Low Yen Ling
Singapore
“I want to thank Member Cai Yinzhou for the clarification. As far as his historic district is concerned, I want to assure him that the new Place-making Project Office that comes under the Inter-agency Task Force does indeed not only serve Kampong Gelam, Little India, but also Chinatown.”
“A "we first" society needs an active citizenry working together to realise it. When corporates, community groups, and individuals come together, we will be able to create a harmonious, united and progressive home and society that belong to us.”
“I want to thank Member Mr Andre Low. In my earlier speech, I have also responded very succinctly. I want to assure him, as well as Mr Melvin Yong, I think you touch on very similar issues, and you probably heard from the political office holders speaking at the Ministry of Home Affairs COS about their tough stance against scams.”
“Finally, Government agencies, not just MTI, EDB and Enterprise Singapore, under the leadership of Deputy Prime Minister Gan Kim Yong, will continue to create a pro-business, pro-people environment, building a business environment based on integrity.”
“— family business, as well as the other one on TACs. On family businesses, I want to assure him that earlier on, when we mentioned that we raised the support level for SMEs and non-SMEs and indeed, many of our multi-generational family businesses are in that category.”
“And since the Member asked, price obviously is an important indicator. Another example is if CCS observes the behaviour of the organisations and if we pick up signals that they are coordinating the behaviour to raise prices, to reduce quality, to reduce output, to reduce innovation, CCS will step in.”
The complete record
Every one of 859 lines we hold for Low Yen Ling, in date order, each linked to its source. Free to read, in full, without an account. Page 18 of 18.
“My concern is that the longer a sunrise period there is, the greater the likelihood that some of the more entrepreneurial organisations will escalate their data collection and use the gathered information for direct marketing activities, in anticipation of the DNC regime coming into force. Similarly, organisations may also attempt to collect personal data and use them before the law comes into force in order to gain an advantage from the deemed consent provision under clause 15 of the Bill as well as to engage in "stockpiling" of personal data to be in alignment with the requirements of clause 17 of the Bill. Sir, regardless of the duration of the sunrise period, I also hope that the Ministry will not provide a further grace period for compliance. To do so would only defeat the purpose of the sunset period, and will reduce the impetus for compliance as soon as possible. I would also like to propose that the regulation of spam emails be incorporated into the PPD Act's Do Not Call registry regime. Sir, the Spam Control Act of 2007 has not addressed the problem of spam emails. If anything, the Act has probably not made any difference at all! Anecdotal evidence suggests that the incidence of abuse and misuse of email addresses is now greater than it was when the Spam Control Act was passed. By bringing emails under the DNC regime, we will not make an arbitrary distinction between emails and phone calls or phone messages. It is noted that SMSes and MMSes are also covered under the Spam Control Act but they are also included under the DNC regime. A person's email addresses are also personal identifiable information.”
“I move on to my other concern, which relates to the "deemed consent" provision in clause 15 of the Bill. In general, actual consent should be encouraged both in law and in practice. While I am not so concerned with the need for explicit consent, there should be adequate safeguards for actual consent, whether expressed or implied. Similarly, while there are safeguards in the case of "deemed consent", I would like to suggest that stronger emphasis be placed on the connection between "purpose" and "consent". To adequately protect the individual, the Bill could go further and state that the connection between purpose and consent given must be clear. A purpose cannot be so broad as to result in an organisation having the carte blanche to use personal information gathered for a whole host of other incidental purposes. Otherwise, what will result will be an abuse and misuse of the personal information gathered, which is seemingly protected by the law as deemed consent of a broad nature had been obtained. Page: 853 On the Do Not Call (DNC) registry found in Part IX of the Bill, MICA has set a 12-month deadline for the implementation of the DNC registry. Could the Minister clarify whether it would consider moving towards a shorter sunrise period from the enactment of the PPD Act? Sir, the bulk of the compliance mechanisms that need to be put in place is under the responsibility of the authorities, that is, the Privacy Commission. The private organisations merely have to consult and observe the register in accordance with the law.”
