The Personal Data Protection Act (“PDPA”) was passed into law by the Singapore Parliament on 15 October 2012. It is a baseline law and circumscribes the collection, use and disclosure of personal data by the International French School (Singapore) (“IFS” or “the School”), recognising the right of individuals to protect their personal data.

A Personal Data Protection Commission (“PDPC”) consisting of appointed members has been established to ensure the effective implementation of the PDPA.

IFS Personal Data Protection Policy

IFS protects data of students, parents, teaching / non-teaching staff and other individuals and embraces good practice in relation to maintaining and holding such data in accordance with the PDPA. This means keeping information securely with appropriate controls; ensuring that the individual’s consent is obtained as required by the PDPA; the individual is made aware of the purpose for which IFS is collecting, using and disclosing his/her data/information; and holding accurate information. IFS ensures that data is managed responsibly in the manner expected by the PDPA. 

The purpose of this Policy is to prescribe guidelines which enable IFS to comply with the PDPA in respect of the data we hold, i.e. in our possession or control about individuals; to embrace good practice in relation to maintaining and holding individual data; to protect IFS’ students, staff and other individuals whose data is held by IFS, and to protect IFS from the consequences of a breach of our responsibilities under the PDPA.
This Policy covers the collection, use, disclosure, processing, protection, storage, retention, and disposal of personal data in the possession or under the control of IFS.

Definition of Personal Data

“Personal Data” as defined in the PDPA means “data, whether true or not, about an individual who can be identified from that data; or from that data and other information to which IFS has or is likely to have access”. In other words, any data that can identify a unique person either on its own (e.g. NRIC number) or in combination (e.g. Full Name and Home Address – because many people can have the same name).

Essentially, any data or information that has the ability to identify the individual concerned would constitute personal data of that individual.

The following categories of personal data are excluded for the purposes of PDPA obligations:

• Business contact information used in a business-to-business context.
• Personal data that is contained in a record that has been in existence for at least 100 years.
• Personal data about a deceased individual who has passed away for more than 10 years.
• Publicly available information, which is information that is lawfully made available to the general public 
• Data which cannot be associated with an individual, or which has been anonymised.

Collection of Personal Data

When collecting any personal data from an individual, he/she must be informed of the purpose for which and how his/her data will be used, even when the data collection point is outside of Singapore.

Purpose Limitation 

Under the PDPA, IFS can only collect, use or disclose / transfer personal data about an individual for specific purposes that a reasonable person would consider appropriate in the circumstances; and for which the individual was notified on or before the data collection.

Notification of Purpose 

When collecting any personal data from an individual, the individual must be informed of the purposes for which and how such personal data will be used and/or disclosed.
IFS has included a statement of purpose (or “notice”) in contracts or forms used for collection of personal data, setting out how and for what purpose the information will be used. 

Consent

An individual is determined to have given consent for the collection, use or disclosure of his/her personal data when IFS informs the individual of:

• The purposes for the collection, use or disclosure of the personal data, as the case may be, on or before collecting the personal data;
• The business contact information of a person who is able to answer on behalf of IFS the individual’s questions about the collection, use or disclosure of the personal data, when so requested; and
• The individual provided his consent for that specific purpose;
• Or where the individual voluntarily provides the personal data to IFS for that purpose and it is reasonable that the individual would voluntarily provide such data.

Deemed Consent

Under certain circumstances as provided for in the PDPA, there could be deemed consent when individuals voluntarily provide their personal data to IFS after having understood the purpose (and it is reasonable for them to do so).

Consent on Behalf 

There could be instances where one Individual A acts validly on behalf of another Individual B in providing the latter’s personal data to IFS. For example,

• Individual A is the parent or guardian of Individual B who is a minor
• Individual A has been granted lasting power of attorney or court order to act on behalf of Individual B who is mentally incapable of making his/her own decision

Under such circumstances, there is no need to get consent directly from Individual B. However, IFS must ensure that Individual A can act validly on behalf of Individual B, and that Individual A is aware of the purpose(s) why IFS wants to collect the personal data of Individual B. 

Where Consent is not Required

The PDPA provides for certain circumstances (non-exhaustive, only those that are relevant to IFS) where there is no need to seek consent for the collection, use or disclosure of personal data:

• Publicly available data
• In the national interest (e.g. contact tracing during COVID-19)
• In relation to data obtained from or disclosed to a public agency
• To protect vital interests of individuals (e.g. responding to emergency, incidents affecting health or safety, contacting next-of-kin or friend of any injured, ill or deceased individual)
• To recover a debt owed by the individual to IFS, or to pay to the individual a debt owed by IFS
• For any investigation or court proceedings
• For evaluative purposes (to determine the suitability, eligibility or qualifications of the individual to whom the data relates, e.g. for appointment, promotion or termination in employment)
• Document produced in the course of the individual’s employment, business or profession
• Entering into, managing or terminating an employment relationship or appointment

Treatment of Publicly Available Data

As a guide, as provided for under the PDPA, there is no need to get consent for the collection, use or disclosure of personal data that is generally available to the public.

Note that so long as the personal data in question was publicly available at the point of collection, IFS will be able to use and disclose the said data without consent, even if it may no longer be publicly available at a later time. 

Withdrawal of Consent

Individuals are entitled to withdraw their consent to IFS for collection, usage or disclosure of their personal data either fully or partially under PDPA.
Individuals need to submit to the DPO a form to withdraw their consent for specific purposes, via email. A distinction must be made between purposes necessary and optional to maintain existing business relationships.