr Xie Yao Quan asked the Minister for Health whether he can elaborate about the Government's plans to support persons who are not able to afford the increase in MediShield Life premiums even after subsidies.

Mr Speaker, may I have your permission to take Question Nos 7 to 14 together, please?

Yes, please.

Sir, MediShield Life is a basic health insurance scheme that provides Singaporeans with universal and lifelong protection against large hospital bills. The key word here is universal and lifelong.

It has strengthened our larger healthcare financing framework to keep healthcare affordable, together with Government subsidies, MediSave and MediFund. Again, it is the 3M + S, that I said so earlier, in the previous question. About eight in 10 patients today need to pay $100 or less in cash for their subsidised hospitalisation bills.

To ensure that the scheme remains sustainable and relevant to Singaporeans, the MediShield Life Council has recently proposed enhancements to benefits and adjustments to premiums.

Ms Foo Mee Har and Mr Liang Eng Hwa asked about the reasons for the premium increases, while Mr Gerald Giam asked about the assumptions behind the premium pricing. Premiums have been kept unchanged for the first five years of MediShield Life, in line with our earlier public commitment. They need to be adjusted to ensure that the MediShield Life Fund remains solvent and sustainable so that it can meet its obligations to all policyholders. Premiums are priced by actuaries based on established actuarial principles, taking into account claims experience such as utilisation rates and cost of medical treatment, scheme benefits, amongst many other factors.

There are three key drivers of the premium increases, which I will now elaborate.

Since its launch, MediShield Life has been providing more payouts and greater protection for more Singaporeans. The number of claimants has increased by about 30% and the annual payouts have increased by about 40% over the last four years.

Mr Xie Yao Quan asked about the growth in hospital charges over the last 20 years. Between 2001 and 2019, the average hospitalisation bill size in public healthcare institutions has increased by about 6% a year on average, and this is affected by medical cost inflation, demographics and medical advancements over these years. This growth in utilisation and payout accounts for about two-third of the premium increases.

One-quarter of the premium increase is from refreshing the claim limits to ensure that Singaporeans continue to be adequately covered for the majority of subsidised bills. The remaining portion of the premium increase, which is about just under 10%, supports the benefit enhancements including those implemented since 2018, such as the extension of coverage to inpatient hospices and serious pregnancy complications.

As premiums are priced taking into account multiple factors, which inevitably vary from country to country, it would not be appropriate to compare MediShield Life's premium increases with other national health insurance schemes, which Mr Leong Mun Wai suggested.

It would also not be meaningful to compute how much premiums a Singaporean will need to pay over his lifetime, simply by assuming a fixed compounding factor each year. Future premiums would depend on how the underlying drivers, which I have just illustrated, evolve. And this depends on many factors including what we can achieve together to manage healthcare cost. The amount of premium subsidies an individual would receive will also vary over his lifetime, depending on his financial circumstances.

Several Members including Ms Ng Ling Ling and Mr Yip Hon Weng asked about the support for those who face difficulties with their premiums. I would like to assure Members that MediShield Life provides coverage for all Singaporeans, for life. Several financial support schemes are available to ensure that no Singaporean will lose their MediShield Life coverage, or be denied access to appropriate care, just because of an inability to pay their premiums.

To ensure premiums remain affordable, the Government provides premium subsidies of up to 50% for lower and middle income households. All Merdeka Generation seniors receive additional subsidies of up to 10% on top of these premium subsidies and all Pioneer Generation seniors receive special subsidies of up to 60%. Taken together, about 35% of the total premiums collected were paid for by the Government through various subsidies and support schemes in 2019.

For the elderly aged 65 and above, the contribution from the Government is even higher, at about 50% of their premiums. To illustrate this, the revised premium for a 62-year-old lower income Merdeka Generation or MG senior is $1,020 before subsidies. This is the annual premium, which therefore equates to less than $90 a month. After taking into account the premium subsidies and additional MG subsidies, the net premium payable per year is $663, or about $55 a month. Additionally, the MG senior will receive annual MediSave top-ups of $200 for MGs from 2019 to 2023, which can be used to pay for his premiums. After this additional $200 offset, the effective premium payable for this MG senior will be $463 a year, or less than $40 a month.

Premiums can be fully paid for by MediSave and the vast majority of Singaporeans have sufficient MediSave for their premiums. Family members can also utilise their MediSave to help pay the premiums for their loved ones. Singaporeans who continue to face difficulties even after subsidies and have limited family support can apply for Additional Premium Support or APS. This includes those who are mid-way through medical treatment or have experienced a recent job loss or a reduction in income, as pointed out by Ms Ng and Mr Yip. Certainly, a concern that many Singaporeans have during this COVID-19 crisis. If approved, Additional Premium Support will cover all outstanding premiums as well as their future premiums.

The Government had considered deferring the MediShield Life review and consequent premium increases given the current difficult economic situation with COVID-19. However, I must emphasise that it was important that MediShield Life remains solvent and sustainable so that it can meet its obligations in time to come when policyholders make claims. Its coverage also has to be updated and enhanced to remain relevant to the healthcare needs of Singaporeans. The MediShield Life Council therefore recommended that premiums should be adjusted accordingly.

Nonetheless, in recognition of the challenges faced, the Council further recommended that the Government should provide additional subsidies to help Singaporeans during this exceptional period. The Government has therefore provided a COVID-19 subsidy for all Singapore citizens in the next two years, which will pay for the bulk of the premium increase in the first year. Taken together with existing premium subsidies and support, the net increase for all Singapore Citizens will be no more than about 10% in the first year after the MediShield Life review is implemented.

The MediShield Life Fund has to be self-sustaining and based on sound actuarial principles. Premiums collected have to cover potential current and future claims, including amounts set aside to support future commitments as well as provide a buffer against unforeseen contingencies such as unexpected spikes in hospitalisations due to disease outbreaks.

As policyholders age, claims are likely to increase and so will premiums. A key feature in the MediShield Life scheme is to distribute premiums more evenly throughout the policyholders' lifetimes. Part of the premiums paid by policyholders during their working ages are set aside to provide for future premium rebates, which will help to moderate premium increases in their older ages. This constitutes the bulk of future commitments set aside in the reserves. As the majority of policyholders are relatively young today, the amount set aside has been increasing. Other commitments include future payouts for diseases currently under treatment and will require multi-year care, such as renal failure and cancer.

Between 2016 and 2019, a total of S$7.5 billion in premiums were collected. This comprises $4.4 billion in premiums collected from policyholders, and $3.1 billion from the Government in terms of premium subsidies and other forms of premium support provided to keep premiums affordable, which also went into the Fund. In this same period, a total of $3.5 billion in claims were paid out, while $3 billion was set aside for future premium rebates.

Mr Yip asked about the surplus or loss ratio of the MediShield Life Fund. The Incurred Loss Ratio or ILR of the Fund was an average of 104% over the period from 2016 to 2019. This means that the total premiums collected was slightly less than the total monies required to ensure that the Fund is able to meet current claims and future commitments.

Mr Leong asked about the formula for computing the Fund’s reserves. The reserves are computed by external professional actuaries in accordance with the Monetary Authority of Singapore or MAS’s requirements and in line with industry standards. For more details, the Member can refer to the Insurance (Valuation and Capital) Regulations 2004.

MediShield Life, I must emphasise, is a not-for-profit Scheme. All premiums collected are placed in the MediShield Life Fund which are used solely for the benefit of policyholders and in the administration of the Scheme. Information about the Fund size, reserves and Incurred Loss Ratio is published on the MOH website. The financial accounts for the Fund are also audited by an external auditor and submitted to Parliament every year for transparency.

Mr Yip asked whether Singaporeans can pay premiums based on the choice of coverage and illnesses covered. MediShield Life focuses on the basic needs of Singaporeans and apply equally to all policyholders. Those who prefer to have better coverage and are willing to pay higher premiums can consider private Integrated Shield Plans or IPs.

Sir, slowing the rise in healthcare costs is key to maintaining the longer term affordability and sustainability of MediShield Life premiums and the overall healthcare system. Everyone has to play a part. Together, appropriate care can remain affordable for all Singaporeans.

Ms Foo Mee Har.

Thank you, Speaker. I thank the Senior Minister of State for the elaboration. He mentioned a number of factors that were key in driving the premium increase including medical inflation and so on. I would like to ask the Senior Minister of State whether MOH would develop a transparent framework where you actually itemise the factors that contribute to the premium increase – just like the Fare Adjustment Formula used by LTA to justify the transport fare adjustment is being done. This is to allow a level of transparency of factors when MediShield Life premium increase. That is the first supplementary question.

The second question also touches on a number of points that the Senior Minister of State mentioned. To me, the best way to control healthcare cost is for the population not to fall sick in the first place by staying healthy. As MediShield Life premiums are universal and their contributions mandated, how can the healthcare system evolve to a model where Singaporeans are incentivised to live a healthy lifestyle, perhaps by enjoying lower premiums based on the individuals' history of healthy living habits and lower consumption of healthcare services?

Sir, I thank the Member for the supplementary questions. I think these are important questions that may be on the mind of many people and public as well. Ideally, it would be good to have a single formula that can address some of these various factors that drive inflation and costs, that translates to higher premiums. But the difficulty is that year-to-year, decade-to-decade, it is very hard to predict ahead of time what kind of technology will drive clinical practice.

In the early years, when I was a student, CT scan was not ubiquitous. When we see somebody in the A&E, if you get a head injury, the default is just a plain X-ray of the skull. That probably cost about maybe $15-$20 to do a skull X-ray, but it does not tell you very much unless you have a bone fracture. It cannot tell you there is bleeding inside your brains, whether there is traumatic soft tissue injury.

Today, it is almost unthinkable, just barely 20 years later, that you do not do a CT scan of the head for somebody with a significant head trauma. But the cost factor for a CT scan is actually in the range of hundreds of dollars. That is easily a 10- or maybe a 100-fold increase in the cost factor.

But at that point in time, you cannot really factor in just one single thing, a CT scan, the magnitude of utilisation, the pervasiveness and the cost factor from the technology, how it can be applied clinically, because this also depends on clinical guidelines as well.

So, as opposed to a transport fare formula, where the parameters and the variables are a little bit more fixed and more predictable, healthcare inflation takes into account many unforeseen kind of variables that will come along the way. Even medications, for example, Hepatitis C used to have not much treatment except for liver transplant. But today, there is drug on the market that one pop of a pill – it costs about $600,000 a pill, a dose of treatment – can potentially eradicate Hepatitis C.

That magnitude of inflation is something you cannot predict ahead of time and the pervasiveness of the disease prevalence that requires you to use this treatment is again very hard to scope into one formula that addresses a broad spectrum of needs.

So, I think it will be very, very hard to have a single formula to have that level of clarity. But the actuaries that use some of these current data to project will make adjustments over time and this is why we need to review our premiums on a regular basis, yearly, if not, every couple years, to take into account new treatment on the horizon, new changes in clinical practice, new utilisation patterns, so that we can reflect the premiums accurately.

The second question on how to incentivise better behaviour. Well, actually the flip side is true. Today, if you have no good behaviour, you actually have premium loading, which is what most insurers in practice would practise. If you have a diagnosis and you want to continue to be covered for the condition or you want to add on a condition that was previously not covered, the insurer will do a premium loading to add on the coverage for the condition. In that sense, it is an incentive to be healthy, so that you do not have a premium increase on the individual basis; not necessary a premium rebate, but you do not want to have a premium increase, by keeping healthy.

In order to encourage our people to adopt a healthy lifestyle and be healthy, there can be other schemes that the Government can do outside of the scope of insurance to encourage good behaviour. You can give vouchers, for example, or give some form of incentive for people who clock 10,000 steps a day, who have good diabetic control and sugar intake; you can give them some incentive like maybe $100 NTUC vouchers a year or something like that. So, there are other ways to incentivise good behaviour without distorting the actuarial calculations for a fund that needs to be sustainable and needs to be solvent.

Mr Speaker, I do not think the Senior Minister of State has answered my question about whether the full MediShield Life actuarial report can be made available. I asked for the actuarial report because it is key to accurately compute the premiums and benefits. It contains mathematical and statistical models designed to evaluate risk and probabilities, which are a bit complex to explain in a reply to a Parliamentary Question.

Has the Government studied how other countries release the actuarial reports for the national insurance schemes? For example, Taiwan's National Health Insurance Administration is required by law to release an actuarial report every five years, and their latest report is available on their website. It covers calculations for potential and current and future claims and a detailed sensitivity analysis to model how claims will vary in various economic scenarios.

So, can I urge the Government to release a report like this, so that independent actuaries can analyse it. This will go a long way to improve transparency and help Singaporeans understand the calculations behind the MediShield premiums and benefits instead of being asked to take the Government's word for it.

Sir, I thank the Member for his question. I think the answer should be do not just take the Government's word for it. Take the words of the professionals who are experts in this field. I think very few people are actuarial experts who can understand the nuancing and the very complicated calculations that goes behind the scenes.

I would say that MediShield Life premiums are, first of all, proposed and calculated by external actuaries. That means, they are independent of the Government, they are a set of actuarial consultants who craft up the series of premiums that they think, based on data and assumptions that they made, that would be fair for to charge to the policyholders. That is the first thing.

Secondly, the size of the funds, the amount we collected and the amount we pay out are actually also externally audited. So, it is not the Government's word, it is an external auditor who takes a look at the funds and calculate the loss or the surpluses.

Finally, whatever the report is, it will be reported to Parliament on an annual basis for the purpose of transparency. So, I think this is not just the Government's words, this is based on external experts, external auditors and transparently reported in Parliament.

But I take the Members point that, over time, we may have to have a better system of looking at how these assumptions, calculations, need to evolve. But this Scheme is a new Scheme. It has only been about four to five years running and we are collecting data as we go along.

Much of the outcomes will have to depend on how the claims have been paid out, what is the actual lived experiences of patients and how much claims and the percentage of bills that are incurred as well.

So, over time, we could perhaps engage different consultants to take a look to challenge the assumptions to do another calculation at the appropriate time, to make sure that we are still on track. We can also speak to the consultants and see if they are able to publish some of these data in an academic way. But again, this will not be something that most lay people will understand. Nonetheless, the key information that is available are already published transparently on the MOH website and those who are interested can take reference from there.

Sir, MediShield Life is a national scheme administered by CPF. I suppose the most obvious reason is because if we offer this to the private sector, there will be no takers, given the terms where, amongst others, it covers seniors, those with pre-existing conditions and also at a premium that is affordable to the lower income groups.

So, I wanted to ask the Senior Minister of State whether he has the data to give us a sense of how are the MediShield premiums compared to the levels of other countries with similarly-run national schemes; whether are we priced at the level that is affordable to our lower income groups?

Sir, I thank the Member for this very important question. As a doctor who has been practising for about 20-odd years, I can tell you what is the saddest thing we see in the clinics. The saddest thing we see is when you see a poor patient or family who has limited means coming to a hospital for a catastrophic illness and they are devastated by the worries of healthcare bills. And the sad thing we always talk about in the doctors' tea room is that, sadly, the people who needs the insurance the most are the ones who cannot afford it.

This is why MediShield Life was conceived to be a universal Scheme to make sure that no single Singaporean will be left behind, even the poorest and the lowest of income; through whatever means: MediSave contributions, through MediFund, through additional premium support. We will make sure every Singaporean patient has a basic medical insurance to cover them for catastrophic bills.