“Instead, for the purposes of this Bill, which is concerned with personal data protection, the concept of privacy for me has to involve information and, in particular, the access of others to undocumented personal information. Page: 852 In reviewing the Bill, my primary considerations are whether the proposed law provides sufficient recognition of the privacy principles of consent, control and care. Sir, I appreciate that the personal data protection regime envisaged by the Bill is a light-touch one – one in which a minimum data protection standard is uniformly applied across all private organisations and individuals. Sir, let me just go on to my first reservation. The proposed law does not apply to the public sector. The public sector, collectively, has a lot of information about individuals living on this island. Further, given the range and intensity of surveillance technology at the disposal of the Government, the need to regulate how the public sector collects, uses, shares and disseminates personal information takes on greater importance. Although there are specific legislations that govern the protection of data by the public sector, such as the Official Secrets Act and the Statutory Bodies and Government (Protection of Secrecy) Act, I am of the view that a unified regime is ideal and one that will provide more robust protection of personal data. If a dual regime is preferred, and which I sense is the Government's preference, I hope that the new Ministry of Communications and Information will seriously consider beefing up the legislation that governs the public sector's handling of information, which is primarily geared towards the protection of the secrecy of information.”
“On this note, I support the Bill. 4.41 pm Asst Prof Tan Kheng Boon Eugene: Mr Speaker, Sir, I rise in support of the Personal Data Protection Bill. This comprehensive legislation is belated but I believe that the regulatory regime offered by the proposed law is better late than never. It provides a good start and will stand us in good stead as we develop and grow our system of protecting the personal data of individuals. As the examples of Google, Facebook and Twitter demonstrate, consumer information and insights are currency in today's business world. This currency, in the form of digitised information, also means that personal data is now much easier to collect, store, use and disseminate. This also means that the protection of personal data is also much harder. Matters are compounded, given the lack of understanding and appreciation for online privacy. Legislation will always be playing catch-up with developments in the online world. Nonetheless, we must always endeavour to keep up. In Asia, the jurisdictions which already have data protection laws include Hong Kong, Taiwan, South Korea, Malaysia and the Philippines. Sir, the role of data protection laws is significant in the Singapore context given that there is no common law protection for personal privacy here. But this does not mean that privacy is not important in Singapore. Yet, the definition of privacy is elusive in that any definition is easily open to the charge of being either too broad or too narrow. The common conceptions of privacy as "the right to be left alone" and "to have control over information about ourselves" are often inadequate.”
“The fact that personal information is becoming an online commodity applies to children as well as adults. We need to place parents in control over what information is collected from their young children online. We should require that "verifiable parental consent" should be sought whenever website operators and online service providers directed to children under 13 years old wish to collect, use, or disclose personal information from children. Parents should also be able to "opt out" of any further information collection from their child. Page: 851 We have all a responsibility to ensure that our children are protected from potential risks or abuse that could result from unwitting personal disclosure. Due to the increased complexity of today's highly connected world, it is not enough to assume that laws to protect adults' personal data would do well for children as well. We need the Personal Data Protection Bill to detail the boundaries and guidelines that can ensure the safety of our children. In view of their limited understanding of risks and consequences, children need specific protection in this area. Furthermore, laws alone would not suffice. Education – for parents and children – on how to protect and treat their personal data is needed to bring the public to a higher level of awareness and maturity that would reinforce responsible behaviour from individuals, companies and organisations. Industries can also be encouraged to self-regulate. Parents or children-related community groups can also play a part by providing and promoting healthy personal data protection practices and online behaviour. We all know that regulation can only set the outside perimeters. We need education to set the inward indicators for safe and healthy sharing of personal information.”
“They are starting at a younger age, using smart phones and electronic tablets, and spending more time online downloading and uploading information. In 2010, according to the MDA, 39% of Internet users aged 7-14 years old get online once a day. The average duration of an Internet session for 41% of Internet users aged 7-14 years is one to two hours. While the Internet can be a channel for education, it also carries a spectrum of risks to children as they share more about themselves online as they view marketing advertisements, join social networks or even transact on the Internet through apps, games and contests. In the course of such activities, they can be targets for unsuitable or aggressive online marketing for commercial gain, cybergrooming, online scams or even identity frauds. As the Personal Data Protection Bill comes into place, I hope we can also provide suitable guidelines as to how children's personal data, especially data for those under 13 years old, should be treated. Several governments recognise that children need additional protection in this area. I understand that in 1998, the US enacted the Children's Online Privacy Protection Act (COPPA) to protect personal data of children below 13 years of age. The European Commission is reviewing its data protection law to offer greater protection to children. Like in the US, European companies have to get parental consent for all minors under 13 years old. The Commission also wants all communication aimed at minors to be clear and in plain language. This will ensure that young people can understand the implications of entering their data, the reason it is needed, and the protection it is afforded. Children's personal data needs extra safeguards.”
