In more detail
Background facts
HMI is a healthcare training provider in Singapore.
On 2 May 2024, HMI received a complaint regarding a personal data breach incident ("Incident") that involved a Microsoft Excel file ("Excel") containing the personal data of 761 individuals that HMI had inadvertently made public on the internet. The data disclosed included a combination of the individuals' names, addresses, NRIC numbers, dates of birth and other personal information.
HMI notified the PDPC of the Incident upon receiving the complaint.
Decision under the Expedited Decision Procedure
HMI voluntarily and unequivocally admitted to the following facts:
- The affected individuals had provided their data to HMI via the Students' Career Portal ("Portal"), which was part of HMI's website from 2017 to 2019.
- In December 2019, HMI decided to decommission the Portal.
- Apart from checking and confirming that the Portal was no longer accessible at its original URL address, HMI did not follow up with the vendor to ensure that the Portal had been properly decommissioned.
- The Excel continued to reside in the web directory of HMI's website with no access control to prevent indexing by online search engines. This led to the Excel being indexed and made publicly accessible via an online search using relevant keywords.
Following the Incident, HMI promptly took several remedial actions, including removing the Excel in its web directory; liaising with internet search engines to ensure that all web links to the Excel had been removed; implementing an internal checklist for all future commissioning, onboarding and decommissioning of IT solutions; and establishing additional protocols to monitor its website content.
Under the Expedited Decision Procedure, HMI admitted to a breach of section 24 of the PDPA as it did not have adequate policies and processes to exercise reasonable oversight over the vendor tasked with decommissioning the Portal. Section 24 of the PDPA provides that organizations must protect personal data in its possession or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, etc., or similar risks, as well as the loss of any storage medium or device on which personal data is stored.
The PDPC held that HMI's own lack of technical expertise and reliance on the vendor to decommission the Portal is not an adequate defense for its failure to take the necessary steps to comply with section 24 of the PDPA. Further, HMI could have exercised reasonable oversight by verifying with its vendor that the personal data it had collected had been properly deleted following the decommissioning of the Portal. As noted by the PDPC, the exercise of reasonable vendor oversight did not require technical expertise.
Accordingly, the PDPC required HMI to pay a financial penalty of SGD 10,000 and directed HMI to report to the PDPC on the completion of various remedial actions, such as putting in place a well-documented vendor management policy and relevant processes for effective management and supervision of its IT vendors.
In deciding on the above penalty and directions, the PDPC also took into account the fact that this was HMI's second contravention of the PDPA. In 2019, HMI had also breached the protection obligation under section 24 of the PDPA when a file server belonging to HMI was affected by a ransomware attack, leading to the encryption of various files containing personal data of HMI's staff and trainees.
Enforcement of the PDPC: Expedited Decision Procedure
The Expedited Decision Procedure allows the PDPC to conduct and complete investigations in a shorter time period while achieving the same enforcement outcomes.
To invoke the Expedited Decision Procedure process, an organization must request the PCPC in writing in the early stages of investigations. In the request, the organization must provide the following:
- An upfront voluntary admission of liability
- Relevant facts of the incident
- Written confirmation of willingness to comply with any direction or penalty notice issued by the PDPC.
The PDPC will review the information provided to decide whether to accept the organization's request. If the PDPC so accepts, a legally binding written agreement between the PDPC and the organization will be executed.
The PDPC has the discretion to discontinue with the Expedited Decision Procedure and proceed with a full investigation instead at any time before the conclusion of a case.
For more detailed information on this decision, please visit the official website of the PDPC: https://www.pdpc.gov.sg/all-commissions-decisions/2024/11/breach-of-the-protection-obligation-by-hmi-institute-of-health-science
* * * * *
For further information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.
* * * * *
© 2024 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