The second kind of condition which we see many private insurance exclude are actually congenital conditions. The moment you are born with a congenital condition, you are already disadvantaged for life. No insurance will probably take you on unless you are prepared to pay an arm and a leg for a very high premium to get that coverage. Many of us who have insurance plans will also know that later on in life when you have the means to buy an insurance plan, but you already have a pre-diagnosed condition, the insurance will take you on but exclude those conditions from coverage as well.

I think these are the important features of MediShield Life that we got to take into account that is different from any other insurance plans out there, especially in the private sector. So, pervasive coverage, all Singaporeans, all disease, conditions, for life. Again, "for life" is another important feature because many private insurance plans do not cover you beyond a certain age because they know once you reach a certain age, your disease prevalence goes up, your risk of claim goes very high and your chance of a severe illness is very high as well, and nobody wants to provide coverage. So, private insurance plans tend to cherry-pick.

If we look at how MediShield Life is constructed, therefore, it is a very unique pervasive universal health coverage plan. If I were to make a comparison to, say, a healthcare plan from another country, I think it is very hard to find something that is exactly the same. But for purpose of comparison, if I can share some premium data from Hong Kong's VHIS, which is Hong Kong's government-backed Voluntary Health Insurance Scheme. So, first it is Hong Kong, which is an Asian country, pretty much similar to Singapore in terms of social construct and healthcare system, which is quite similar, in the British-base kind of healthcare system. But bear in mind, this is a voluntary healthcase system. Theirs is not universal. Even then, for a voluntary healthcare system, the premiums compared to the revised MediShield Life premiums coming on stream before subsidy add-ons – that means just the raw premiums after the revision – the premiums range from being 34% to 143% higher than our MediShield Life. Or you can work it out – it is about 76% higher on average across the age bands.

So, Hong Kong's healthcare insurance system which is voluntary, on average, at least 76% higher than our premiums. At the lowest end, at the one to 20-year-old age range, our revised MediShield Life premium before subsidy is S$145 a year. The Hong Kong premiums is S$352. So, it is easily close to two times or more.

At the extreme end of the age range, at more than 90 years old, the MediShield Life premium for Singapore citizens more than 90 years old before any form of subsidies is S$2,055. The Hong Kong one equivalent is S$3,767.

So, even before subsidies, our premiums for universal coverage, for all conditions, for life, no exclusion, is already much cheaper than the one that Hong Kong has. But bear in mind that for the older group, especially those which I said is above 90 years old, they belong to the Pioneer Generation group where there is already additional premium subsidies, premium discounts, MediSave top-ups. Virtually, it is almost a free healthcare insurance for those who are at the extreme end of age range for the Pioneer Generation.

I hope that gives the Member a clearer idea of the comparisons that we have.

Mr Yip Hon Weng.

Mr Speaker, I thank the Senior Minister of State for his reply. I am heartened to hear that there are various subsidies for the premium increases, including the COVID-19 subsidies. I would like to ask about the plans of the Ministry on how they plan to communicate and promote awareness of such subsidies for the premium increases.

Sir, this is where we need the help of all the Members in this House. As Members of Parliament, as Advisors to the grassroot organisations, as key touchpoints within the community, we hope that all Members in this House, having understood what is being said earlier, would help to communicate this to your residents. The Ministry will also push out a series of communications through case illustrations, through engagement with the public, through press releases and perhaps also through write-ups in the media to help share some of this information to the public. So, we look forward to your support and continued partnership.

Mr Leong Mun Wai.

I thank the Senior Minister of State for his detailed information on the current situation. However, I do not think he has answered the questions we asked. I think what we are saying is that we need more transparency in the system. The Member Mr Gerald Giam has also asked for the future liabilities estimation.

I would like to urge the Senior Minister of State not assume that the people outside, in our country, do not understand the calculations of the acturians. When the data is disclosed, there will be people who are able to make an informed judgement. We really need to have more information about the system in order that we come out with more ideas to arrive at a better system in our country.

The situation that is described by the Senior Minister of State is still not quite — Based on the feedback we have received from the ground, the situation of our healthcare system is still a source of a lot of stress to our people. As a result, we are here to get more information. That is why disclosure and also the affordability are two very important issues.

If I may ask one additional question here, is that, the various components that the Government has contributed to the MediShield Life Scheme, which was shared just now, about over $3 billion over the last five years, I think that is what the Senior Minister of State said, can we categorise them under pre-existing conditions, low-income and the ageing factor? If possible, what are the respective contribution based on these components? Because at the point when MediShield Life was brought in in 2015, the Committee said that the Government will contribute $850 million to support the pre-existing conditions. So, one of the key components of the financing of the scheme is that, will the Government continue to finance these pre-existing conditions going forward; and in the past five years, how much was it?

Sir, if the Member were to listen carefully to what I said earlier, I already said that 35% of the contribution within a fund came from Government subsidies and all sorts of premiums contribution by the Government as well. So, that itself is a sizeable commitment from the Government. Today, there are already about $7 billion or so inside, of which 35% of it comes from the Government. That is way more than $800 million that he was talking about. We are contributing in the billions here.

The second thing is we do welcome ideas from experts who can actually help us to also refine the Scheme as we go along. But bear in mind this is a very new Scheme and we just started for the last four to five years. As we go along, we will try and share more data as possible and involve more actuarial consultants to try and help us to look for new possibilities and new ways to look at some of these things.

But let me just say that for the purpose of transparency, the Member must note that this is not proposed by Government. This is an external consultant who proposes the premiums, audited by an external auditor and report this yearly in Parliament where Members get a chance to question about the proportioning of the Fund and the usage.

I think transparency is not an issue here. We will try and work with the actuarial consultants to see whether some of these publications can go on to the academic circles, for people to take a look as well. But bear in mind that what you do in academia, what you look at, has to marry with the actual reality. As I was explaining earlier to Ms Foo Mee Har's question, some of these conditions are always evolving. They are changing. We know we have an ageing population so the dynamics will change. Today, we are trying to fight the war of diabetes because we know diabetes leads to many more downstream consequential problems. A person may claim for an amputation of a left leg today. There is no telling tomorrow next year that he will have amputation of the other leg. Following, year after that, he may have one kidney failure or two kidney failures and going on to dialysis and following that, a transplant of the kidneys as well. Some of these things will have to evolve. It is not as if is hard-coded in science. It is a dynamic process. You cannot just predict so well ahead of time when a person lose his second leg or will have a kidney transplant.

When we talk about stress, I think it is important to remember my emphasis that this is universal, this is for life and importantly, no Singaporean will be denied coverage if you cannot pay premiums. We will find means to subsidise, to cover with MediFund or additional payment support if needed. Twenty-odd years as a doctor in the hospital, I have not seen a single patient who has been declined treatment on the account of inability to pay. And many of these predate even the era of MediShield Life. I can tell you, with MediShield Life, this will provide an even greater cushion and hopefully a lot more comfort to many of these patients.

15 Mr Xie Yao Quan asked the Minister for Health (a) what portion of an average bill for a surgical procedure in each Table for Surgical Procedures, including pre-operation scans, medical tests and other work-ups as well as post-operation rehabilitation, is paid through MediSave; (b) what portion of this average bill is paid out-of-pocket; and (c) whether MediShield Life coverage for surgical procedures can be further enhanced for a member above 80 years old, beyond the present recommended deductibles for day surgeries.

Sir, surgical procedures may be undertaken as part of an inpatient or day surgery episode. The Government provides significant subsidies of up to 80% for both the surgical procedure and the daily hospital charges, which include any number of tests, scans and rehabilitative services which may be required as part of the treatment episode.

MediShield Life is targeted at helping patients with more costly bills. For hospitalisations involving a more complex surgical procedure, it will cover about 15% to 20% of the total bill in a subsidised ward on average, while MediSave pays for about 5% to 10%. About 3% of the bill is then paid for in cash.

For example, an average subsidised bill for a heart artery bypass surgery, a much more complex surgery, would cost probably about $33,000 before subsidies, where MediShield Life pays for about $7,300, MediSave covers about $1,600, and the patient pays the remainder of about $200 in cash. The bulk of it is still taken care by subsidies and the remaining by the other components I just illustrated.

Overall, for all treatments, including less complex surgeries, eight in 10 of all subsidised hospitalisation bills incurred by Singaporeans were paid $100 in cash or less. So, eight in 10 Singaporean subsidised bills cost less than $100 in cash.

The MediShield Life and MediSave claim limits for surgical procedures are pegged to the complexity of the surgery required, as indicated in the Table of Surgical Procedures. The MediShield Life claim limits for surgical procedures were recently increased in January this year to keep pace with rising healthcare costs and provide better coverage for more complex surgical procedures. The MediShield Life Council has recommended further adjustments to the claim limits for daily ward and treatment charges as part of the ongoing MediShield Life Review. And we will also review MediSave limits in tandem with this. These adjustments will help to cover more of the inpatient or day surgery bill. In addition, the Council has also recommended to raise the policy year claim limit from the current $100,000 to $150,000 for that year. This will help older patients with exceptionally large bills due to long or multiple periods of hospitalisation within that same year. We will continue to review the MediShield Life and the MediSave limits regularly, to ensure they remain adequate in protecting Singaporeans, while keeping the premiums affordable.

MediFund, as I said earlier in a previous reply, is available for needy Singaporeans who require additional financial assistance to pay for their healthcare bills after subsidies, after MediSave and after MediShield Life. No Singaporean will be denied appropriate healthcare due to their inability to pay. So, I want to emphasise that point again – no Singaporean will be denied appropriate healthcare.

Mr Xie Yao Quan.

Mr Speaker, I thank the Senior Minister of State for his reply. I have one supplementary question. I recently saw an estimated bill for a procedure in the highest surgical table, table 7, and assuming a C class ward stay, the out-of-pocket expense, meaning the cash outlay after MediSave and MediShield Life claim was estimated to be $9,000.

My question is: were outlier surgical bills in the scope of the Council's review? And, if so, what were the conclusions of this review regarding the adequacy of MediShield Life coverage for such outlier bills?

Sir, I think such outlier bills will be unusual and I think it is useful if the Member can perhaps share the information through an email with the data. Because the policyholder has a deductible a year and the deductible, usually, is in range of $3,000. Anything beyond that, MediShield Life kicks in. So, for the policyholder to have to pay $9,000 in cash, I think it is quite unusual. So, we do need to take out a look at the specifics of the case whether they have required very esoteric or specialised treatment even though they may be a C Class patient where certain treatments would not fall within the scope of the usual subsidies, for example. I think that is something we can do.

And if the person does have difficulties paying the bill with cash, then this is where we need to get a medical social worker involved and see if MediFund can be a way to help defray the cost and help this person to settle the hospital bills and continue the treatment.

16 Mr Saktiandi Supaat asked the Deputy Prime Minister and Minister for Finance with regard to the recent theft of Budget 2020 grocery vouchers from residents' letter boxes (a) whether the Government has explored other distribution methods to issue the grocery vouchers seamlessly and securely to residents; and (b) whether technology can be used to provide seamless distribution of the grocery vouchers or future vouchers to households, for example, using PayNow.

17 Mr Lim Biow Chuan asked the Deputy Prime Minister and Minister for Finance (a) what are the reasons for sending the Budget 2020 grocery vouchers by post to eligible recipients; and (b) whether the Government has made any assessment on the risk of lost or stolen grocery vouchers.

18 Mr Ang Wei Neng asked the Deputy Prime Minister and Minister for Finance (a) how many sets of the $150 Budget 2020 grocery vouchers have been given to Singaporeans; (b) how many sets have been stolen; (c) whether other ways of distributing the grocery vouchers instead of posting them have been considered; and (d) whether digital distribution of the vouchers have been considered.

Mr Speaker, may I take Question Nos 16 to 18 together.

Yes, please.

The Grocery Vouchers scheme aims to help less well-off Singaporeans with their household expenses during this period of economic uncertainty. All Singaporeans aged 21 and above in 2020 living in 1- and 2-room HDB flats, who do not own more than one property, are eligible. This group of recipients is largely older, with the majority aged 55 and above.

About 150,000 sets of Grocery Vouchers, each worth $150, were mailed out via tracked registered mail to eligible Singaporeans in October this year. Of these 150,000 sets, the vast majority reached their intended recipients smoothly. Two hundred and twenty-nine sets, or less than 0.2%, have been reported as stolen as of 28 October 2020. The Police are investigating the reported theft cases and have made 55 arrests as of 28 October 2020. Based on SPF's investigations, the thefts appear to be opportunistic and the cases are not linked. In some cases, the recipients had left their letter boxes unlocked.

The small number of vouchers reported as stolen have been voided and replacement vouchers are being issued to eligible recipients. We encourage everyone to keep their letter boxes locked and repair any damaged letter boxes to avoid theft.

On the choice of the delivery mode, we balanced between public health constraints amidst COVID-19, reasonable convenience for the recipients and security. Some of the recipients may not own a smartphone, have a mobile data plan, or be digitally ready. If digital vouchers were used, more time and effort would have been needed to first provide appropriate digital interfaces, before the recipients can receive the intended support with their household expenses. That said, as digital literacy improves among older Singaporeans, we may be able to consider digital vouchers for this group in future.

We also considered the option of self-collection at the nearest Community Club or Centre, but this would create additional inconvenience for senior citizens, especially those with mobility issues. There may also be crowding at the collection points.

On balance, we sent the grocery vouchers via registered mail for optimal convenience to the intended recipients. Due to the COVID-19 pandemic and the need for safe distancing, SingPost adopted contactless delivery measures earlier this year, including the redirection of registered mail services to the letterboxes. SingPost will monitor and verify successful deliveries to recipients' letterboxes, with a photo taken by the postman as proof of delivery.

To mitigate theft and fraud, each voucher has unique features which enable us to identify the intended recipient and trace any voucher to specific locations and time of transaction. That said, we will continue to review the on-going disbursements to balance between security and convenience for recipients.

Order. End of Question Time. Introduction of Government Bills. Minister for Transport.

[Pursuant to Standing Order No 22(3), Written Answers to Question Nos 20, 22-24, 29-30, 32, 34-35, 37-39, 41-42, 44, 50, 52, 54-55, 58-66, 69, 71-72, 74 and 77-80 on the Order Paper are reproduced in the Appendix. Question Nos 19, 21, 25-28, 31, 33, 36, 40, 43, 45-49, 51, 53, 56-57, 67-68, 70, 73, 75-76 and 81 have been postponed to the sitting of Parliament on 3 November 2020.]

[(proc text) "to amend the Payment Services Act 2019 (Act 2 of 2019)", (proc text)]

[(proc text) presented by the Minister for Transport (Mr Ong Ye Kung) on behalf of the Prime Minister read the First time; to be read a Second time on the next available Sitting of Parliament, and to be printed. (proc text)]

[(proc text) "to give effect to the ASEAN Framework Agreement on Multimodal Transport signed at Vientiane, Lao People's Democratic Republic, on 17 November 2005 and for related purposes", (proc text)]

[(proc text) presented by the Senior Minister of State for Transport (Mr Chee Hong Tat) on behalf of the Minister for Transport read the First time; to be read a Second time on the next available Sitting of Parliament, and to be printed. (proc text)]

[(proc text) First Reading. (proc text)]

Mr Speaker, I have a Certificate of Urgency signed by the President in respect of the COVID-19 (Temporary Measures) (Amendment No 3) Bill, to be laid upon the Table.

[(proc text) Certificate of Urgency signed by the President in respect of the Bill, laid upon the Table by the Second Minister for Law. (proc text)]

The Certificate is in order. Minister, please proceed.

Thank you. Mr Speaker, I beg to introduce a Bill intituled "An Act to amend the COVID-19 (Temporary Measures) Act 2020."

