Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP/A > Jurisdictional comparison > Flashcards

Jurisdictional comparison Flashcards

1
Q

What are the different consent obligations in Singapore

A

Organisation can only collect, use or disclose personal data for purposes for which an individual has given his or her consent.
- Can be in verbal or written form.
If verbal consent given, give written acknowledgement.
- DNC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the different consent obligations in HK

A
  • Consent needed in relation to direct marketing
  • If verbal, written confirmation needed in 14 days
  • Consent needed if online tracking info related to personal data and is collected for direct marketing purposes
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the consent obligations in India

A

A business cannot collect SPDI unless it obtains the prior consent of the provider of the info.

Consent has to be provided by letter, fax or email

No specific legislation that governs online direct marketing. However general practice to allow opt in/ opt out

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the notification obligations in Singapore

A

Notify ind of purposes before collection, use or disclosure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the notification obligations in HK

A

PICS - Informed of purpose for which data is to be used and classes of person to whom the data may be transferred

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the notification obligations in India

A

Provider of info should be made aware that info is being collected, purpose of use, recipients, name of collection agency

Prior consent required for disclosure to any party other than gov

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the access obligations in SG?

A

Must upon request provide individual with his data in the possession or within the control of the organisation and information about the ways in which the personal days has been or may have been used or disclosed during the past one year

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the access obligations in HK?

A

The data subject to be informed of his/her rights to request access and the correction of the data and the name, job title, and address of the individual to handle any such request made to the data user.

Under DPP6 (Access and Correction), data subjects are entitled to request access to personal data within 40 days.

Failure to comply with a data access request is an offence under the PDPO

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the access obligations in India

A

The business should permit the provider of the info the right to review the info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the response period and fulfilment or request for SG?

A

Fulfilment as soon as reasonably possible and otherwise, preferably, fulfilment within 30 days of the request, otherwise a response within such 30 days to inform about expected time of fulfilment

If valid request, correct the personal data as soon as reasonably possible and send the corrected data to other organisations to which the personal data was disclosed within a year before the correction is made.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the response period and fulfilment or request for HK

A

Require data users to inform a data requestor if it does not hold any of the requested data within 40 days of receiving such a request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the response period and fulfilment or request for India

A

Not stated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Can an access fee be charged in SG?

A

Can charge an individual a reasonable fee for access to personal data about the individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Can an access fee be charged in HK?

A

May be entitled to request a fee if not excessive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Can an access fee be charged in India

A

No requirement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the correction obligations in SG?

A

If valid request, org must correct the personal data as soon as reasonably possible and send the corrected data or other organisations to which the personal data was disclosed within a year before the correction is made

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the correction obligations in HK

A

Data subjects are entitled to request the correction of personal data without charge to the data subject

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the correction obligations in India

A

The business should ensure that any information found to be inaccurate or deficient be corrected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are the complaint rights of individuals in SG

A

Can submit complaint to PDPC. individual can also take civil action against organisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the complaint rights of individuals in HK

A

Can submit complaint to PCPD. Privacy Comm may grant assistance such as legal rep and advice to data subjects

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the complaint rights of individuals in India

A

Body corporate must designate grievance officers to manage compliances. Grievance officer shall redress the grievances or provider of info expeditiously but within one month from the date of receipt of grievance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the exemptions in SG

A

Public sector, public authorities, publicly available information, public agency, business contracted by SG gov

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the exemptions in Hk

A

Chinese central gov org and media

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What are the exemptions in India

A

Limited application for sensitive data, limited application to “providers” not data subjects, freedom of speech, lack of openness

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the difference between privacy and security?

A

Info privacy: Application of rules that govern collection, usage and disclosure (CUD) of personal data / information

Info security: Also protecting any type of info or info asset that supports a business, while ensuring Confidentiality, Integrity and Availability (CIA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the info security requirements in SG?

A

Must make reasonable security arrangements to prevent unauthorised access, collection, use and other risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the info security requirements in Hk

A

DPP4 - Security: A data user needs to take practical steps to safeguard personal data from unauthorised or accidental access, processing, erasure, loss or use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the info security requirements in India

A

The IT Act requires reasonable security procedures to be maintained in order to escape liability. Standards based or code by an industry association and approved and notified by the government. At least once a year audit by an independent auditor approved by the government.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are the DPO requirements in SG?

A

Each org must appoint one or more DPOs. May delegate certain reps, including to non-employees. Business contact of DPO must be made available to the public.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the DPO requirements in HK

A

No legal requirement for DPO. However PCPD issued a best practice guide to encourage users to appoint DPO.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the DPO requirements in India?

