In response to the COVID-19 outbreak, Singapore’s Personal Data Protection Commission (PDPC) has reminded organisations that they may collect the personal data of visitors to their premises without consent if used only for contact tracing and other emergency response measures during the COVID-19 outbreak. The personal data to be collected may include visitors’ National Registration Identification Card (NRIC), Foreign Identification Number (FIN), or passport numbers.
The PDPC’s Advisory relies on provisions of the Personal Data Protection Act 2012 (PDPA) that authorise the collection, use and disclosure of personal data without consent if necessary, to respond to an emergency that threatens the life, health or safety of the individual or another individual.
However, organisations must continue to comply with other provisions of the PDPA, such as making reasonable security arrangements to protect the personal data and ensuring that it is not used for other purposes without consent or authorisation under the law.
The PDPC has issued a sample notice that organisations may use to inform visitors that their personal data will be collected for contact tracing purposes.
The World Health Organisation and the Centres for Disease Control and Prevention remind everyone that healthy personal hygiene is still the best deterrent in preventing the further spread of COVID-19. Wash hands properly and frequently, and desist from touching the face, mouth or eyes. If it can be avoided, limit domestic or international travels. Finally, it is encouraged that anyone who is feeling poorly, feverish, and exhibiting flu-like symptoms, to visit a healthcare facility as soon as possible.
Disclaimer: This article is for general information only and does not constitute legal advice.