[(proc text) Bill read the First time. (proc text)]

Mr Speaker, copies of the Bill have been provided to the Clerk, who will distribute it to Members now. [Handouts were distributed to hon Members.]

Minister, second reading when?

Tomorrow, Sir.

So be it. Order. The Clerk will now proceed to read the Orders of the day.

[(proc text) Order for Second Reading read. (proc text)]

Minister Iswaran.

Thank you, Mr Speaker. I beg to move, “That the Bill be now read a Second time”.

Sir, the Personal Data Protection Act, or PDPA, was enacted in 2012. Since then, there have been profound changes in the data landscape, most notably in the sheer variety and volume of data that is being generated and its economic significance. The typology of data is diverse – ranging from personal and machine-generated to meta data – with different risk implications.

The volume of data is growing at an unprecedented rate. Today, Tera/Peta/Zetta bytes of data – you can pick your prefix – are being generated by ubiquitous Internet-of-Things or IoT devices and sensors, our real and virtual world activities, and smart machines in manufacturing and supply chains. The International Data Corporation estimates that the volume of data that will be created in the next three years will eclipse the total data generated over the past 30 years.

Data is also a key economic asset in the digital economy. Data analytics provides valuable insights that inform decisions, generate efficiencies, enhance products and services, and power innovation. It is a critical resource for emerging technologies like artificial intelligence, which hold much transformative potential.

Our regulatory architecture must evolve and keep pace with these magnitudinal shifts. For example, we have initiated digital economy Agreements to position Singapore as a key node in the global network of digital flows and transactions. The proposed amendments to the PDPA are another step to ensure our legislative and regulatory regime is fit for purpose for a digital economy with a complex data landscape.

Our digital economy must be built on a solid foundation of trust. Consumers must have the confidence that their personal data will be secure and used responsibly, even as they benefit from digital opportunities and data-driven services. Organisations need certainty to harness personal data for legitimate business purposes, with the requisite safeguards and accountability. The proposed amendments to the PDPA seek to strike this balance so as to maximise the potential benefits and minimise the risks of collecting and using personal data.

In drafting the Bill, we have studied the data protection practices in jurisdictions like Australia, Canada, the European Union, Hong Kong and New Zealand. The proposed amendments also incorporate valuable feedback received through four public consultation exercises.

Sir, I will elaborate on the amendments which aim to: first, strengthen consumer trust through organisational accountability; second, ensure effective enforcement; third, enhance consumer autonomy; and fourth, support data use for innovation.

Firstly, to strengthen consumer trust, organisations must undertake responsibility for the personal data in their possession or control. Today, this principle of accountability is implied in sections 11 and 12 of the PDPA. Clause 4 of the Bill inserts a specific reference to accountability at Part III to make the principle explicit and to underscore its centrality.

This shift towards an accountability approach is in line with international trends and best practices in data protection laws. It supports interoperability, allowing multi-national corporations to more easily adapt global best practices in Singapore, and minimises compliance costs for Singapore-based companies which are expanding globally.

To further strengthen organisations’ accountability, clause 13 introduces a system for mandatory notification to the Personal Data Protection Commission, or PDPC, when a data breach occurs.

Under this Clause, organisations must notify the PDPC of data breaches that are of significant scale. In addition, organisations must notify both the PDPC and affected individuals when data breaches result, or are likely to result, in significant harm to individuals. This places the onus on organisations to assess the scale and impact of data breaches, ensures they are duly accountable to individuals for the personal data in their care, and empowers individuals to take timely measures to protect themselves if a data breach occurs.

Sir, the Bill also incorporates the recommendations of the Public Sector Data Security Review Committee in its report of November 2019.

First, clause 3 removes the current exclusion for agents of Government, thereby making clear that all private sector organisations are subject to the PDPA, even when they are acting on behalf of public agencies.

Second, the Bill strengthens individual accountability for the egregious mishandling of data. Clause 22 sets out new offences for (a) disclosure of personal data; (b) use of personal data that results in personal gain for the offender or another person, or harm or loss to another person; and (c) re-identification of anonymised information. Related amendments will also be made to the Public Sector (Governance) Act and the Monetary Authority of Singapore Act to align the public and private sector data regimes.

While the primary responsibility and liability for breaches of the PDPA rest with organisations, these new offences are aimed at individuals who know that their actions are not authorised or who act recklessly. The clause provides for defences to the new offences, such as independent testing of anonymisation deployed in information security systems. Also, these offences should not apply in situations where the conduct is solely in the nature of a private dispute, which should continue to be resolved through civil suits or other forms of dispute resolution.

Sir, let me now move to the second cluster of amendments, which seeks to enhance the flexibility and effectiveness of the PDPC’s enforcement.

Clause 23 introduces section 48L, a statutory scheme under which the PDPC may, in lieu of a full investigation, accept written voluntary undertakings from organisations to remedy breaches and prevent their recurrence. For example, such undertakings may be accepted when organisations with effective monitoring and breach management systems notify the PDPC of a data breach, and undertake in writing to implement their breach management plan.

Several jurisdictions, like Australia, Canada and the UK, accept voluntary undertakings as part of their enforcement regimes. The PDPC will exercise this option only if it assesses that it will achieve an outcome similar or superior to a full investigation. For transparency, the undertakings, as well as the PDPC’s decisions and considerations for accepting them, will be made public. In the event of non-compliance, the PDPC may issue a direction requiring the organisation to comply with its undertakings, or initiate investigations.

Section 48G of clause 23 empowers the PDPC to establish dispute resolution schemes for the resolution of customer complaints. The PDPC may also direct complainants and organisations to attempt to resolve disputes via mediation, without the need to secure the consent of both parties.

Clause 37 empowers the PDPC to require the attendance of an individual or employee to give statements and produce documents that are relevant to its investigations.

Clause 24 increases the maximum financial penalty for breaches of Parts III to VI, and the new Parts VIA and VIB, to 10% of an organisation’s annual turnover in Singapore or $1 million, whichever is higher. This penalty framework is similar to that in other domestic regulation and legislation, including the Competition Act and the Telecommunications Act.

During public consultations, concerns were raised about the higher financial penalties. I would like to assure Members, as well as the broader community, that the PDPC will ensure that financial penalties imposed are proportionate to the severity of the data breach. The Bill also provides for Ministerial discretion to review the effective date for these penalties to commence and we intend for the revised financial penalty cap to take effect no earlier than one year after the Act comes into force.

Sir, I also wish to highlight, at this juncture, that I will be moving a Notice of Amendment during the Committee Stage to address a clerical error in clause 24 of the Bill.

Clause 23 sets out amendments providing for the enforcement of the Do Not Call or DNC provisions under the same civil administrative regime as the data protection provisions. The new Part IXA of clause 22 also prohibits the use of dictionary attacks and address-harvesting software when sending messages to telephone numbers. Under clause 24, the maximum financial penalty that may be imposed on an organisation is 5% of annual turnover in Singapore or $1 million, whichever is higher, and $200,000 for an individual.

The new section 48O under clause 23 of the Bill updates the current right of private action by a person who suffers loss or damage directly as a result of a breach of the data protection provisions. The right of private action will be extended to organisations and public agencies that suffer direct loss or damage arising from contraventions of the new business-to-business obligations in the Bill.

Sir, the third set of amendments confers consumers with greater autonomy over data generated by their use of services and more control over how they receive commercial communications.

Under the PDPA, individuals have the right to access their personal data, and request for corrections to be made or a copy to be provided. Clause 14 extends this right by providing for a new Data Portability Obligation, which will enable individuals to request for a copy of their personal data to be transmitted to another organisation. Data portability is expected to spur competition and benefit consumers by encouraging the development of substitute as well as novel services.

Sir, though data portability has been introduced in practice in jurisdictions like Australia, California and the EU, it is a relatively new concept in Singapore. The PDPC will therefore work closely with all stakeholders for a phased implementation. Regulations will be issued in the coming months on the categories of data that should be portable and other technical and consumer protection details.

Clauses 22 and 41 update both the PDPA and the Spam Control Act to rationalise and harmonise the requirements across all modern digital channels for direct commercial communication with consumers. The options for direct communications have evolved since the enactment of the PDPA’s DNC provisions and the Spam Control Act’s spam control provisions. For example, instant messaging on mobile devices has become the communication channel of choice for many consumers. With the proposed amendments, organisations can offer consumers a unified experience in managing their subscription to commercial communications. The Bill also recognises the development of an industry of third party DNC checkers, and delineates the responsibilities and obligations of DNC checkers and the organisations that commission them.

Sir, the final set of amendments aims to provide organisations greater clarity on the use of personal data.

Currently, the PDPA recognises organisations’ need to use personal data for legitimate purposes, and accommodates them through exceptions to the consent requirement, or as deemed consent. For all other purposes, organisations have to obtain consent from the individual.

The proposed amendments update, restructure and clarify the lawful purposes recognised as exceptions under the PDPA, and the deemed consent provisions. Let me elaborate how changes to exceptions and deemed consent accommodate modern commercial arrangements and essential purposes such as security, and support business innovation.

Multiple layers of contracting and outsourcing are common in modern commercial arrangements. Clause 6 therefore expands deemed consent to cater for scenarios where personal data is passed from an organisation to successive layers of contractors for the organisation to fulfil the contract with its customer. Crucially, organisations relying on deemed consent for contractual necessity can only collect, use and disclose personal data where it is reasonably necessary to fulfil the contract with the individual.

Clause 31 introduces the First Schedule to the PDPA, which sets out a new exception to consent for these legitimate uses of personal data. To rely on this exception, organisations must conduct an assessment to eliminate or reduce risks associated with the collection, use or disclosure of personal data, and must be satisfied that the overall benefit of doing so outweighs any residual adverse effect on an individual. To ensure transparency, organisations must disclose when they rely on this exception. One of many potential use cases is anomaly detection in payment systems to prevent fraud or money-laundering.

The next set of enhancements supports innovation and introduction of new services.

The new First and Second Schedules introduced in clauses 31 and 32 make clear that organisations may use personal data for business improvement purposes including: operational efficiency and service improvements; developing or enhancing products or services; and knowing the organisations’ customers. As a safeguard, this exception can be relied upon only for purposes that a reasonable person may consider appropriate in the circumstances and where the purpose cannot be achieved without the use of the personal data.

Businesses have asked for this exception to also apply to entities within a group as they may consolidate corporate or administrative functions, or concentrate research and development expertise in a single unit that supports the entire group. Recognising this commercial reality, Part 5 of the new First Schedule in clause 31 allows related corporations to collect and disclose personal data among themselves for the same purposes. The Bill provides for additional safeguards for intra-group sharing by requiring related corporations to be bound by a contract, agreement or binding corporate rules to implement and maintain appropriate safeguards for the personal data.

The current research exception has also been revised in clause 32 to support commercial research and development that is not immediately directed at productisation, in other words, going upstream. This could apply to research institutes carrying out scientific research and development, educational institutes embarking on social sciences research, and organisations conducting market research to identify and understand potential customer segments.

Clause 7 introduces the new section 15A, which expands the consent regime by introducing deemed consent by notification. Under this provision, organisations may notify their customers of the new purpose and provide a reasonable period for them to opt out. Before doing so, organisations must conduct a risk assessment and conclude that the collection, use or disclosure of personal data in this manner will not likely have an adverse effect on the individual.

To illustrate, this would be useful for organisations that wish to use the personal data of existing customers for new purposes. For example, a financial institution may want to use voice data as an alternative means to authenticate and verify its customers. With these amendments, the financial institution can notify its customers of the intended use of their voice data, provide a reasonable opt-out period, and a contact number for customers’ queries. It should be noted that the individual may still withdraw his deemed consent any time after the opt-out period has lapsed.

The PDPC will put in place safeguards to ensure that organisations work with anonymised data as much as possible, clearly assess and address any potential adverse effects on individuals, and continue to seek express consent for sending direct marketing messages.

Sir, in summary, the proposed amendments to the PDPA will strengthen consumer trust with greater accountability for the protection of personal data; it will give greater certainty for organisations to use data for legitimate business purposes with the requisite safeguards; and it will ultimately enhance Singapore’s status as an important node in the global network of data flows and digital transactions. Sir, I beg to move.

[(proc text) Question proposed. (proc text)]

Mr Speaker, Sir, thank you for allowing me to speak on this Bill.

The world is undergoing massive digital transformation. The Fourth Industrial Revolution has perhaps already induced the fifth. Singapore is also set on this path as we strive towards becoming a Smart Nation.

The global digital race is intense. The risk of winner takes all is there and if this happens, where does that leave us. Therefore, there is urgency for us to transform and the urgency for us to transform is also increasing, in large part due to the on-going COVID-19 pandemic. According to a McKinsey study published in October 2020, companies surveyed across all sectors and regions digitised 20 to 25 times faster during COVID-19.

A consequence of digitalisation is that firms and people become more connected globally. This interconnectedness means access to bigger markets, which can be a boon for our talents and firms.

Singapore is thankfully at the forefront in Asia for having the right conditions to embrace a digital economy and smart nation. For example, in the IMD World Digital Competitiveness 2020 ranking, Singapore came in second, just behind the US.

Against this background, we can understand the explosion of data in Singapore and the importance of data to our digital economy. Data is vital to innovation.

Intuitively, data for innovation and data protection seem to conflict with each other. We need data to create and optimise products, processes and business models. Hence, there must be sufficient room for harnessing and using data. Too much controls leads to high compliance costs and distracts firms from innovating. Start-ups may also find it stifling.

Yet, data protection, specifically personal data, is essential to protecting the privacy and interests of our citizens.

Prior to the introduction of PDPA in 2012, public awareness of personal data protection was generally lower. Anecdotally, we can easily recall instances in which people trustingly and freely share NRIC numbers and other personal information with various parties for various purposes. Consequently, besides receiving unwanted marketing material, they also become vulnerable to scams and crimes.

Having laws and a mechanism to sufficiently protect personal data engenders greater trust. A clearly defined framework and laws that are effectively enforced will build consumers' confidence. One study of GDPR on how data protection regulation affects start-up innovation, published in November 2019, suggests that while the regulation appears to obstruct certain business models and technologies, it also clearly stimulated a certain amount of innovation and market opportunities.

More studies may be needed to study the effects of regulation on innovation. But we can agree that data protection regulation builds trust.

A healthy dose of trust enables meaningful data to be shared and drives innovation. This forms a virtuous cycle. Therefore, a balanced approach to regulation is important. Singapore needs high quality do-good innovations. Facilitating the use of data in a way that does not erode consumer trust will enable Singapore to innovate better and faster, and stay competitive.

Furthermore, firms are no longer confined to Singapore with growing global connections. They can operate out of Singapore and still access markets around the world. With the rise of cross-border e-trade and e-commerce, putting in place the right data laws will enhance our interoperability with global frameworks, thereby making it easier to do business and allow cross-border data flow. The idea of "if it works in Singapore, it works everywhere" will be very helpful in strengthening Singapore's position as a regional and global innovation hub.

Hence, I generally welcome the amendments to the PDPA. A balance in this approach is hard to strike and I do note that four consultations had been conducted to date and I believe that this effort is to precisely to try to strike this balance. But I do have four key concerns and would like to seek the Minister's clarifications.

First, the introduction of data portability and extension of spam controls and DNC provisions to all direct communication platforms would give consumers more control over their own data. But contraventions will now be dealt with as a civil proceeding in Court. I believe that this was originally a criminal proceeding. My concern is that this perceived "step down" will diminish the importance of personal data protection and the severity of breaching the law. Therefore, it risked undermining consumer trust. Can the Minister explain the rationale for this change?