A

Every corporate entity collecting SPDI must appoint a Grievance Officer to address complaints, and respond to requests in an expeditious manner within one month.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the breach notification requirements in SG?

A

No mandatory req.

Best practice guide recommends that affected individuals be notified immediately if sensitive personal data involved.

PDPC should be notified ASAP for breaches that might cause public concern or where there is a risk of harm to a group of affected individuals.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the breach notification requirements in HK

A

No mandatory requirement.

However according to non-binding guidance issued by the PCPD; encourages notification to the PCPD and to data subjects and where there would be a risk of harm but not notifying.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are the breach notification requirements in India

A

Upon the occurrence of some cybersecurity incidents, companies a data required to notify the Cert-in within reasonable time.

Breach notice obligations depend upon the place of occurrence of such breaches and whether or not Indian customers have been targeted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are Binding Corporate Rules?

A

BCRs are a set of rules adopted within a particular company or corporate group that provide legally binding protections for data processing within the company or the group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is pseudonymisation?

A

Anonymisation technique that replaces personal identifiers with other references

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What is de-identification?

A

Process used to prevent a person’s identity from being connected with info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is anonymisation?

A

Removing identifying info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is the definition of personal data in SG?

A

Data, whether true or not, about an individual who can be identified from that data and other information to which the organisation has or is likely to have access.

Individual is defined as natural persons whether living or deceased

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is the definition of personal data in HK

A

Data relating directly or indirectly to a living individual. From which it is practicable to identify the individual in a form in which access to or processing of the data is practical.

Does not protect info concerning a deceased individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is the definition of personal data in India?

A

No definition of personal data, only personal information.

Defined as any information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such a person.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What is the definition of sensitive data in SG?

A

No concept or specific requirement.

Reasonableness requirement in CUDS leads to a need for additional measures in practice in connection with sensitive data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is the definition of sensitive data in HK

A

No concept or specific requirement.

Sensitive data include ic card numbers, healthcare, biometric data, financial info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is the definition of sensitive data in India?

A

SPDI includes passwords, financial info, physical, physiological and mental health condition, sexual orientation, medical records and history, biometrics.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What are the children’s data protection rules in SG?

A

No concept or specific requirement.

In advisory-Data Activities relating to Minors

Age threshold of 13- typically have sufficient understanding to be able to consent on his own behalf.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What are the children’s data protection rules in HK?

A

No concept or specific requirement

PCPD leaflet to help parents and Teachers help children under their care to protect their personal data in the online environment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What are the children’s data protection rules in India?

A

Child porn crime.

s67 of IT Bill- creating, transmitting, browsing obscene material.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What is the treatment of publicly available data / registries in SG?

A

Generally available if any member of the public could obtain or access the data with few or no restrictions.

Consent not needed if data is publicly available.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is the treatment of publicly available data / registries in HK?

A

May access and obtain public information, but must still observe Data Protection Principle 1(2) and 3

If for direct marketing activities has to comply with Part VIA of the PDPO and obtain consent.

Relevant factors for assessing:

  • Original purpose for which the personal data was placed in the public domain
  • Restrictions
  • Reasonable expectation of the personal data privacy of the data subjects
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What is the treatment of publicly available data / registries in India?

A

No mention of treatment of public registers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

What is the National ID system in India?

A

UIDAI (Unique Identification Authority of India) created In 2009 to issue biometric UID, Aadhaar

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

What is the position for national surveillance in SG?

A

Credit reporting covered under where necessary for loan evaluation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What is the position for national surveillance in HK

A

PDPO Code of Practice on consumer credit data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is the position for national surveillance in India

A

Only India has credit reporting limitations.

The Credit Information Companies (Regulations) Act is the only Indian legislation, other than the IT code, to have its own data protection code.

India’s Centralised Monitoring system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What are the rules on data processing and export in SG?

A

Transfer only where overseas organisation provide a comparable standard of protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What are the rules on data processing and export in HK?

A

S33 PDPO - prohibits transfer abroad except in certain circumstances.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What are the rules on data processing and export in India?

A

A business can only transfer the SPDI or information to a party overseas if the overseas party ensures the same level of protection provided for under the Indian Rules.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is the position for intermediaries in SG?

A

Only the Retention Limitation and Protection obligation are applicable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What is the position for intermediaries in HK

A

Data processor: DPP2 (Accuracy and retention) and DPP 4 (Security) had been revised to cover data processors.

