Companies Breaching Personal Data Protection Act and Do-Not-Call Provisions

Mr Zainal Sapari asked the Minister for Communications and Information (a) what is the number of complaints that the Personal Data Protection Commission has received since the implementation of the Personal Data Protection Act on Do-Not-Call related offences; (b) how many companies have been convicted or have had their offences compounded; and (c) whether public education efforts have been effective in educating businesses with regard to compliance with the Act.

Madam, the Do Not Call, or DNC, rules under the Personal Data Protection Act came into effect on 2 January 2014. Over the past two years, the Personal Data Protection Commission, or PDPC, has received about 9,700 valid public complaints against some 1,500 companies. A majority of these companies were from the property, retail and financial sectors.

PDPC's investigations revealed that most companies which flouted the DNC rules did not clearly understand the requirements of the rules and how to comply with them. Given that it was still early days of the Act and most complaints involved one-off breaches, PDPC issued advisory notices and warnings to about 3,000 organisations. These were meant to provide useful guidance to these companies on specific steps to be taken, in order to comply with the DNC rules.

For the more egregious cases, PDPC prosecuted two organisations: Star Zest Home Tuition and its director, and a salesperson from Huttons Asia in 2014. They continued to send multiple, unsolicited telemarketing messages to numbers listed in the DNC Registry, despite being notified by PDPC not to do so. In addition, two others had their offences compounded in lieu of prosecution, given that the breaches were not as serious.

Madam, PDPC has also received some 26,500 complaints on messages relating to illegal activities, such as unlicensed moneylending and illegal gambling, and the Minister is not exempt from these. As these activities come under the purview of the Police, PDPC has been referring such complaints to the Police.

PDPC has been proactive in its public education and outreach efforts to organisations and members of the public. PDPC has conducted briefings and workshops for organisations to explain how the Act would apply to various types of businesses and what organisations would need to do to ensure compliance. PDPC's online e-learning and educational resources have also been helpful, especially for smaller organisations. PDPC also collaborates with other agencies, such as the Law Society of Singapore and SPRING's small and medium enterprises (SME) Centres, to offer advice and consultation services to smaller businesses.

As of end 2015, PDPC has engaged more than 23,000 participants from some 7,500 organisations. These efforts have allowed organisations to gain a better understanding of the Act, which has helped to reduce the number of DNC complaints in 2015 by more than 50%.

I would like to assure the House that PDPC will continue to engage organisations, raise awareness and facilitate compliance with the Act. Organisations which require any guidance or advice can approach PDPC.