Second, the deemed consent will now be enabled in this amendment. I understand this to be a move to avoid unnecessary inefficiencies in contracts with multiple layers of outsourcing. But I am also concerned, whether this will weaken consumer protection and therefore again, consumer trust. I note the measure that are put in place in Minister's speech earlier, I am just wondering what kind of risk-assessment and disclosure are we talking about. Would the Ministry regularly review whether these mechanisms are sufficient in providing sufficient protection and control to the consumers?

Third, the amendment facilitates the collection, use or disclosure of personal data for a broad range of business purposes such as enhancing goods or services, operational processes, personalised services and research and development. Clearly, sufficient flexibility in harnessing and using data is needed for innovation. But many actions can be categorically explained as addressing one of such purposes. How will the Government prevent abuse in a more upstream manner? Again, I say this because I know that enforcement has been enhanced, even individuals can be liable for breaches, but, I am wondering, whether it can be more upstream to provide enough guidelines to have more controls in place to prevent this in the first place.

I understand that it can be too tedious and time consuming for enterprises to keep applying for Government's approval for every relevant business decision. That would be counter productive to innovation. But, might there be a "whitelist" or "blacklist" that clearly articulates the boundaries, the "dos" and "don’ts", for the firms?

Fourth, finally, will the "relaxation" in the collection, use or disclosure of personal data for commercial innovation purposes in this Amendment be applied to the Government and public service? If so, what measures are in place to ensure consistency and avoid double standards in terms of data protection policy, standards and enforcement? The Government, as a body with regulatory powers and control over significant resources, will have to exercise greater discipline, caution and demonstrate transparency when handling personal data. A better understanding of how the Government handles personal data will no doubt strengthen public trust. Notwithstanding my concerns, I support the Bill.

Mr Speaker, the Personal Data Protection (Amendment) Bill is a much welcome update, eight years after the original Bill was first introduced in 2012. Eight years is a long time in the digital age. Technology has advanced by leaps and bounds and such technological improvements have also significantly changed our lives.

[Deputy Speaker (Mr Christopher de Souza) in the Chair]

Singapore has one of the highest Internet penetration rates in the world. Eighty-eight percent of the population are Internet users and spend close to seven hours a day on the Internet on average. They 8.9 million mobile connections, approximately 1.5 times more than the country's population. The easy access of the Internet allows people to engage in content sharing, online shopping, access gaming sites and social media platforms amongst others.

The law, too, has to keep up with the times. With increasing usage of such digital platforms comes increasing risk of personal data breaches. Most Singaporeans use their smartphones for social networking or to search for information. And as a result, the number of scammers, impersonators and cyber attacks has jumped nine folds in the last three years with 672 cases in the first 11 months of 2019, with over half the victims in their 20s to 40s. In fact, just a few days ago, personal information from 1.1 million RedMart customers were stolen from Lazada, an e-commerce platform. Personal data such as names, phone numbers, emails and physical mailing addresses were being sold online.

While I appreciate the effort to enhance the legal framework for the collection, use and disclosure of personal data, and to strengthen the accountability of organisations in respect of handling these data, I believe that there is still room for further refinement, namely in strengthening protection against unsolicited communication, clarifications on deemed consent and individuals rights under data portability.

Firstly, protection against unsolicited commercial messages. Mr Speaker, there are multiple safeguards in place within the original PDPA, with the intention to protect data privacy of individuals. One of such safeguards is the Do Not Call Registry when an individual can opt to be excluded for marketing or promotional messages. However, even with such safeguards in place, most Singaporeans still get unsolicited calls and messages from telesales agencies, moneylenders, illegal gambling advertisements and even phishing scam calls claiming to be from SingPost or DHL, asking them to collect the parcel.

Improved controls for unsolicited commercial messages and the section 43, would thus, be welcomed by consumers. A few years ago, I have personally lodged a Police report over persistent and unlicensed moneylending messages, but I was subsequently told by the Investigation Officer that the perpetrators are based overseas and that there is not much that we can do.

I acknowledged that some of these calls and messages are from overseas or even from masked numbers. However, some are actually conducted from local numbers and since 2005, it is compulsory to present customer details to telcos when purchasing both a prepaid and postpaid SIM card. Now, with the revised Bill when organisations have breached the PDPA Act, they could have to pay a penalty of 10% of their annual Singapore turnover or up to S$1 million dollars, whichever figure is higher.

However, I would like to ask, how can we better protect Singaporeans against unsolicited messaging and fraudulent communication from criminal syndicates, especially the elderly who are at risk of such scams. In particular, how does the Commission intend to take action against parties that are not even based in Singapore.

Second is the topic on deemed consent and deemed consent by notification. Mr Speaker, under the section of deemed consent, organisations are allowed to pass information to a third party for the fulfilment of the contract between the person and the organisation. While this makes sense, we should question if there are any mitigating factors to prevent the unwanted spreading of personal particulars or information from the third party organisation to subsequent parties for their benefit. For example, targeted marketing strategies as well as also raising the possible issue of increased risk of the spread of personal information. With personal data held by multiple parties across multiple jurisdictions potentially, the risk of the data leak is much higher and data protection is only as strong as the weakest link.

Furthermore, in the newly added section 15(a), deemed consent by notification, organisations are now able to collect information on the individual as long as the organisation has taken reasonable steps to inform the individual the organisation's intent, purpose to collect, use or disclose the person's data. The organisation itself also has to make sure that this is not likely to have an adverse effect on the individual. Individuals also have the right to opt out or withdraw consent within a reasonable period.

Mr Speaker, this system reduces the power of individuals relative to organisations who have the power to determine if the collection use and disclosure of personal data have any adverse effect on the individuals.

Section 15(a) also gives organisations the freedom to determine whether or not there is any adverse effect on the individual, which may not always be interpreted in the individual's favour. The new provision does serve as an exception to the consent obligation and moves the data protection framework away from express and explicit consent to implicit consent from individuals. For example, online shopping algorithms are designed to identify the type of product a person is interested in and to suggest to the person, items that he or she may like to purchase. If a person for example, has conditions that decreases his overall well-being with these advertisements, for example, having compulsive buying disorder, is that deemed as an adverse effect that should be intervened?

An organisation needs to identify and implement reasonable measures to eliminate or reduce the probability of the adverse effect. What are some of the ways that these can be executed in reality?

Further, what is regarded as a reasonable period for individuals to opt out? Are businesses allowed to determine this or will the commission be providing some guidance on the general timeframe?

Perhaps, we could adopt the practice from the European General Data Protection Regulation or GDPR, where there are specific categories of data in which processing such data is prohibited unless explicit consent is given by the individual. The PDPC could consider something similar by carving out exceptional categories of data where deemed consent by notification, cannot work or requires express consent.

Lastly, on the new Part VIB on data portability. The introduction of the new data portability obligation is a welcome one, where an organisation must at the request of an individual, transmit his or her personal data that is in the organisation's possession or under its control to another organisation in a commonly used machine-readable format. However, while the individual can request for his or her data to be transferred from one organisation to another, individuals themselves do not have the specific right to receive a copy of such data in a machine-readable format before it is ported over. This may pose issues for individuals that may want to limit or select the data they would like to hand over to the receiving organisation. And this will be unlike Article 20 of the European GDPR, which gives individuals the right to receive the personal data concerning him or her.

I acknowledge that there is an "access request" under section 21 of the current PDPA, where individuals may be able to get a copy of their personal data that is under the possession of the originating organisation. However, it is unclear to what extent this will apply hand-in-hand with the data portability obligation. Further in this digital world, it is often been said that, "the Internet never forgets". Could we perhaps go one step further and that in addition to data portability and access to one's personal data, can the individual be granted the right to request organisations to delete personal data at his or her request? This would then truly give meaning to the phrase under section 26G and that is to provide individuals with greater autonomy and control over their personal data.

Mr Deputy Speaker, to conclude, the updated PDPA is the right step in ensuring the data security of Singaporeans. What has perhaps not been fully addressed is firstly, the ability to enforce such rules to protect against unsolicited messages, particularly from overseas parties; secondly, the power imbalance between organisations and individuals under a deemed consent opt-out regime; and finally, the individual’s rights to his or her data. In this rapidly evolving digital age, it is imperative that we constantly assess and fine-tune the PDPA, in order to maintain the effectiveness of its safeguards.

Ms Joan Pereira.

Mr Deputy Speaker, Sir, the COVID-19 pandemic has led to the acceleration of digitalisation in almost every aspect of our lives. Hence, it has become even more important for us to ensure that our data protection legislation is keeping pace with advances in information technology.

Recent data breaches, which affected 1.1 million Redmart and 2.8 million Eatigo accounts, highlight once again the dangers lurking in the shadows of Internet space and the importance of cybersecurity and remedial procedures. I understand that users were informed quite quickly and were thus able to take measures to protect themselves, such as changing their passwords.

Different organisations have very different attitudes towards data protection. Therefore, I am very glad that the Bill’s amendments will make it compulsory for all organisations to notify the Personal Data Protection Commission or PDPC and affected individuals of data breaches. This will compel all companies to step up controls or risk heavy financial penalties.

However, I note that notifications are only required where there are significant number of people affected, which had previously been proposed at 500 or more, and where there could be significant harm for affected individuals, such as compromised NRIC and credit card numbers.

I would therefore like to ask the Minister why notifications to PDPC need be made only when the breaches involve a prescribed number of people? I feel that as long as an individual is affected, PDPC should be informed. I note that the current online reporting form for data breaches is already quite a simple one-page form that takes about eight to 10 minutes to fill up, and hence reporting should not be too onerous for organisations. Of course, any individual acting in a personal or domestic basis will not be caught by these obligations, as such a case is already excluded from the Act.

In addition, the Bill specified that PDPC must be notified within 72 hours and affected persons, without undue delay. This in effect means that there is no timeframe set for notifying individuals. I feel that there should be a clear deadline so that individuals can do the needful to protect themselves. Time is of the essence. The longer it takes to inform them, the greater the potential damage, and the PDPA is not simply a notification regime, but is also an Act that protects individuals and their data. Individuals may also need to take their own steps to change, mask or protect their data, including those on other platforms, especially if the leaks involve their digital identities, which are increasingly interlinked. Sir, in Mandarin.

(In Mandarin): [Please refer to Vernacular Speech.] In addition, the Bill specified that PDPC must be notified within 72 hours, and affected persons, without undue delay. This in effect, means that there is no timeframe set for notifying individuals. I feel that there should be a clear deadline so that individuals can do the needful to protect themselves. Time is of the essence. The longer it takes to inform them, the greater the potential damage, and the PDPA is not simply a notification regime, but is also an Act that protects individuals and their data. Individuals may also need to take their own steps to change, mask or protect their data, including those on other platforms, especially if the leaks involve their digital identities, which are increasingly interlinked.

(In English): I welcome more stringent controls over spam and telemarketing through related amendments to the Spam Control Act or SCA. The SCA will be updated to protect users from unsolicited messages, particularly bulk commercial texts sent to instant messaging accounts, such as WhatsApp and Facebook Messenger. The most common messages make offers of loans, gambling and betting.

My question is how the Ministry would deal with perpetrators from overseas. How can they be caught and what recourse do our people have, besides blocking these numbers as and when they attack? Would the Ministry be able to explore cross-jurisdictional cooperation with countries where these overseas numbers have originated from, so that there is a possibility of either bringing these syndicates to justice or at least to shut them down?

Finally, I urge PDPC to check and conduct selective audits to ensure that all companies that collect consumers’ personal data have a tight regime in protecting the data collected. If there are gaps, would PDPC consider providing more resources and experts at a reasonable or low cost to help and guide these companies, since prevention is always better than cure? Sir, I would like to conclude with my support for the Bill.

Mr Shawn Huang.

Mr Deputy Speaker, Sir, the digital landscape of Singapore is constantly evolving. Cross-border data flows and data capitalisation is increasing the importance for business competitiveness.

The current regime of consent-based data protection faces challenges from the rapid, technological developments. In addition, the recent data breaches suffered by the likes of Lazada, Razer and Eatigo evidenced the need for solid personal data protection laws. Personal data protection laws must offer adequate protection to individuals but still allow businesses to remain agile and competitive. The amendments to the PDPA to shift towards a risk-based accountability approach is practical and in line with modern economy and global data protection laws. These amendments should attend to a basic tenet of protecting the rights of individuals.

I wish to clarify on two points.

Under the Bill, organisations may process personal data without the consent of individuals in circumstances classified as "legitimate interests". This concept may be ambiguous in certain contexts. Without further guidance on the scope of legitimate interests, especially for vulnerable segments such as children be provided. This will ensure that individuals are protected and companies can comply to requirements efficiently and responsibly.

Secondly, the Bill requires organisations to notify PDPC of data breaches that result in or likely to result in significant harm to affected individuals or it is of significant scale. Organisations will also be required to notify affected individuals if the data breach is likely to result in significant harm to them. The concept of significant harm and significant scale may again ne very ambiguous. As such, would further guidance of the concept of significant harm and significant scale be provided. If significant scale constitutes prescribed number, can I clarify on how this number is obtained? I agree with the need to strengthen the accountability of organisations and enabling of meaningful consent as reflected in the Bill. Mr Deputy Speaker, Sir, I support the Bill.

Order. I propose to take a break now. I suspend the Sitting and will take the Chair again at 4.15 pm.

Sitting accordingly suspended

at 3.55 pm until 4.15 pm.

Sitting resumed at 4.15 pm.

[Mr Deputy Speaker in the Chair]

[(proc text) Debate resumed. (proc text)]

Mr Gerald Giam.

Mr Deputy Speaker, before I speak, I would like to declare my interest as a director and shareholder of a technology company which manages and safeguards customers' personal data.

The protection of personal data is a concern of all Singaporeans, particularly when they learn about mass data breaches suffered by public agencies and private companies, both here and abroad.

There is now greater public awareness among members of the public and organisations of the need to safeguard personal data. The public has a right to demand strong protection of their personal data. At the same time, policy-makers have to be aware of the business costs of complying with stringent regulations. It is thus necessary to make periodic amendments to the Personal Data Protection Act or PDPA and the Spam Control Act to bring our data privacy regulations more in line with current realities and global norms.

I will focus on three areas in my speech.

First, ensuring that personal data is protected where it matters to citizens, yet without unnecessarily burdening business with regulations.

Second, aligning the PDPA with the GDPR, the European Union's general data protection regulation to avoid conflating rules.

Third, harmonising the Government's data protection rules with the PDPA to ensure that Government agencies safeguard personal data the same way as it expects private sector companies to do.

Everyone wants their personal data protected from prying eyes and unwanted marketers. No one likes being interrupted by unsolicited phone calls from people they do not know, trying to sell things that they do not want or tricking them into sharing confidential information. They certainly do not want scammers using their NRIC address or credit card numbers to take up unauthorised loans, buy stolen goods or, worst of all, sell their personal data on the dark web.

We had made good progress in personal data protection since the introduction of the PDPA in 2012. However, some things are still slipping through. For example, despite being on the Do Not Call Registry since 2013, I still get phone calls or text messages from individuals offering cheap loans, access to illegal gambling sites or asking me to pick up packages which I never ordered.

More than 46,000 complaints on unsolicited calls and text messages had been made to the Personal Data Protection Commission or PDPC since 2017. I have met residents who were scammed of tens of thousands of dollars by swindlers who persuaded them over the phone to reveal their Internet banking passwords or one-time PINs. Still others had loans in their names taken up with loan sharks because their NRICs were misused. For most Singaporeans, these are the biggest concerns with regard to personal data privacy.

On the other hand, fewer people are concerned about what kind of cookies a website is using to track them and many find cookie notices on websites nowadays more of an irritant than a privacy protecting measure.