In outsourcing arrangements (within or outside HK), data user must adopt “contractual means or other means” to prevent any personal data transferred to the data processor from being kept longer than is necessary for processing of that data.

Data user remains accountable for the acts done and practices engaged by data processor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What is the position for intermediaries in India?

A

No concept of data processor - only body corporate

Entire s43A and the Rules are clearly intended to impose liability on:

  • Business process outsourcing
  • IT enabled Services
  • Other outsourced providers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What is the extra-territoriality of the data privacy rules in SG?

A

No specific provisions for extraterritorial operations of the PDPA.

Foreign companies which do not have a physical presence in SG can still be liable under the PDPA but only for actions which takes place in SG such as collection or disclosure of personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

What is the extra-territoriality of the data privacy rules in HK?

A

No provision dealing with extraterritorial application of the ordinance.

In yahoo Hk case, Privacy Commissioner concluded that the China entities not liable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

What is the extra-territoriality of the data privacy rules in India?

A

IT Act s1(2) unlimited territorial jurisdiction and applies to any offence or contravention committed outside India by any person.

Section 75(1) and (2) states “the act or conduct constituting the offence involved a computer, computer systems or computer network located in India.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

What are the rules for marketing in SG?

A

The data protection principles apply to any marketing activities (including electronic marketing) which involve the collection, use or disclosure of personal data.

Telemarketing needs to comply with DNC provisions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

What are the rules for marketing in HK?

A

Data users who wish to use personal data for data user’s own direct marketing purposes to obtain prior consent from the data subject for such action and notify the data subject accordingly.

If consent given orally, data users have the additional obligation to send a written confirmation to the data subject confirming the particulars of the consent received.

Sharing personal data with third party requires prior written consent.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

What are the rules for marketing in India?

A

Act does not refer to electronic marketing directly. Privacy rules provide the right to “opt out” of email marketing, and the company’s privacy policy must address marketing and info collection practices.

DNC registry effectively implemented by TRAI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What are the OECD principles?

A 
CUPIDASO
Collection Limitation 
Use Limitation
Purpose Specification 
Individual Participation
Data Quality
Accountability
Security safeguards
Openness
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

What are the SG PDPA Principles?

A

Carp on Tap

Consent
Accuracy
Retention Limitation
Purpose Limitation

Openness/accountability
Notice Specification

Transfer Limitation
Access & Correction
Protection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What are the India security practices rules?

A

Rule 4 : Provide privacy policy
Rule 5: Collection of information (Consent and Purpose Limitation; Lawful purpose and minimal collection, notice and purpose Limitation, Retention, use, subject access and correction, option to refuse or withdraw consent, security, complaint handling
Rule 6: Disclosure limitations and exceptions/ Processing of info
Rule 7: Transfer of information/ data export restriction
Rule 8: Reasonable security practices and procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

What are the HK data privacy rules

A

CArUSOA

  1. Collection
  2. Accuracy & Retention
  3. Use
  4. Security
  5. Openness
  6. Access & Correction
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What HK law covers surveillance and identification?

A

Interception of Comms and Surveillance Ordinance

Introduced a requirement for judicial authorisation of both interception of communications and the more intrusive types of other covert surveillance by law enforcement bodies, while allowing law enforcement agencies to sanction their own use of less intrusive forms.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

What are the key constitutions for the protection of privacy in Hk

A

Basic Law which provides the continued application of the International Covenant in Civil and Political Rights; Bill of Rights Ordinance.

ICPR 1966 is the broadest international convention protecting human rights.

73
Q

What is the key ICCPR provision?

A

Art 17 - deals with the protection of privacy, family, home, correspondence, honour and reputation.

74
Q

What is the HK Bill of Rights 1991?

A
  • Binding only on the gov and all public authorities

- article 14 replicates 17 of the ICCPR

75
Q

What is the HK position for online tracking info?

A

Consent is needed if online tracking info relates to personal data and is collected for direct marketing purposes

76
Q

What are the Codes of Practice issued for HK DPP1

A

Consumer credit data, human resource management, IC and other personal identifiers

77
Q

What does excessive disclosure of personal information breach in Hk?

A

DPP3 Use

78
Q

What are the consequences of not providing a HK user with an opt out right from consent?

A

Non compliance HK$500k-1m and imprisonment of 3-5 years depending if personal data used for personal gain.

79
Q

What are the security measures (DPP4) for outsourcing in HK?

