Personal Data Protection Act, offence of unauthorised re-identification of anonymised information

Section 48F makes it an offence for an individual to take any action to re-identify, or cause the re-identification of, the person to whom anonymised information in the possession or under the control of an organisation or a public agency relates, where the organisation or agency has not authorised the re-identification and the individual knows that it is unauthorised or is reckless as to whether it is.

On conviction the penalty is a fine not exceeding $5,000, imprisonment for up to 2 years, or both. The offence binds individuals, and Part 9B does not apply to a relevant public official in a Singapore public sector agency, or to a director, officer or employee of the Monetary Authority of Singapore in respect of information acquired in the performance of their duties.

The accused has a defence, to be proved on a balance of probabilities, where the information on the affected person's identity is publicly available, where another law permits or requires the re-identification or a court order authorises or requires it, where the accused reasonably believed it was for a specified purpose and notified the Commission or the organisation as soon as practicable, or where the accused reasonably believed they had the legal right to do it for a purpose other than a specified purpose.

Where a public agency shares anonymised information under a data sharing and use direction, a re-identification that the direction or a further authorisation under it does not authorise is treated as unauthorised.