There is a debate going on about how to stop big tech companies from hoovering our personal data in order to serve us tailored advertisements. This is a valid concern but not something that keeps the average citizen awake at night. Privacy regulations should therefore give greater focus to the areas of data privacy that matter most to Singaporeans.

I will now move on to discussing the PDPA and GDPR. The general data protection regulation is a wide-ranging personal data protection legislation from the EU which has extraterritorial effect. The GDPR applies not only to European companies but also to Singapore companies that offer goods and services to individuals in the EU, even if those companies do not have an EU presence.

The PDPA covers much of the GDPR but there are many requirements in the GDPR that are more stringent than that of the PDPA. For example, the GDPR provides extra protection for special categories of data, which include data about an individual's race, religion, political opinions and health information. The PDPA does not specifically define what constitutes sensitive personal data although guidance from PDPC suggests that personal data of a sensitive nature should be accorded a higher level of protection as a matter of good practice. The GDPR also sets a more stringent standard for consent, which must be obtained in a clear, open, specific and transparent manner.

Despite its less prescriptive approach compared to the GDPR, the PDPA's model may be preferred by countries whose approach towards privacy is closer to Singapore's than the EU's. However, we should guard against the PDPA acquiring a reputation of providing a GDPR-minus standard of personal data protection. It would be much better if the PDPA were known internationally as a law that strikes the right balance between data protection and business efficiency.

While the PDPA may not be identical to the GDPR, it should not have provisions or interpretations which are in conflict with the GDPR. This way, Singapore businesses, which need to comply with the GDPR will be able to rest easy, knowing that they also comply with the PDPA.

Based on my analysis of the PDPA, I am glad to note that this currently appears to be the case. I hope that this approach will continue through future amendments to the PDPA.

My last point concerns the personal data protection obligations of the Government. Unlike the GDPR, the PDPA specifically exempts the Government from having to comply with it. The Government has explained that this is because it has its own set of data privacy standards, which are set out in the Public Sector Governance Act or PSGA, the Official Secrets Act or OSA, the Banking Act, the Income Tax Act or ITA, the Statistics Act and the Instruction Manual 8 or IM8, among others.

I have worked with the Government both as a civil servant and a government contractor, and I am well aware of the robust rules and practices in place to safeguard personal data. However, complying with a different set of data protection rules from the private sector is problematic for several reasons.

First, the data protection provisions in the various Acts differ in their standard of protection. For example, the maximum fines for violations of the different statutes range from $1,000 to $250,000. This is not surprising since these laws were enacted long before the PDPA and without the specific purpose of general data protection in mind. Having public data controllers governed by a hodge podge of separate legislation is likely to lead to differing standards and gaps in coverage.

Second, the lack of a single set of rules governing privacy leaves individual data owners unclear as to what level of personal data protection they are entitled to. Most individuals concerned about privacy would be more familiar with the protections provided under the PDPA than what is provided for under the PSGA, OSA, ITA, IM8 and others. In fact, the IM8 is not even a public document that ordinary citizens can access.

The Government's exemption from the PDPA could lead to concerns among citizens about how their sensitive data is being used by the Government. For example, many are now worried about how the information collected by SafeEntry and Trace Together will be processed. Others continue to worry about how our security services may be collecting and sharing sensitive information about citizens with little independent oversight.

Third, the Government regulations cover mainly internal checks on the Government Ministries and agencies, and criminal and disciplinary consequences for individual officers. A citizen who has incurred damages as a result of a data breach by a Government agency has little recourse to pursue civil remedies against that agency. The PDPA, on the other hand, grant such recourse against offending organisations. This could be seen as a lower threshold of accountability on the part of the Government should data beaches occur.

Why should public data controllers be treated differently from private data controllers. I believe there is merit in having a universal standard of personal data protection that applies to both private as well as public data controllers. If there is a need to maintain discretion because of national security reasons, these exemptions can be explicitly written into the PDPA.

I hope the Government can eventually harmonise the data protection clauses in the separate legislations and bring them under the umbrella of the PDPA and make the PDPA apply to Government agencies as well.

Mr Deputy Speaker, the overarching goal of data protection legislation is to ensure that personal data is not misused in a way that causes harm to individual. This can be achieved without causing undue inefficiencies in the functioning of businesses or the Government. We need to continue to update the PDPA to keep up with the realities on the ground. The Government should hold itself to the same level of data privacy standards, procedures and accountability it expects of private sector companies. Sir, I support the Bill.

Mr Deputy Speaker, I rise in support of the Personal Data Protection (Amendment) Bill.

Sir, with the increasing demand and trend for personalisation of products and services and the pace of digitalisation in many aspects of everyday life and work, sharing personal information is increasingly a requirement for us to be able to gain access to a service, obtain a benefit or even to participate.

Against this backdrop, the Personal Data Protection (Amendment) Bill is timely. This looks to ensuring the protection and responsible use of personal data by organisations. Clear accountability on what data is collected, used and disclosed digitally or even physically, will help in building consumers' trust. For businesses, having clarity on the use of personal data and the trust of consumers will give them the confidence to use the data to innovate and improve services.

With advancement in technology, the volume of personal data collected and aggregated is vast and growing. With capabilities like data analytics, machine learning and artificial intelligence making sense of the data and using it to gain valuable insights is real. If used appropriately, this can provide benefits but it can also be exploited for not so well-meaning purposes.

To strengthen trust and at the same time derive the value of data, we need to balance and handle the "right to data privacy", "data security" and "the proper use of data to innovate". These objectives may seem at odds.

My speech will focus on trust which I believe is core to achieving the objectives of this Bill. I will speak on two aspects of the proposed amendment which are key to protecting data while appropriately enabling the leverage of data for innovation.

First, the strengthening of organisational accountability. This will enchance the protection for indivduals and is key to building trust with individuals on how their personal data is used.

Second, amendment of section 15 regarding "deemed consent" and changes to the exceptions and the new section 15A "deemed consent by notification" and a reasonable period and manner for the individual to withdraw consent.

Let me touch now on strengthening of organisational accountability.

The amendments proposed in the Bill will make mandatory and will require organisations to report data breaches to the Personal Data Protection Commission or PDPC, if such breaches are likely to result in significant harm or impact to individuals, and/or are of a significant scale. Organisations must also notify affected individuals when a data breach is likely to result in significant harm or impact to them, regardless of the scale of the breach.

Why is this important? Cybercrime statistics show that data breaches continue to rise. And just to cite one example, on SafeatLast Editor's Choice, one of the key cybercrime statistics, that a hacker attack takes place every 39 seconds. So, you can imagine, as I am speaking here, by the time I finish my speech, the number of attacks that have happened. So, notification to individuals is important because it will allow them to take timely mitigating measures but also it is important that there is notification because it allows the national actions, both of the organisations and other organisations impacted to take the necessary actions.

To signal the importance of organisational compliance and the proper handling of personal data, irresponsible organisations will face a higher financial penalty cap of 10% of annual gross turnover in Singapore or $1 million, and if I heard the Minister correctly, whichever is higher. The Bill also includes the introduction of offences for the mishandling by individuals of personal data and fines and imprisonment for a term not exceeding two years or both.

With increased accountability, offences and penalties – while I do agree that it is necessary – there may also be a danger of organisations becoming overly risk averse to protect themselves. This seems a little strange but one would say it is okay for organisations to protect themselves. If they do all the right things, individuals will be protected. It really depends. If the scale is on organisations protecting themselves from being penalised or against enforcement, we may also lose the focus on actually protecting consumer's data privacy and risks. This may also have a negative impact on the desire to use data appropriately to innovate and improve productivity.

The Bill's introduction to require organisations to conduct risk assessments to identify and mitigate the adverse impact on individuals is the right approach because it balances this, because it allows organisations to analyse what is the real risk and really then make that decision of being able to notify and then decide to innovate. I will later touch on this in my speech on the point about "deemed consent" associated with the risk assessments.

These amendments to strengthen accountability of organisations are necessary as they give businesses clear guidelines on how they handle personal data. We must, however, recognise that there will be compliance costs associated. Given the value of personal data and the inherent risks, I think it is important that organisations take the responsibility and it is a necessary cost of doing business. But with the current economic challenges, can the Minister also share if there will be any support given to businesses in managing the increased cost of compliance and also the increased complexity of compliance?

Let me touch on the amendments to section 15 and the point about "deemed consent" and the new section 15A "deemed consent by notification".

As businesses may need to partner, subcontract and outsource services to deliver their contractual obligations to customers, the amendments proposed for section 15 introduces deemed consent by contractual necessity. I think this is important because it does recognise a new business model and facilitates collection, use and disclosure of personal data by organisations with their contractors and partners to enable better understanding of customers for more effective performance and fulfillment of contractual obligations to customers.

But let me now touch on the introduction of the new section 15A relating to deemed consent by notification. What is required of an organisation if it wishes to rely on this new section 15A to obtain deemed consent by notification is that they need to conduct risk assessments to identify and mitigate adverse effects that the collection, use and disclosure of the personal data may have on individuals.

This will allow them to collect and process personal data to use, to improves services as well as productivity research purposes and also for fraud detection and security. All these are good. I do support and agree that there are benefits for consumers when organisations use data to innovate.

I do, however, have questions on how we ensure that deemed consent by contractual necessity and by notification does not lead to unintended and more importantly, uninformed consent?

The requirements outlined in the Bill for notification, the manner and the period for individuals to opt out are fairly broad. I agree that it should not be prescriptive but there must be measures to ensure that individuals fully understand that they are deemed to have given their consent for the use of their personal data if they do not opt out. And I am glad that the Minister, in his speech did say that the individuals can also withdraw consent even after the opt-out period. I think this is important.

Why am I saying this? Because many of us today, we just tick that box that says "I consent" but not realising that actually, even when you do not do it, it is deemed consent and therefore it is an uninformed consent. What I am asking for is, ensuring that there is informed consent, not necessarily that we take away deemed consent because, at the end of the day, what is important is consumer trust. And if consumers understand that fundamentally, then the protection and the appropriate use of information will be there because organisations will have that confidence to use the data.

Mr Deputy Speaker, I must admit that when I first reviewed the amendments proposed in the Bill, I was concerned with the challenge of how we can achieve the protection of personal data while still allowing the effective use of personal data for innovation because they seem at the opposite of each other.

But having worked through the details of the Bill, and I must admit that there was quite a lot of details on the Bill, I see that it does strive to achieve the difficult balance of protecting consumer personal data and, at the same time, not limit the use of data to innovate and deliver greater benefit. In today's day and age and the role that Singapore plays, I think it is important.

I do want to make a special mention to the team that worked on this because, clearly there was a lot of work put in and a lot of thought given in terms of that balance because when I first started looking at this amendment Bill, I actually had the very opposite feeling about it. But having gone through the details, I think there has been very good thought given to strengthening of accountability but at the same time, not limiting that use of data for innovations while protecting individuals' privacy.

I believe that success will be achieved when individuals trust that their personal data is protected. And this will in turn gives organisations confidence to use and leverage the data for insights to deliver value. Mr Deputy Speaker, I support the Bill.

Mr Deputy Speaker, Sir, the PDPA Bill seeks to update the original PDPA Act to strengthen data privacy protections and individual data autonomy, ensure greater accountability on the part of organisations and enhance the power of the PDPC.

I do not oppose the Bill and agree with the comments expressed by my Parliamentary colleagues Mr Gerald Giam and Mr Louis Chua Kheng Wee. I shall focus my speech on just a few areas where I would like to pose technical clarifications and suggestions.

Firstly, Sir, I would like to speak on the mandatory data breach reporting guideline.

I suggest that the we could, in section 26B, provide a clearer and more precise definition of "significant harm" to an individual that would warrant notification. In other words, it would be helpful if the Government could provide a statutory definition or further guidance as to the factors that are to be taken into account in assessing the nature of the "harm" and any relevant thresholds before the PDPC would hold the view that "significant harm" has been occasioned, so that organisations have clarity in their assessment as to when a data breach will be considered a notifiable data breach. The definition provided in section 26B subsection 2 currently seems rather broad.

Also, on this point, allowing for exemption of organisations by the PDPC from notifying affected individuals of data breaches in the new section 26D is problematic. In this clause, the obligation to notify affected individuals can be waived "subject to any conditions that the [PDPC] thinks fit".

Given that such an overly broad "escape" clause may undermine the legal spirit of the mandatory data breach notification requirement, I would like to ask: what are circumstances in which the Government may activate this clause, and would the Government consider tightening and carefully circumscribing the scope and use of this clause, to reduce any potential for abuse and the perception of arbitrariness?

Secondly, Sir, the amended Bill creates new offences to hold individuals accountable for egregious mishandling of personal data on behalf of an organisation or public agency.

The thrust of the PDPA is to hold businesses responsible such that risk can be treated as a business cost rather than something to be potentially placed on individual "scapegoats" who may have little bargaining power as employees.

With new offences for the unauthorised mishandling of personal data by individuals, including employees, there is the possibility that "scapegoating" may happen. Junior employees with lesser bargaining power may be held liable, while higher ranked employees and the organisation itself may face reduced accountability thereby.

While the amendments spell out possible grounds of defence that the accused individual may take, has the Government given some thought to what additional measures should be put in place to prevent such "scapegoating"?

Thirdly, I would like to speak about what has been referred to, in the context of the GDPR, as the "right to be forgotten".

I would suggest further extending the retention limitation obligations in the PDPA to be aligned with Article 17 of the GDPR, where individuals may interface with an organisation to request the deletion of data and where withdrawal of consent may lead to an obligation to immediately delete personal data. Sir, such an obligation seems to me to be not overly onerous on businesses.

Fourthly, businesses, especially SMEs, sole proprietorships and some not-for-profit organisations, may experience difficulties in adhering to these new, more rigorous regulations.

I would like to ask when this Bill will come into effect and would the Government consider allowing for a transition or grace period? Such a suggestion would be in line with, firstly, the previous 18-month transition period adopted before most of the substantive provisions of the PDPA took effect when it was enacted in 2012; and secondly, the two-year transition or sunrise period which was given when the GDPR was adopted by the European Union in 2016, during which time there was delayed enforcement so that organisations would have time to prepare.

During this transition period, the PDPC could consider providing greater support to SMEs and volunteer organisations in several respects.

Firstly, training of staff to understand the new requirements imposed and guidance to introduce new processes and frameworks in compliance with those requirements.

For instance, in the 2018 SingHealth data breach, the delay of 28 days in the reporting of the incident to senior management could be attributed to lack of staff training and absence of a reporting framework to some extent.

Voluntary organisations, in particular, may benefit from such training as they may lack knowledge of these requirements. For instance, in 2019, Henry Park Primary School Parents' Association was found by the PDPC to have been negligent in failing to make reasonable security arrangements to protect members' personal data and appoint a Data Protection Officer.

Secondly, Sir, the PDPC could, during this transitional period, provide guidance and possibly subsidies for adopting compliant IT systems, to reduce the compliance burden on these organisations while encouraging good data protection practices.

This would be particularly helpful for SMEs and business-to-business or B2B companies in Singapore, as these often store data in an unstructured way, using folders in an ad hoc fashion. As such, if a data breach were to happen, the data review process could be particularly complex, time-consuming and costly for them. Thank you.

Alright. Mr Patrick Tay.

Mr Deputy Speaker, Sir, I declare my interest as a member of the Data Protection Advisory Committee of the Personal Data Protection Commission (PDPC).

I rise in support of this Bill, which seeks to achieve the twin objectives of strengthening consumer confidence that their personal data will be used responsibly; and enabling organisations to confidently harness personal data for innovation which, in turn, would benefit our citizens and Singapore's economy. It has been eight years since the PDPA was enacted in 2012. The objective then was to provide a baseline standard for data protection in the private sector.

