Safeguarding User Privacy and Data against Illegal Tracking by Tech Companies

Mr Shawn Huang Wei Zhong asked the Minister for Communications and Information with rising concerns of tech companies illegally tracking location data for search and advertisement purposes, what are the measures in place to safeguard the privacy and data of users in Singapore.

Location data can form part of the personal data that organisations collect, if such location data can be used by companies to identify individuals. Location data may be used legitimately, including for search and advertisement purposes, such as when it is anonymised before use, or the organisation has obtained consent. Illegal tracking occurs when organisations fail to obtain consent when required, or obtain consent through misleading or deceptive practices. In such cases, organisations, including tech companies, may be in breach of the Personal Data Protection Act (PDPA).

When organisations collect location data as part of their customers’ personal data, they are required under PDPA to manage the data responsibly and securely protect them. PDPC has outlined specific security measures on location data in the Guide to Data Protection Practices for ICT Systems, which organisations are expected to adhere to. For instance, the Guide suggests that organisations could collect approximate location data of users, rather than their exact location. It also suggests that apps provide users with the option to authorise the collection of their location data only when required, rather than on a continuous basis. PDPC has previously taken companies to task for failure to protect location data.

While PDPA designs safeguards to protect consumers’ personal data, consumers are, ultimately, the first line of defence to protect their own location data. Location data can be collected by any mobile app developer that has been granted permission to read the GPS sensor on a consumer’s mobile phone. Thus, consumers should exercise caution with regard to the types of apps they download and the app permissions they consent to.