Regulation to Ensure Deletion of Personal Data Collected by oBike

Debated in Parliament on 10 Jul 2018.

Summary written by AI (learn more)

Miss Cheng Li Hui questioned how authorities can ensure the deletion of oBike’s collected personal data under the Personal Data Protection Act, given its one million members.
S Iswaran stated that oBike must comply with PDPA, including stopping data retention when no legal or business purpose exists, and that liquidators must uphold PDPA obligations during winding up.
He clarified that customer data cannot be sold as assets without consent; if transferred during a sale, customers must be notified and can request deletion from the acquirer.
The Personal Data Protection Commission has reminded oBike of its duties, is monitoring the situation, and will take action if needed to protect consumer interests.

Questions identified by AI (learn more)

Full Transcript

Miss Cheng Li Hui

Miss Cheng Li Hui asked the Minister for Communications and Information how can the authorities ensure the deletion of personal data collected by oBike in compliance with the Personal Data Protection Act, especially since it claims to have around one million members.

S Iswaran

oBike, like any other business in Singapore, is required to comply with the data protection obligations under the Personal Data Protection Act (PDPA). If a business has no legal or business purpose for the personal data in its possession or control, PDPA requires it to stop retaining such data.

PDPA continues to apply to a company undergoing liquidation. Where a liquidator is appointed, the liquidator will also have to ensure that the company undergoing liquidation continues to comply with PDPA. This includes the obligations to protect customer data during liquidation and expunging customer data at the end of the winding-up process if there is no legal or business purpose to retain it.

The personal data of customers in Singapore cannot be treated as assets and sold without their consent. In winding up a company, the company's liquidator may sell the whole or part of the company, its assets or business. If such a sale takes place, customer data that is directly relevant to the transaction may be transferred to the acquirer. However, under PDPA, customers must be notified that their personal data has been transferred. If customers do not wish for the acquiring company to use their personal data, they can approach the acquiring company to withdraw their consent, whereupon the acquiring company shall then delete the personal data once there is no legal or business purpose to retain it.

The Personal Data Protection Commission (PDPC) expects oBike and its liquidators to continue complying with PDPA even as it prepares to exit the market in Singapore. PDPC has reminded oBike of its obligations under the PDPA and is monitoring the situation closely. PDPC will not hesitate to take further action to safeguard consumers' interests if necessary.

Summary written by AI (learn more)

Miss Cheng Li Hui questioned how authorities can ensure the deletion of oBike’s collected personal data under the Personal Data Protection Act, given its one million members.
S Iswaran stated that oBike must comply with PDPA, including stopping data retention when no legal or business purpose exists, and that liquidators must uphold PDPA obligations during winding up.
He clarified that customer data cannot be sold as assets without consent; if transferred during a sale, customers must be notified and can request deletion from the acquirer.
The Personal Data Protection Commission has reminded oBike of its duties, is monitoring the situation, and will take action if needed to protect consumer interests.

Questions identified by AI (learn more)

Regulation to Ensure Deletion of Personal Data Collected by oBike | PAPERCUTS

Regulation to Ensure Deletion of Personal Data Collected by oBike

Debated in Parliament on 10 Jul 2018.

Summary written by AI (learn more)

Miss Cheng Li Hui questioned how authorities can ensure the deletion of oBike’s collected personal data under the Personal Data Protection Act, given its one million members.
S Iswaran stated that oBike must comply with PDPA, including stopping data retention when no legal or business purpose exists, and that liquidators must uphold PDPA obligations during winding up.
He clarified that customer data cannot be sold as assets without consent; if transferred during a sale, customers must be notified and can request deletion from the acquirer.
The Personal Data Protection Commission has reminded oBike of its duties, is monitoring the situation, and will take action if needed to protect consumer interests.

Questions identified by AI (learn more)

Full Transcript

Miss Cheng Li Hui

S Iswaran

Summary written by AI (learn more)

Miss Cheng Li Hui questioned how authorities can ensure the deletion of oBike’s collected personal data under the Personal Data Protection Act, given its one million members.
S Iswaran stated that oBike must comply with PDPA, including stopping data retention when no legal or business purpose exists, and that liquidators must uphold PDPA obligations during winding up.
He clarified that customer data cannot be sold as assets without consent; if transferred during a sale, customers must be notified and can request deletion from the acquirer.
The Personal Data Protection Commission has reminded oBike of its duties, is monitoring the situation, and will take action if needed to protect consumer interests.

Questions identified by AI (learn more)

Regulation to Ensure Deletion of Personal Data Collected by oBike

Summary

Questions Identified

Full Transcript

Miss Cheng Li Hui

S Iswaran

Summary

Questions Identified

Regulation to Ensure Deletion of Personal Data Collected by oBike

Summary

Questions Identified

Full Transcript

Miss Cheng Li Hui

S Iswaran

Summary

Questions Identified