“For instance, they would have to have a Personal Data Officer, ensure compliance of marketing activities, have their data lists filtered and observe other requirements under this Bill. Many SMEs that are already under pressure with the labour crunch and economic uncertainty, may have little capacity or capabilities to do this. As SMEs do not have the scale and deep pockets of well-recognised, global brands, we must be mindful that the Personal Data Protection Bill can pose considerable challenges to their marketing and customer acquisition efforts. The fear of infringing the new laws may also weigh them down. Page: 850 While protecting the interests of consumers, I hope MICA and the relevant Government agencies will also lend good support to the SMEs during the sunrise period to ease them into the implementation of the Bill. For example, it will take resources and time for SMEs to make sense of all the legal requirements and to also ensure compliance. There could be new or recurrent costs involved in ensuring all requirements of the Bill are met. Besides awareness and education, I hope the Government will consider providing free training, consultancy and support for SMEs that extend beyond the sunrise period, and also explore possible tax reliefs and financing for SMEs on the costs incurred as a result of complying with the Bill. (In English): The second area of concern that I wish to raise is with regard to the protection of children's personal data. The fact that the Personal Data Protection Bill does not draw any explicit distinction between data subjects who are adults and those who are children introduces an important extra dimension that must also be addressed in the Bill. An increasing number of children are now using the Internet.”
“While protecting the interests of consumers, I hope MICA and the relevant Government agencies will also lend good support to the SMEs during the sunrise period to ease them into the implementation of the Bill. For example, it will take resources and time for SMEs to make sense of all the legal requirements and to also ensure compliance. There could be new or recurrent costs involved to ensure all requirements of the Bill are met. Besides awareness and education, I hope the Government will consider providing free training, consultancy and support for SMEs that extend beyond the sunrise period, and also explore possible tax reliefs or financing incentives for SMEs on the costs incurred as a result of complying with the Bill. (In Mandarin): [Please refer to Vernacular Speech on Pg 939.] I rise in support of the Personal Data Protection Bill. It is a positive move that not only protects consumers' interests, but will also put Singapore on par with countries with data protection laws and strengthen our position as a business hub and location for global data management and processing services. With regard to the Bill, I would like to discuss its impact on SMEs. SMEs are the lifeblood of our economy. Today, 99% of all enterprises in Singapore are SMEs. They employ 70% of our workers, and contribute over 50% of national GDP. The often-cited challenges by SMEs include manpower, financing and cashflow. In view of this, marketing activities that are key to enhancing an SME's brand and offering can become quite a load for these enterprises. With the introduction of the Personal Data Protection Bill, SMEs would have to put in more resources to navigate and understand the new law.”
“Mr Speaker, I rise in support of the Personal Data Protection Bill. It is a positive move that not only protects consumers' interests, but it will also put Singapore on par with countries with data protection laws and strengthen our position as a trusted business hub and location for global data management and processing services. With regard to the Bill, I would like to raise two areas of concern: firstly, the impact of the Bill on SMEs, a point also raised by hon Members who spoke before me; and secondly, the protection of children's personal data. As we all know, SMEs are the lifeblood of our economy. Today, 99% of all enterprises in Singapore are SMEs. They employ 70% of our workers, and contribute over 50% of national GDP. The often-cited challenges by SMEs include manpower, financing and cashflow. In view of this, marketing activities that are key to enhancing an SME's brand and offering can become quite a load for these enterprises. With the introduction of the Personal Data Protection Bill, SMEs would have to put in place more resources to navigate and understand the new law. For instance, they would need a staff to double up as a Personal Data Officer, to ensure compliance of marketing activities, have their data lists filtered and observe other requirements under this Bill. Many SMEs that are already under pressure with the labour crunch and economic uncertainty may have little capacity or capability to do so. Page: 849 As SMEs do not have the scale and deep pockets of MNCs, we must be mindful that the Personal Data Protection Bill can pose significant challenges to their marketing and customer acquisition efforts. The fear of infringing the new laws may also weigh them down.”