8. Unauthorised re-identification of anonymised information

Feedback & support

Amended

Last amended by an amending law of 2020.

(1)

If —

(a)

an individual takes any action to re-identify or cause re‑identification of the person to whom anonymised information under the control of a Singapore public sector agency relates;

(b)

the re-identification is not authorised by any data sharing direction given to the Singapore public sector agency;

(c)

the individual is a relevant public official of the Singapore public sector agency at the time of taking that action; and

(d)

the individual does so —

(i)

knowing that the re‑identification is not authorised by that data sharing direction; or

(ii)

reckless as to whether the re‑identification is or is not authorised by that data sharing direction,the individual shall be guilty of an offence and shall be liable on conviction to a fine not exceeding $5,000 or to imprisonment for a term not exceeding 2 years or to both.

(2)

In proceedings for an offence under subsection (1), it is a defence to the charge for the accused to prove, on a balance of probabilities, that —

(a)

the information on the identity is publicly available;

(b)

the action to re-identify or cause re-identification is —

(i)

permitted or required by or under an Act or other law (apart from this Act);

(ii)

authorised or required by an order of court; or

(iii)

in any other circumstances, or for any other purpose, prescribed; or

(c)

the accused —

(i)

reasonably believed that the re‑identification was for a specified purpose; and

(ii)

notified either of the following agencies of the re‑identification as soon as was practicable:

(A)

the Singapore public sector agency;

(B)

the Government Technology Agency.

(3)

To avoid doubt, subsection (2) does not affect any obligation or limitation imposed on, or prohibition of, the re‑identification of anonymised information under the control of a Singapore public sector agency by or under any other written law or other law.

(4)

In this section —

“anonymised information” means any information which is in anonymised or de‑identified form;

“Government Technology Agency” means the Government Technology Agency established by section 3 of the Government Technology Agency Act 2016;

“personal data” has the meaning given by section 2(1) of the Personal Data Protection Act 2012;

“relevant public official” has the meaning given by section 7(7);

“specified purpose” means any purpose specified in the Eleventh Schedule to the Personal Data Protection Act 2012.