This Bill seeks to introduce, inter alia, the concept of organisational accountability, mandatory data breach reporting to the PDPC, new requirements for organisations to conduct risk assessments, a new data portability obligation to enhance consumer autonomy, a higher financial penalty cap, enhanced enforcement of the Do Not Call provisions and new exceptions and definitions of consent to facilitate the use and movement of data by organisations.

Undeniably, there will be some who will question the timing and impact of these proposed amendments. After all, we are only starting to see the effects of the COVID-19 pandemic unravelling and facing a probable imminent global recession. These amendments will necessitate changes in an organisation’s policies, systems and processes. With organisations already trying to cope with stretched resources and trying to avoid going belly-up, measures, such as stiffer fines for data breaches or making it mandatory for organisations to notify the PDPC, may seem counterproductive. Nevertheless, I support the proposed amendments for the following reasons.

These long-contemplated amendments are vital and tabled none too soon. As we have read in the news, e-commerce and tech companies are looking to expand or invest in Singapore, using Singapore as a launchpad for expansion, not only into the ASEAN region but globally as well. Singapore has hereinafter taken steps to establish and position itself as a data hub. There is, therefore, no better time than the present to refine our data protection regulations as we continue in our race to lead in a data-driven economy.

We must recognise and seize these opportunities to ride the tech wave. Speaking also as the Assistant Secretary-General of NTUC, the creation of job opportunities and the sharpening of Singapore’s innovation capability, without question, would, and can only, be advantageous to our workers in this current economic climate. The refinement of our data protection framework and policies that support the growth of our digital economy is an essential element in our nation's overall blueprint for the future and for continued growth. With our infrastructure and links to the region and the world, we are in a good position to ride the tech wave and to continue tapping and building on our potential and strengths.

Furthermore, data protection laws are still in an early evolutionary stage globally. These proposed amendments seek to bring our data protection laws in greater alignment with the global standard. Indeed, our aspiration is not just to keep up with the data protection regulations like the GDPR. We have more than a fighting chance of becoming one of the leading authorities in data protection in the region and in the world.

At the same time, consumers are increasingly aware and concerned about the way their personal data is being collected, used and shared. They demand for convenience, speed, personalised user experience, flexibility and, at the same time, greater confidence and assurance in the way their personal data is safeguarded and used. I hope this set of changes will let consumers be assured in this respect. This is especially important, in light of the recent compromise of 1.1 million user accounts of RedMart, Lazada's online grocery store and other e-commerce platforms.

Firstly, the framework for the collection, use and disclosure of personal data will be updated to enable consent to be sought when meaningful and necessary. Where consent is not sought, safeguards will be put in place for organisations to be held accountable for their practices. For example, with the introduction of the notification with opt-out option, organisations will be able to obtain meaningful consent from consumers and use this data in new ways. However, organisations must first ascertain that there is no adverse effect on the individual before obtaining consent in this manner.

Even as businesses are given more scope to leverage data, consumers will still have flexibility and the ability to opt out if and when they so choose. Express consent will still be required for organisations to send direct marketing messages and updates to the Spam Control Act and Do Not Call or DNC provisions will allow consumers greater protection from unwanted communications across all direct communication platforms, that is, voice calls, SMSes, instant messaging and emails. At the same time, with the new Data Portability obligation, consumers no longer need to worry about being locked-in to a single service provider and can easily switch to new services.

For businesses concerned with the increase in the limits of financial penalties, I think there is no cause for alarm, as this is targeted towards irresponsible organisations in the most serious cases. Similarly, the introduction of new offences is only intended for individuals who egregiously mishandle personal data and not where employees are acting within the scope of their employment, or for data professionals, cybersecurity specialists, artificial intelligence engineers or researchers carrying out legitimate activities.

While I am supportive of the amendments to this Bill, I would be grateful if the Minister could address the following concerns.

First, the costs and investment in complying with the new data portability obligation may be significant. Will organisations, especially SMEs, receive any assistance in this regard? Can the Minister share how MCI or PDPC plans to help reduce the compliance burden on organisations?

Second, the proposed amendments seek to remove the exclusion for organisations acting on behalf of public agencies from compliance with the PDPA obligations. Can the Minister elaborate on the impact of this amendment and how organisations, acting as the data intermediaries of public agencies, can be accorded protection in the performance of their tasks? Can such organisations reasonably comply with their obligations under the PDPA, given that public agencies, that, the principal, are not subject to the provisions of the PDPA?

Third, the proposed criminal offences against individuals for the mishandling of personal data have been drafted rather widely. Would the Minister provide some guidance on when and how these provisions would apply?

Sir, clarifications notwithstanding, I stand in support of this Bill.

Sir, since we passed the Personal Data Protection Act in 2012, the Personal Data Protection Commission has been busy. It has investigated numerous data breaches and received a record-breaking 4,500 complaints last year. Data protection has become only more concerning and this Bill helps address those concerns.

I am heartened by the amendments requiring organisations to inform people who are affected by data breaches and to help people port their data to other services. These changes will help Singaporeans feel a greater sense of control over their data. Many will welcome these enhancements. That said, I have three points of clarification on this Bill.

My first point is on data breaches. The Bill introduces a requirement for organisations to notify the Commission and affected individuals in certain instances where there is a data breach. One instance is when the data breach results in, or is likely to result in, significant harm to an affected individual. I understand the Commission intends to prescribe classes of personal data considered likely to result in significant harm to individuals. Beyond this, can Minister clarify what other circumstances will be prescribed to help organisations assess whether a data breach may lead to “significant harm” to affected individuals under section 26B?

Further, can Minister clarify what standard the Commission will apply when it reviews an organisation’s assessment on whether a data breach is notifiable? An organisation may decide not to notify affected individuals of a data breach because they assess that there was no significant harm caused and the breach was not of a significant scale. If the Commissioner later disagrees with this assessment and reviews the organisation’s assessment, will the Commissioner do so by holding the organisation to the standard of a reasonable person? Can Minister also clarify whether the Commission will consider a good-faith, systematic assessment by an organisation as a mitigating factor in deciding whether and how much to penalise the organisation for failing to notify the Commission of a data breach?

My second point is on the definition of adverse effect. The Bill now allows organisations to avoid asking for consent in certain cases. In several cases, they have to assess whether their action will have an “adverse effect” on individuals. Under section 15A, organisations have to assess the extent of adverse effect to decide whether deemed consent by notification is sufficient consent. Under section 17, organisations have to weigh such adverse effects against the “legitimate interests” of the organisation or of other people.

Can Minister define what it means to impose an “adverse effect” on an individual and what are some examples of it? Such clarity is important because organisations will likely face practical challenges in identifying every possible adverse effect on an individual, and a wrong assessment may lead to harsher penalties for them.

In line with the Act’s shift to a risk-based accountability approach, I would also suggest applying a standard of reasonableness when determining whether organisations have fulfilled their obligations. In other words, they should be required to assess the “adverse effect” on an individual only to the standard of a reasonable person.

Finally, can Minister also clarify the intended differences between “significant harm” and “adverse effect” on individuals? It will help organisations comply with the new Act.

My third point is about data porting obligation. The Bill empowers individuals to make data porting requests. This means individuals can ask organisations to send their personal information to other organisations. Organisations can say no only under conditions outlined in the new Twelfth Schedule. Will the Commission be releasing guidelines and examples to help organisations understand whether each of the conditions applies to them? The guidelines should especially clarify three conditions.

First, these guidelines should clarify when the data would “reveal confidential commercial information” that could “harm the competitive position of the organisation”. I am sure many companies will be keen to cite this condition if they are asked to transfer data to a competitor.

Second, the guidelines should clarify when the data is “trivial”.

Third, the guidelines should clarify when the data porting request is “frivolous” or “vexatious”.

Data porting is a new concept to many organisations in Singapore. Organisations will benefit from greater clarity on what counts as trivial, frivolous or vexatious.

Sir, notwithstanding these clarifications, I stand in support of the Bill.

Mr Deputy Speaker, Sir, I rise to support the Bill. The Bill is a timely and necessary effort to strengthen personal data management. The pandemic has accelerated the need to go digital. This results in the sharing of personal data with businesses in exchange for their products and services. And unless the data is carefully protected, it will expose many people vulnerable to cybercrimes. According to a July CNBC report, large-scale data breaches have grown in intensity and frequency in 2020. The number of breaches rose by 273% in the first quarter, compared to the same period last year. This is largely attributed to more businesses being conducted online during the COVID period.

I appreciate the move to enhance the Do Not Call provisions. The popularity of instant messaging platforms like Whatsapp, Telegram and WeChat has surpassed that of SMSes. During lockdowns, these are the platforms that residents use to communicate with each other, especially between seniors and their families.

But many of these platforms have been abused to spread fake news, commit fraud and scams. They can even spread malicious links containing malware. We hear of scammers making phone calls supposedly representing MOH during this pandemic. Many seniors, including several from my constituency, have reported falling prey to scams and unsolicited advertisements. Many of these fraudulent messages are from overseas sources. And some phone numbers have been spoofed to conceal the perpetrator’s actual number. As such, it is impossible to report them to the authorities, or to block them on your handphone. May I ask how would the Ministry help to safeguard our citizens against these perpetrators? If not, what can be done to safeguard the interests of phone users?

Despite success in the reduction of unsolicited marketing messages from commercial companies, users are at greater risk of more sinister problems. These include scams via robo-calls and text messages from unlicensed moneylenders and online gambling. The frequency of such messages has increased. The culprits prey on the vulnerable. They also exploit the desperation of victims during this challenging period.

I met Mdm K, a young professional, at my Meet the People Session, or MPS, last week, who fell victim to an online scam and was swindled of her $100,000 life-savings. She got a message from an overseas company offering her an investment proposal that promised her 20% annual returns. She did some simple checks on the company. After some brief interactions over email, she decided to wire across the money to the company. She has not heard from the company since. She went to file a police report. If someone like Mdm K can fall for such a scam, other residents like seniors are at an even higher risk.

The Government’s amendments for the PDPA and Spam Control Act will only work on legitimate businesses. This case highlights that the Government today has no reach to those entities with criminal intent and especially those that originate overseas. As such, consumers will need to exercise caution. And this may be an area where technology can provide a solution. Email spam filters is a good example. It works well for emails. We should encourage our entrepreneurs to think of similar solutions for phone and SMS apps.

Mr Deputy Speaker, Sir, the higher compliance required of businesses on data protection also leads to higher business costs. Several businesses are new to e-commerce. Many invested a large sum of money to pivot their businesses. For them, there is still a steep learning curve to scale. They have to now deal with this new enhanced responsibility. Undoubtedly this would be an added burden on their operations and finances. They may then pass on the additional costs to the consumers. Can the Minister share how can Government help them to meet the new requirements without imposing too much on these businesses’ finances?

As regulations for companies to gain access and share data for innovation is relaxed, good data collection and protection practices will be increasingly pertinent. Big Data has been mostly lauded for its contribution to innovative product development and improved user experiences. But there are growing privacy concerns. Facebook’s Cambridge Analytica data scandal was a wake-up call.

As such, the Government must invest in creating a strong eco-system that protects our data. The efforts must be transparently communicated to consumers to retain their faith in the system. We must be more discerning of the types of information that can be collected and shared, with or without consent. For instance, it is a common marketing practice to entice consumers to sign up for a promotion or a freebie. They provide highly personal information in return. And consumers are required to mark a little box at the end of the form, giving consent to use the data for marketing purposes. It is well and easy to say, if you don’t feel comfortable handing over your information, you don’t have to. No one is forcing you to sign up. But these marketing techniques leverage a common human weakness. And this is the inclination to act on a good deal. And at that moment, sharing one’s personal information may seem of little consequence until a data breach happens. Many Members today have highighted the data breaches at Lazada and Eatigo, affecting millions of accounts. It is therefore critical, as part of measures to enhance data protection, that we do more to prevent the indiscriminate collection of highly personal data.

That said, Mr Deputy Speaker, Sir, I support the use of consumer data to spur innovation. The development of more exciting, relevant products and services will open up new business opportunities and new markets. This also translates into jobs for Singaporeans.

Mr Deputy Speaker, Sir, to quote Bill Gates, “Power comes not from knowledge kept, but from knowledge shared”. In conclusion, I believe an enhanced eco-system of data sharing for spurring innovation will give rise to some powerful and exciting developments that are unique to Singapore. I support the Bill.

Mr Sharael Taha.

Mr Deputy Speaker, Sir, the rapid advancements made in technology over the past decade has drastically changed our digital landscape as well as our economy. The pandemic has also highlighted the critical need for digitalisation at the personal, as well as organisational level. We have done well to keep abreast with this development.

However, if Singapore wants to keep its leading position in the international digital economy, we must recognise the key role that data privacy plays in the digital economy.

Currently, knowingly or unknowingly, personal data is already being shared and traded. When consumers share personal data, there must be robust safeguards to protect their privacy so that we can increase trust and level of participation by one and all in the digital economy.

We must at the same time be mindful that as an innovation hub, businesses and organisations must be able to harness data confidently in their search for creative solutions and ways to improve consumers’ experiences, products and services.

In order to enhance the protection of consumer data, we must support increased accountability by organisations and businesses. There was no legal requirement or compulsion to inform the consumer of information breaches. To use the recent Lazada data breach of 1.1 million users and the Eatigo data breach of 2.8 million users as an example, we have a sense of how massive and widespread such breaches can be. Lazada has been forthcoming in this instance and had actively monitored their data security systems, while Eatigo was able to detect the breach after it’s users’ data was put on sale online.

This should convince us that we cannot leave consumer data security to chance, hoping that businesses and organisations will act in an ethical manner whenever information breaches happen. With the amendments, when there is a breach of significant scale or may cause harm to the individual, there is a framework for these businesses and organisations to assess if both the Commission and the individuals concerned must be informed. This strengthens the confidence of consumers in the organisation’s ability to protect their privacy.

Consequently, affected parties can take simple measures like changing their passwords to afford immediate protection to their data. However, we all agree that any data breach is unacceptable and as such, stiff financial penalties is needed to deter poor handling of data security.

Data portability would benefit both consumers and businesses. Ease and security of data portability provides consumer autonomy over their personal data, and plausibly, increase the consumer participation rate in the digital economy. At the same time, it can provide access to data for businesses to better serve their customers’ needs or to provide innovative solutions for their clients.

However, how do we prevent companies from exploiting this ease of portability to manipulate customers and shape their behaviour? How can we protect consumers from exploitative and manipulative marketing techniques once businesses get a hold of consumer data? Do less tech-savvy customers, such as our senior citizens and other vulnerable groups understand the implications when they consent to port their data over? At which point does using portable data for highly personalised service becomes exploitation for profit-making purposes, especially if it is used to exploit an individual's pre-existing condition such as compulsive buying disorder? What if a customer just wants part of his data to be ported? These are important questions we need to answer to assure the public that their privacy is protected.

To illustrate these concerns, take for example a vulnerable consumer giving consent or is perceived to have provided deemed consent to an e-commerce site to port his data. The e-commerce vendor proceeds to use it and may even proliferate the data indiscriminately, and he falls prey to questionable marketing techniques. How do we protect the vulnerable who are less digitally savvy?

I think we can all agree that spam marketing messages in the form of voice calls, text and fax messages are a nuisance and not to mention highly intrusive. Thus, I am supportive of such Do Not Call provisions or DNC under the PDPA. The DNC already prohibits businesses and organisations from sending Instant Messages or IMs, SMS and so on, to Singapore-based telephone numbers which have been registered with the DNC registry.

