Key takeaways

• Even if a data intermediary or vendor is engaged to implement necessary data protection measures, the data controller bears the responsibility of exercising reasonable oversight of the vendor. A data controller may be found in breach of the Personal Data Protection Act 2012 (PDPA) even if its data intermediary or vendor is not.
• With the immense value of health data, companies in the healthcare and life sciences space should conduct periodic security reviews of their IT systems.

In more detail

In October 2021, a healthcare services provider became aware that its customer data was being offered for sale on a dark web forum. The cybersecurity consultants it engaged thereafter made contact with the purported seller of the data, who claimed that he had exfiltrated the healthcare services provider's online drive.

As a result of the data breach, the personal data of more than 150,000 patients and employees of the healthcare services provider's corporate clients were accessed without authorisation. The personal data included identity numbers, financial details such as bank account numbers and codes, as well as health information.

The Personal Data Protection Commission (PDPC) found that the healthcare services provider had exacerbated the situation by inadvertently disclosing unnecessary sensitive personal data, which was only intended for its employees' internal use, onto the online drive shared with the vendor. This included sensitive financial information and health information such as codes for surgical procedures done in hospitals. These datasets were not required by the vendor.

In assessing the penalties that the healthcare services provider and its vendor should be subject to, the PDPC took into account the following mitigating factors:

• The healthcare services provider and its vendor were cooperative during the investigations.
• The healthcare services provider and its vendor voluntarily admitted to their breaches under the PDPA.
• The healthcare services provider and its vendor took prompt remedial actions following discovery of the incident.

The PDPC also took into account that the vendor's breaches of the PDPC were more causally proximate to the unauthorised access and disclosure of personal data in the incident, but the healthcare services provider's inadvertent disclosure of financial and health related data resulted in the impact of the incident being amplified. Further, the healthcare services provider, as data controller, also bore the responsibility of exercising due diligence and reasonable supervision over its vendor.

Against these factors and also considering the difference between both companies' annual turnovers, where the healthcare services provider's annual turnover was almost 50 times higher than that of its vendor, the PDPC imposed a fine of SGD 58,000 on the healthcare services provider and SGD 10,000 on its vendor.

The maximum amount that a company can be fined for being in breach of the PDPA is 10 per cent of its annual turnover in Singapore (for companies whose annual turnover in Singapore exceeds SGD 10 million) or SGD 1 million.

* * * * *

© 2023 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.