A

In outsourcing arrangements (within or outside HK)(data users must adopt contractual or other means to prevent unauthorised or accidental access, processing, erasure, loss or use of the data transferred to the data processor (DPP4(2)

80
Q

What are the new amendments for DPP5 in HK under the Amendments Ordinance?

A

Commissioner is empowered to serve enforcement notice directing the data user who is found to have contravened DPP5 (Openness) to remedy and it appropriate, prevent any recurrence.

Recommendations: systematic approach by data users in implementing a privacy management programme built upon a robust data privacy policy and practices that are properly executed,reviewed and assessed by designated data protection officers.

81
Q

How Long can personal data of unsuccessful candidates be held in HK?

A

2 yrs from date of rejection. may retain beyond 2 if it has a subsisting reason to do so or the applicants have given their consent.

82
Q

What are the consequences of breaching an enforcement notice in Hk?

A

Fine of HK$50k on first conviction and HK$100k on subsequent conviction and imprisonment for two years

83
Q

What are the penalties for direct marketing contraventions in HK?

A

If the data user provided data for gain- fine of up to HK$1m and imprisonment for up to five yrs

If otherwise than for gain- fine of up to $500k and imprisonment for up to 3 yrs

If it fails to stop using data for direct marketing, punishable for a fine of up to Hk$500k and imprisonment for up to 3 yrs.

84
Q

Which two DPPs were breached by Octopus in 2010?

A

DPP 1 Data collection - collected HKID etc for authentication. Commissioner found that Octopus had failed to justify claim that collecting HKID numbers necessary to safeguard against damage and loss. PICS also in unreasonably small font.

DPP3 - Data use (sale of personal data not made clear to data subject)

85
Q

What can a HK complainant appeal to AAB?

A

A complainant may appeal to AAB (Administrative Appeals Board) against a decision of the Privacy Commissioner not to issue an enforcement notice following an investigation into a complaint.

Can appeal decision not to investigate or to discontinue an investigation, to issue an enforcement notice.

86
Q

What are the two HK consultative advisory committees?

A

Personal Data (Privacy) Advisory Committee to advise the Commissioner on privacy matters.

Standing Committee on Technological Developments - to advise the Commissioner on matters relevant to the developments in the processing of data and computer tech

87
Q

What laws regulate data privacy in India?

A

ITA 2000, ITAA 2008!

April 2011, Indian Ministry of Communications and IT published four sets of rules implementing certain provisions of the 2008 amendment:

  • The Security Practice Rules require entities holding SPDI to maintain certain specified security standards
  • The Intermediary Guidelines Rules
  • The Cyber Cafe Rules
  • Electronic Service Delivery Rules
88
Q

What are the key sectoral laws in India?

A

Public Financial Institutions Act 1993, Professional Code of Ethics of Doctors, Telecommunications Laws, Banking Laws

89
Q

What are the two major laws dealing with telephonic and digital surveillance in India?

A

Indian Telegraph Act 1885
- interception in public emergency and if it is considered necessary

ITA 2000
69: Empowers Central Gov and State Gov to issue directions for monitoring, intercepting or decrypting any info transmitted, received or stored through a computer resource.

90
Q

What is the Indian surveillance system?

A

Centralised Monitoring System - gives the authorities sweeping access to citizens’ phone calls and internet comms in the name of national security.

No law exists which mandates or regulates the CMS. This mass surveillance system is merely regulated under section 5(2) of the Indian Telegraph Act 1885 which empowers the Indian gov to intercept comms on the occurrence of any public emergency or in the interest of public safety.

91
Q

What is the only Indian legislation, other than the ITA, to provide a data protection code?

A

Credit Information Companies (Regulation) Act

92
Q

Are there any express provisions in the Constitution of India on the right to privacy?

A

Only implicit in 2 fundamental rights:

  • Art 19(1)(a) Right to freedom and expression
  • Art 21: Right to life and personal liberty
93
Q

What are the permitted reasonable restrictions in Art 19(2) in the constitution of India?

A

State can impose any reasonable restrictions:
(A) in the interest of sovereignty and integrity of India
(B) Security of the state
(C) Friendly relations with foreign states
(D) Public order
(E) Decency
(F) Morality
(G) Contempt of court
(H) Defamation
(I) Incitement to an offence

94
Q

What Indian act mandates timely response to citizens requests for gov info?

A

Right to Information Act 2005

95
Q

What are the key highlights under the proposed data protection act released by the Ministry of Electronics & IT, Gov of India MeitY?