However, considering that the digital economy is global in nature and is not bounded by the jurisdiction of nation-state borders, how do we enforce these DNC provisions to overseas companies? Are there even ways to minimise the ability of overseas businesses from spamming our consumers? Conversely, how do we ensure that Singapore registered businesses and organisations handle their data ethically when they port them over to overseas vendors and partners? What safeguards do we have to ensure that the data is not proliferated and subsequently manipulated for commercial gains from overseas?

Increasingly, there is the necessity in providing disclosure of personal and even organisational data by a business to its partners or contractors in order to assess and review contractual performance. This may result in multiple layers of outsourcing. Businesses and organisations can then use this disclosed data for their own purposes. However, when businesses and organisations require such data, there should be pre-arranged stipulations such that there is either a time-bound or scope-bound condition in order for the disclosed data to not be traded or sold to other organisations. This would go towards making data disclosure more secure and again, increase participation in the digital economy. It also avoids the situation where disclosed data is knowingly or unknowingly used by other organisations for their own purposes other than that which was agreed upon by the initial contractual obligation.

In addition, if a Singapore-based company then discloses data to its overseas vendors, how do we then ensure that the overseas vendor do not use the data beyond the scope of the original intent, especially when we are then unable to hold them accountable?

In conclusion, with the amendments, we are arguably in a much better off position than we were previously. There is a measure of increased protection for the consumers, as well as more punitive consequences for businesses and organisations who have not taken adequate safety precautions when using data that is made available to them.

To enhance the amendments to the Bill further, I propose considering the following.

One, more must be done to educate the vulnerable so they are aware of what they are consenting to. This would help ensure that all are protected and not unfairly taken advantage of.

Two, guidelines are also to be drawn up to help ensure the ethical use of data. These guidelines should be based on ethical considerations and not on commercial or profit interests of businesses and organisations.

Three, digital literacy programmes for youths should include the awareness of personal data protection, as well as ethical considerations. Our youths are entering a world where the digital landscape is ever evolving. We will have to depend on them to define how data is being used ethically.

Four, potentially, an accreditation system can be used, to give consumers some assurance that their data is secure when dealing with companies that meet, or even surpass, standards, and also to forewarn them to exercise caution when dealing with companies that do not meet these stipulated standards.

And finally, fifth in the absence of the possibility for enforcement, we need to explore ways to protect consumer data from being used or proliferated by foreign companies and businesses.

Mr Deputy Speaker, Sir, may I continue my speech in Malay, please.

(In Malay): [Please refer to Vernacular Speech.] With this amendment, we are protecting consumer data security in addition to ensuring that businesses and organisations act more responsibly when using data. This amendment will hopefully increase consumer trust and level of participation in the ever-evolving digital economy. There are measures to increase protection for the consumers as well as more punitive consequences for businesses and organisations who have not taken adequate safety precautions when using the data that is made available to them. However, I would like to suggest the following.

First, we must enhance awareness and educate those who are less digitally capable within our community so that they can be aware of what they are consenting to. This will help ensure that they are protected against those who try to take advantage of them.

Second, guidelines must also be drawn up to help ensure ethical use of data by businesses and organisations.

Third, we also need to educate our youths with literacy programmes that include awareness of personal data protection as well as ethical considerations in a digital economy. Our youths are entering a world where the digital landscape is constantly evolving. They must be strengthened with positive values. We have to depend on them to define how data is used ethically in the future.

Finally, we must also have an accreditation system to give assurance to consumers that their data is safe when they transact with companies that meet the standards, as well as forewarn them to exercise caution when dealing with companies that do not meet the stipulated standards.

Given that Singapore is at the forefront of data privacy laws, especially in this region, we need to have a level playing field between Singapore companies and foreign companies. We should not stifle innovation too much but we must do our best to protect consumers from manipulative and exploitative practices. We must give consumers the choice and control over their personal data and how it is used.

As consumers and business owners, we must bear the responsibility and further strengthen our understanding of data usage and data privacy, and we must continue to use data to drive innovation in order to transform our economy.

(In English): In summary, Mr Deputy Speaker, Sir, given that Singapore is at the forefront on data privacy laws especially in our immediate region, we need a level playing field between Singapore companies and foreign companies. We cannot be overly restrictive but we must still do our utmost to protect our consumers from intrusive, manipulative and exploitative practices. We need to give consumers the choice and control over their personal data and how it is used. With that, Mr Deputy Speaker, Sir, clarifications notwithstanding, I stand in support of the Bill.

Mr Deputy Speaker, Sir, I stand in support of the Bill, which seeks to strengthen the accountability of organisations when handling and protecting personal data and to provide individuals with greater autonomy over their personal data.

Mr Deputy Speaker, despite the introduction of the PDPA in 2012 some eight years ago, we continue to see worrying lapses and breaches of personal data by commercial entities. Recent examples include: (a) a data breach by Grab, where the details of over 21,000 GrabHitch drivers and passengers were leaked due to an update of the mobile app; (b) a marketing email sent out by electronics retailer, Courts unwittingly exposed the personal data of over 76,000 customers, and (c) even the Central Depository, whose staff had mailed dividend cheques to outdated addresses, putting at risk the personal data of over 200 account holders.

Given the potential severity of these continued breaches, I am supportive of the Bill's proposed increase in financial penalties, from the current cap of $1 million to 10% of the organisation's gross annual turnover. Creating a strict data protection regime and strengthening our enforcement will also be vital in boosting Singapore's position as the region's premier data hub.

However, going back to the data breach by Grab that I mentioned earlier, I note that this was Grab's fourth instance in two years, where the company was in breach of the PDPA, and in this latest case, the company was given a fine of $10,000. Some would see this as a small amount for such a large company. I would like to ask what was the largest penalty that the PDPC had imposed on an organisation for a data breach under the current regime. I would also like to know if the PDPC intends to punish repeat offenders more severely, as repeated offences simply go to show that the organisation has not implemented the necessary safeguards to properly protect personal data, despite previous reported lapses.

Mr Deputy Speaker, I am also supportive of the Bill's proposal to further tighten the rules around telemarketing and unsolicited spam calls and text messages. Many residents have told me that they continue to receive spam calls and text messages related to online gambling and unlicensed moneylending, despite having registered their phone numbers in the Do-Not-Call or DNC registry. This makes them question what was the point of registering their numbers in the DNC registry in the first place. I therefore support the proposed enhancements to the Spam Control Act 2007 and the DNC provisions, which will serve to provide consumers with more protection from unwanted communications across various platforms.

Despite the enhancements, we need to recognise that many spam text messages and calls originate from scammers or unlicensed moneylenders based overseas. I hope that the Ministry could work with our telcos to explore the use of technology to prevent such unsolicited messages, which often contain malware links, as well as spam robo-calls.

In the United States, their mobile and broadband providers have worked with the government to create a new protocol called STIR/SHAKEN, which provides a secure mechanism for service providers to cryptographically sign and verify the Caller ID for calls made over the Internet. This has seemingly helped to combat Caller ID spoofing. Could the Ministry explore implementing similar technology here?

Mr Deputy Speaker, as we debate about the importance of securing the personal data by organisations, the reality is that individuals too have a part to play in ensuring that their personal data is safeguarded. Consumers need to be personal-data-literate and understand what they are consenting to when they tick off the checkboxes under a company's User Agreement. Often, many consumers do not fully read the terms and conditions, as they are written in small font sizes and clauses are often hidden behind many technical jargons. Hence, many simply just check the accept button, not knowing that they would then unwittingly give up their personal data, sometimes in perpetuity, to these commercial entities. We therefore need to educate consumers about personal data literacy, even as the PDPC works to ensure that businesses safeguard data responsibly.

I would also like to urge the PDPC to publish guidelines on how companies should highlight their key User Agreement terms and conditions in a simple and upfront manner, preferably in large font size, and make clear to consumers about the categories of personal data that these companies will collect and how they intend to use them.

Finally, Mr Deputy Speaker, while I am generally supportive of the Bill's proposed amendments, I am, however, concerned about the timing of Bill and its impact to businesses. The proposed amendments to the PDPA are significant and it is likely that many organisations will incur additional costs in adapting to these new regulations. For example, companies will have to undertake an extensive review of their data protection procedures to ensure that they meet the Bill's expanded scope of "deemed consent", as well as ensure that their current systems are able to comply with the new data portability obligation.

Many businesses are already reeling from the impact of COVID-19 and they are worried about the cost of adhering to the revised regime. To alleviate these concerns, will the Ministry consider providing some form of assistance to these organisations, especially our SMEs or consider perhaps a grace period for the new regulations, so that companies have a longer runway to plan for their organisation's compliance to the latest PDPA rules?

Mr Deputy Speaker, the proposed amendments to the PDPA are timely as we seek to transform our economy for the post-COVID-19 future. However, I do think that we need to mete out more deterrent penalties to organisations that continually fail to safeguard the personal data of consumers, as having a stringent data protection policy is important to further strengthen Singapore's position as the region's leading data hub. We also need to focus on educating Singaporeans about personal data literacy, as more organisations seek to collect and monetise our personal data. With that, I support the Bill.

Mr Deputy Speaker, Sir, I stand in support of the Bill. Personal data protection is essential for today's increasingly data-driven economy to function effectively. Without adequate safeguards regulating the usage and protection of data, consumers' confidence can be eroded, making it difficult for legitimate companies and entities to operate optimally. Like what the hon Mr Sharael Taha had said, Lazada's recent data breach affecting 1.1 million users or approximately one-fifth the population of Singapore is a timely reminder.

The amendments bring Singapore's data protection regime a step closer to the European Union's General Data Protection Regulation or GDPR. The latter has been internationally regarded as the gold standard for the protection of consumer data.

Notwithstanding the expanded responsibility of organisations under the amendments, I am glad to know that many of the businesses consulted welcome the amendments. This demonstrates their cognisance of the value of a robust data privacy regime, especially with the rise of malicious cyber-actors.

I believe that the amendments have tried to carefully balance the interests of both consumers and businesses. Individuals will have greater control over their data with, for example, the new data portability obligation and the tighter rules on telemarketing with the enhanced DNC provisions. Furthermore, the strengthened penalty regime under the amendments will drive an appropriate investment by companies into data protection and compliance efforts. At the same time, sufficient flexibility is provided through the exceptions to consent provisions to meet commercial needs.

Mr Deputy Speaker, Sir, I seek a few clarifications and will make a few suggestions on the amendments for the Ministry's consideration.

Firstly, I seek clarification on the legitimate interest exception to consent. Per Part 3, section 1(2)(a), the legitimate interest is viewed from an organisation's perspective. This inadvertently encompasses a subjective determination on the part of the organisation in assessing whether their legitimate interests outweigh potential adverse effects on an individual. While section 2 to 10 provides some circumstances whereby the collection, use or disclosure of personal data is necessary, these circumstances may be limited in scope, except for section 2 where the meaning of "evaluative purposes" is seemingly ambiguous. As such, I seek the Ministry's direction to provide guidance on what constitutes "evaluative purposes".

Furthermore, to minimise disputes, perhaps the Ministry may consider looking into prescribing broader, objective guidelines on what constitutes legitimate interests to firstly, ensure greater ease of compliance for organisations who seek to rely on this exception and secondly, enhance consumers' understanding of their rights. Lastly, considering that the collection, usage and disclosure of personal data are central to the business models of data collection and survey companies, I would like to clarify with the Ministry if the availability of this exception should similarly apply to such companies.

My second clarification relates to the new Data Portability Obligation. This is a important advancement in Singapore's data privacy regime, allowing individuals to regain more control over their data. However, my concern with this obligation lies within its potential impact on businesses costs and operations. Some businesses consulted have cited significant compliance costs, efforts and manpower requirements in meeting these new regulations. This includes tailoring current processes for larger businesses and the construction of new technological structures for smaller businesses. With the global economy experiencing a hard hit from the COVID-19 pandemic, many SMEs are already struggling to stay afloat. In light of this, I have three suggestions to make.

Firstly, could the Ministry consider a transitionary period in relation to the data portability obligation especially for the SMEs? This would help businesses to tide through the COVID-19 crisis and provide an appropriate duration of time to comply with this new obligation.

Secondly, I am concerned about the hardship SMEs and smaller businesses may face in adhering to this obligation. Could the Government support SMEs in setting up basic technological structures to do so? Perhaps the Government can work with unions and trade associations or TACs, for these support platforms to help smaller businesses comply with the new obligations imposed. The unions and TACs can also update businesses, train them, especially SMEs, on the revised amendments. NTUC’s Learning Hub currently conducts data-protection related courses and the scope of courses can be expanded to complement the amendments made to the Act.

In addition, section 26H affords consumers the avenue to apply to the Commission to review a porting organisation’s failure to transmit the applicable data within a reasonable period of time. Instead of a subjective measure of time, could the Ministry prescribe a stipulated duration of time to fulfil the porting request, with the subjectively determined "reasonable time" only applying in situations where businesses require more than the stipulated time to do so? This would better help businesses and consumers manage their duties and expectations respectively, reducing unmeritorious complaints to the Commission.

My third point of clarification relates to the increased financial penalties under the amendments. The maximum financial penalty that can be meted out is a fine amounting to 10% of the defaulting organisation’s annual turnover in Singapore. For comparison, the contravention of Personal Data Laws in Hong Kong attracts a maximum financial penalty of HKD$1 million; in Malaysiam it is RM$300,000 and in the Philippines, it is PHP$5 million.

The worry, which has been similarly reflected during the public consultation, is that the maximum fine that can be imposed might be too large compared to worldwide standards, especially in Asia. Could this disadvantage Singapore as an offshore destination, where MNCs might choose other Asian countries over ours to set up operations? While the penalty imposed on a contravening organisation will vary naturally according to the facts, this might artificially create the impression that the financial penalties under Singapore’s data privacy regime are much harsher compared to those of its neighbours. In light of this, can the Ministry reconsider the maximum financial penalty that it is imposing on defaulting organisations to better align with the standards in neighbouring Asian jurisdictions or competing economies?

Lastly, I propose an explicit recognition of the right for individuals to the erasure of their personal data, for the consideration of the Ministry. The right to erasure is recognised in other jurisdictions, such as the EU’s GDPR. Article 17 of the GDPR affords individuals the right to obtain from data controllers the erasure of personal data and the obligation on controllers to erase the concerned data without undue delay under certain circumstances. For example, where the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed.

Similarly, under section 25 of the PDPA, the retention limit obligation is imposed on organisations. Under this, organisations shall cease to retain personal data where the purpose for which that data was collected for is no longer served by the retention of personal data and where the retention is no longer necessary for legal or business right.

This obligation seems to complement an individual’s right to withdraw consent in section 16. However, while consumers can withdraw consent of the use, collection and disclosure of their data, with organisations thereafter obligated to cease to do so, this does not squarely extend to the right of consumers to direct organisations to erase their data. In furtherance of the amendments’ overall objectives, the imposition of this provision assigning an individual the explicit right of erasure is arguably another step ahead to afford greater autonomy to individuals over their personal data. The viability of such a provision is, of course, subject to the further perusal of the Ministry, especially with regard to under what circumstances may such a right be circumscribed or exercised.

Mr Deputy Speaker, Sir, notwithstanding my clarifications and suggestions, I reiterate my support for the Bill. I am confident that by passing the Bill, the House would be taking a big step ahead in priming Singapore in our shift to a data-driven economy.

Senior Minister of State Janil Puthucheary.

Mr Deputy Speaker, Sir, Mr Gerald Giam has brought up several matters associated with the public sector governance of data and data privacy, data security. I thought I might deal with some of them although they are not directly connected with the Personal Data Protection (Amendment) Bill which we are debating today.

There are some matters of confusion, conflation and, perhaps, a misunderstanding, and I hope I can bring some clarity and understanding to the debate.

The first point I would like to clarify is Mr Giam's assertion that somehow the Government believes that the standards for Government need to be lower than for the private sector. We completely disagree. We believe the standards for the Government should be as high, if not, higher than for the private sector. That is why, several years ago, when there was a Government data security policy in IM8 and there was not something for the private sector, we enacted the PDPA to improve standards for the private sector.

Mr Giam also suggests that, perhaps, we should treat Government and treat businesses the same way, that the same tools and the same behaviours would either be useful or expected in the private realm and the public sector. This is not so. We expect Government to behave as one service, servicing residents, servicing our citizens, servicing our country as one entity. We expect the private sector to behave as individual entities and there needs to be an appropriate separation and gap in data sharing between private entities.

We have, in Mr Giam's assertions, another confusion. He talked at the beginning of a high compliance burden for public sector officers and then asked later on whether the standards are high enough. The high compliance burden is precisely because the standards are high and, perhaps, more burdensome than for the private sector. Nevertheless, there is internal coherence despite the many different Acts and rules and laws that he cited, which are correct.

Internally, within the Government, the data security and data privacy space is looked after by the Government Data Office, a single point of contact. There is internal coherence, so that we can operate as one Government. Externally, for members of the public that are concerned about their data security, they also have one point of contact – the Government Data Security Contact Centre or GDSCC. That was established and launched publicly on 30 April this year. Members of the public can contact that single point of contact if they are concerned. But if they contact any other arm or organisation within Government, we have our Government working as one through a No Wrong Door policy. And that is enabled precisely because there is sharing of data across Government.

Nevertheless, whoever they contact, they will be referred to the Government Data Office and GovTech to handle the matter.

On the issue of our Government data policy lacking transparency – Mr Giam referred to it; it is IM8 – the Government's personal data policies were published on 30 April this year. It is available on the Smart Nation website and it is there for scrutiny and for examination. And we can debate and discuss this further if he wishes.

Another point of conflation and confusion that I would like to clarify, the monetary fines that are in the PDPA are fines; they are not redress to the individual. They are fines imposed by the regulator on the private sector entity. There is no specific provision for compensation to the individual as a result. The individual would need to pursue legal action if they were looking for compensation.

Mr Giam suggested that there needed to be some corollary of compensation within the public sector for these fines that the PDPA imposes, should there be a data breach. I just want to be clear that the fines are fines from the regulator and if in the private domain, an individual wishes to pursue compensation, they would have to take legal action in order to do so.

For the Government, there is no special provision or exception or protection for the conduct of the Government or Government officers with respect to data; there is no special carve-out there.

So, let me be clear. The PDPA and the PSGA – the IM8 provisions that Mr Giam referred to – are aligned in terms of standards, the expected behaviour of the officers and entities. And they are aligned where there is a single point for people to complain: the PDPC versus the GDSCC. There is an option for individuals to pursue mediation and an option for individuals to pursue action for compensation.

One of the key other points of confusion I want to address is this idea that the PDPA is equivalent to the PSGA or the Public Sector (Governance) Act, when taken together with a whole series of other laws such as the Official Secrets Act, the Income Tax Act, the Statistics Act. This is not so.

The controls are equivalent between the PDPA and the PSGA. These other laws are then on top of the PSGA, governing and controlling behaviour within specific domains. They also apply to the private sector; for example, the Income Tax Act will apply to certain private sector entities as well. So, the equivalence is between the PSGA and the PDPA.

The key issue is then how do we want Government to behave and how do we want our private sector entities to behave. What we want within Government is for sharing of data to achieve that No Wrong Door, One Government responsiveness to citizens, for policy, for execution and implementation as well as for communications. For that, we need to encourage sharing of data. And because Government has roles that do not exist in the private sector, there are additional controls, because of the additional sensitive data that Government has access to. And hence we take this very, very seriously. How seriously do we take it? We prosecute and I give you three examples.

In April this year, we had a civil servant arrested as a result of leaking COVID-19 case numbers, for accessing a Government COVID-19 database without authorisation to retrieve confidential records and giving that information to a friend. This person was arrested as a result.

Another example also in April. A public servant and her husband arrested for wrongful communication of information, which was about the implementation of home-based learning by schools.

And in December 2017, an HDB officer was fined $2,000 for giving confidential information on HDB resale transaction time and changes to the valuation process to a Straits Times journalist.

We take this very, very seriously and the public sector officers who handle our data, on behalf of our citizens, know that we take this very, very seriously.

The separation of the public and private sector data protection regimes in Singapore remains relevant. It remains necessary for us to keep achieving the outcomes that we want to achieve in terms of good policy, responsiveness to citizens, operating as One Government. It has to be used in a way that drives trust and helps us be effective in maintaining that trust with our citizens.

Nevertheless, we always review these provisions. As we are reviewing the PDPA today, we will regularly review the PSGA as well as other legislation to ensure that they remain relevant and effective in safeguarding personal data for both the public and private sectors.

Mr Gerald Giam, you have a clarification?

Thank you, Mr Deputy Speaker. I just want to clarify with the Senior Minister of State that I did not say that the standards for Government should not be higher. In fact, I agree with the Senior Minister of State that the Government standards should be the same or higher than what it expects of the private sector.

In fact, I support the No Wrong Door policy. With regard to data sharing between agencies, I think that is a good thing and it is important for the convenience for our residents. But this provision can also be made within the PDPA, so that Government agencies are allowed to share data between each other. So, why can the myriad of legislation not be brought under the PDPA, so that Singaporeans, public sector officers, will be able to know that there is this harmonised set of data privacy standards that they should all comply with and that they are held to the same standard?

Now, let me first clarify again that I am not saying that currently the Government is operating at a lower standard. Like I said in my speech, in my experience as a civil servant and my experience working as a government vendor in the past, the standards are very high. So, why can these all not be harmonised under one law, just like how they do it in the GDPR for Europe?

Yes, Senior Minister of State Dr Janil, would you like to respond?

Mr Deputy Speaker, I am glad that Mr Giam agrees largely with us. The issue then is what outcome would he achieve or would we achieve merely by putting it all under one legislation?

I doubt very much there is any confusion among the civil servants about the standards that are expected of them simply because we have two legislative frameworks. The issue is whether or not the outcomes in terms of the number of data breaches, the security that we have in our systems and the trust that our citizens have in our processes would be assisted by his approach, provided he continues to agree that we are effective at maintaining very high standards within the Government. The outcomes demonstrate that we are not doing too badly in our public sector.

The PDPC reports hacks and data breaches. I do not have all the numbers but I was looking at their website. For example, in 2018, in the private sector in Singapore, there were about 13 incidents of exfiltration of data through hacking and in 2019, it was 16 incidents. This is in the private sector. In comparison, in the public sector, we had three in 2018 and zero in 2019.

While hacking is not the only type of breach, we can also have, for example, an accidental loss, that is, inadvertent data breaches. On PDPC's website, in 2018, there were 2,700 instances in the private sector and 4,500 in 2019. I do not have the exact number, but I know it is at least one if not two orders of magnitude lower for the public sector. We do review them and we can happily get those numbers to Mr Gerald Giam and Members of this House. But it demonstrates that our system is not ineffective. People know that we have a robust protection regime as he has repeatedly said, that is, our citizens trust us to do the right thing and we must uphold those standards and have these high expectations of our public sector officers.

We are not alone in this world. There are other jurisdictions in countries, cities and states where they have different legislative frameworks for Government versus the private sector. It is not inherently a weakness. The issue is how you design both of those and whether you make it work for these outcomes. And let me say, categorically, the two are aligned to the same expectations and standards and we will refine them as needed to make sure that that is the case.

However, we believe that we need these two approaches because Government is not a private company nor should it behave as such and you cannot expect a private company to behave like Government. Mr Gerald Giam goes on about the burdens that he felt as a civil servant. If the private SMEs had to comply with all the regulations that he had to struggle with as a civil servant, they would not be able to do business in quite the same way and perhaps innovation and the ease of customer relations, the ease of coming up with new products would be impeded.

So, there is a difference in behaviour at the entity level and there is a difference of behaviour at an individual level. And so, we have to have the right tools to influence behaviour correctly on behalf of our citizens. That does not mean that we reduce our standards in any way and we have not done so.

Minister S Iswaran.

Thank you, Mr Deputy Speaker.

Let me start by thanking all 13 Members who have spoken and for their support for this Bill. To be precise, actually, 11 Members have given explicit support and Mr Leon Perera and Mr Louis Chua, I am assuming, I have their deemed consent since I do not think that there is adverse effect on any individual. I also want to thank them for raising important issues this Bill seeks to address. And I think the comments of Members fall broadly into a few areas about: protecting consumers' personal data, endowing consumers with more control and a greater sense of autonomy and confidence while supporting organisations' legitimate use; and supporting businesses in the use of data for growth and innovation.

I think in the comments that have been made by Members, it is clear that we all appreciate and recognise that there is an inherent tension between these objectives, and the proposed amendments seek to strike a judicious balance between them.

In thinking about these issues and I do propose to address the specific questions raised by Members, it is important that we first recognise that this is a delicate and dynamic balance. It is delicate because if we over-correct in one direction, consumers may not retain their confidence and trust in the system. If we swing the other way, then we shackle our businesses and the very benefits that we seek for our consumers and for our economy will diminish. It is dynamic because technology is changing and the ways data is being generated and being put to use are also changing. And therefore, it is imperative that we find our own balance in the way we regulate the collection and use of data in Singapore.

And there are different jurisdictions with different models. GDPR has been cited by several Members. There is also the APEC CBPR. I do not think any one of these is universally acclaimed because each has its strengths and its weaknesses. And that is why, in this endeavour of moving this legislative amendment, we have sought to understand the different regimes and to ensure that Singapore is able to remain best-in-class and also ensure that we are nimble and remain interoperable, which is key to our positioning as a node in the international flow of data and digital transactions.

And that leads me to the second overall point I want to make, which is we must recognise that whilst legislation and regulation is important, it is not a panacea and neither is it foolproof. And therefore, what it means is whilst we can put in place rules that will govern the data practices and ensure that data is safeguarded to the best of our ability, we cannot eliminate the risk of data breaches.

So, it is important that we recognise that whilst the rules must be formulated and enforced, it must be complemented by good practices and that has to evolve over time so that we understand, as an overall economic system and as a society, our respective responsibilities and roles.

And that brings me to my third overarching point, which is that it is essential that we recognise all of us have a role to play and a responsibility to discharge in maintaining the security and the usability of our data regime and, in a sense, safeguarding the public commons.

So, Government formulates the rules and regulations, enforces, provides guidelines and adapts to changing market situations to ensure that we remain abreast, to the best of our ability, of the developments and ensure that we keep Singapore relevant in the context of a new digital economy.

Businesses must recognise that this is in their self-interest. It is not just about complying with rules or regulations. At the end of the day, in any competitive domain, businesses will be able to differentiate themselves by their data policy and they will be able to signal the quality of the institution by the kind of approaches they take to safeguard their customers' data. So, they must be accountable and responsible, recognising ultimately that it is in their self-interest.

And finally, individuals. I think all of us have the responsibility. Whilst some Members have talked about the so-called power asymmetry, ultimately, I would argue that consumers – individuals like you and me – we are not powerless by any stretch of the imagination. We can choose to decide whom to do business with or whom to give our custom. We can choose to decide what data we want to share. We can choose to decide whether we want to give consent and when we want to withdraw that consent. And, ultimately, we can decide when to sever the relationship if that is what we want.

So, I think we should not lose sight of that aspect as well. Ultimately, the legislation must be seen in that perspective. It is one part of an overall architecture that will ensure a vibrant digital economy, but also one where data is respected, it is safeguarded, but also used for appropriate purposes.

Let me now turn to some of the specific questions that have been raised by Members.

First, on protecting consumers and the data. I think it is important to emphasise PDPA recognises organisations' need to use personal data for legitimate purposes. And today, that is accommodated through exceptions to the consent requirement, or as deemed consent. For all other purposes, organisations have to obtain consent from the individual.

Current exceptions to consent cater for scenarios such as investigations and responding to emergencies. We are updating this list by adding business improvement and legitimate interests and updating the research exception for the benefit of consumers and organisations in the digital economy.

The Bill is also clarifying the deemed consent provision to cover multiple layers of subcontracting when needed to fulfil a contract and to facilitate organisations notifying customers and giving a reasonable period to opt out, before they use data for new purposes. And I would like to reinforce this point and a point that Ms Jessica Tan had also picked up, that ultimately, consumers can opt out at any time and they have the freedom to do so.

I want to assure Mr Desmond Choo that all private sector organisations can rely on these new provisions, regardless of the industry they are in. It is meant to apply uniformly.

And on the whole, the amendments regularise current practices, provide organisations with clarity and confidence to use data, while protecting consumers' interests. As Mr Yip Hon Weng has noted, this will also enhance Singapore's status as an innovation and commercial hub.

Some Members have asked about the safeguards for the new provisions. Stricter process safeguards are prescribed for the general legitimate interests exception and deemed consent by notification, while specific exceptions, such as business improvement and research, are tightly scoped. The safeguards have been designed based on the following principles.

Before relying on the legitimate interests exception, organisations have to conduct a risk assessment and be satisfied that the overall benefit outweighs any residual adverse effect to an individual. And before relying on deemed consent by notification, organisations must conduct a risk assessment to be sure that there is not likely to be any adverse effect on an individual. Individuals may withdraw their consent even after the opt-out period. The PDPC may also require organisations to produce these assessments for its review. Some Members have asked how these provisions might be operationalised. The PDPC has provided guidance on how to conduct risk assessments. It will also issue detailed guidance on the legitimate interests exception and how to identify adverse effect, which generally refers to any physical harm, harassment, serious alarm or distress to an individual.

Exceptions for specific purposes, such as business improvement and research purposes, are tightly scoped. For example, the business improvement exception supports internal use of data within an organisation or a group of companies, with clearly defined limits. And when it comes to sending direct marketing messages, organisations still need to obtain express consent. Mr Sharael Taha enquired about the safeguards for deemed consent by contractual necessity. Essentially, organisations can rely on this provision to share personal data only to the extent necessary to perform their contracts with the individual. So, that is the test.

Mr Desmond Choo asked about the “evaluative purposes". This is actually an existing exception in the PDPA which has now been reclassified under the “legitimate interests exception”.

There has been another set of queries about how we can ensure or have confidence that organisations can be trusted to use personal data in good faith. I think this is an important point. I would start by saying firstly, we must recognise, more importantly, organisations must recognise that it is in their self-interest to safeguard personal data as that would foster consumer trust, strengthen their business reputation, and ultimately, their competitiveness and bottom line.

To support that and to ensure organisations take their obligations to protect data seriously, we are introducing both incentives and penalties – carrots and sticks, if you will. The PDPC will issue new advisory guidelines with examples and illustrations, so that organisations have ample notice of the expected standard of conduct.

As data breaches cannot always be prevented, the PDPC’s enforcement framework reinforces the importance of dealing expeditiously with data breaches to reduce harm, through measures like breach reporting and statutory undertakings.

Last year, PDPC investigated 185 cases, issued 58 decisions and ordered 39 organisations to pay a total of $1.7 million in financial penalties and that includes the highest financial penalty sums the PDPC imposed in 2019, which were $750,000 and $250,000 on IHiS and SingHealth respctively.