A

(1) Extra territorial application to foreign data processors insofar as they have a business connection to India or carry on activities involving profiling of individuals in India
(2) Differential obligations for personal data and sensitive personal data
(3) Obligations of the Data Controller: Notice, Purpose and Collection Limitation, maintaining data quality, storage Limitation
(4) Grounds for processing in addition to consent include use for employment purposes as well as emergencies

96
Q

What are high risk data for processors required to implement under the upcoming India Data Protection Act?

A

Trust scores, data audits as well as a data protection impact assessment

97
Q

Is data localisation applicable in India?

A

Under the upcoming Data Protection Act, a copy of all personal data must be stored in India; additionally the Gov may notify certain types of personal data that should mandatorily be processed only in India. the Gov has retained with itself the powers to exempt storage of copies of Sensitive Personal Data

98
Q

What are the requirements for cross border data flows under the upcoming Indian Data Protection Act?

A

In addition to consent cross border transfers would also require the use of: (a) model clauses and (b) possible adequacy requirements - that is transfer to jurisdictions approved by the Gov

99
Q

What is the court that resolves disputes under the IT Act 2000?

A

Cyber Appellate Tribunal

100
Q

What is s43 of the IT Act in India?

A

Section 43 relates to penalty and compensation for damage to computer, computer systems which attracts civil prosecution and criminal action

101
Q

What is section 65 of the Indian IT Act?

A

Tampering with computer source documents

Penalty: 3yrs imprisonment and 2 lakh rupees

102
Q

What is section 66 of the IT Act

A

Hacking of computer system

Penalty: 3 yrs imprisonment and fine up to INR 500,000

103
Q

What is section 72 of the Indian IT Act?

A

Penalty for breach of confidentiality and privacy

Penalty: Three years imprisonment( fine up to INR 100,000)

104
Q

What does the new Section 43A of the ITAA cover?

A

(A) Where a body corporate
(B) possessing, dealing and handling SPDI or info in a computer resource that it owns, controls or operates
(C) is negligent in implementing and maintaining reasonable security practices and procedures
(D) Causes wrongful loss or gain
(E) Liable to pay damages by way of compensation, not exceeding five crore rupees, to the persons affected

105
Q

What is s66A of the ITAA?

A

Has been held to be unconstitutional because it was over broad, penalised the sending of offensive messages

Petition that it violated the freedom of speech guarantee in art 19(1)(a) in the Constitution of India

Found unconstitutional in the Shreya Singhal 2015 case

106
Q

Which sections of the ITAA penalise identity theft and computer based scams?

A

Sections 66C and 66D

107
Q

Which is the national agency for cybersecurity in India?

A

Indian Computer Emergency Response Team as established by s70B ITAA

108
Q

What is the coverage of the IT Rules 2011?

A

Bodies corporate or persons located in India

Does not apply to the processing of data in India regarding data subjects located overseas

Some of the rules do not apply to B2B, but only to the collection of individuals’ data by businesses

Covers private sector only

109
Q

What three categories are exempt under the IT Rules?

A

Religious and social, charitable orgs, non-commercial orgs, non-automated data

110
Q

What is the definition of “personal data” under the IT Rules?

A

No specific definition of the term “personal data”

IT Rules define “personal info” as “any info that relates to a natural person which, either directly or indirectly, in combination with other info available or likely to be available with a body corporate, is capable of identifying such a person.

111
Q

What is SPDI under section 43A?

A
  • passwords
  • financial info
  • physical, physiological and mental health info
  • sexual orientation
  • medical records and history
  • biometric info
112
Q

What is the definition of a body corporate?

A

Any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities

113
Q

Under the India IT Rules, is there data protection where info is collected from third parties or other documentary sources?

A

Possibly no as some rules only apply to “providers of information”.

114
Q

What is acceptable as reasonable security procedures under s8 of the IT Rules?

A

Either the IS/ISO/IEC 27001 or a code developed by an industry association and approved and notified by the government.

115
Q

Who is the regulator of CICRA?

A

Reserve Bank of India

Any Indian citizen can also move to The National Human Rights Commission with an application of violation of privacy right.

116
Q

Who enforces the IT Act in India?

A

The adjudicating officer and Cyber Appellate Tribunal and thereafter, the different High Courts and the Supreme Court

117
Q

Who regulates unsolicited commercial communications through telephone or text?

A

Telecom Regulatory Authority of India (TRAI)

Telemarketers must register with TRAI before they may send out marketing communication through telephone or text messages.

Can register preference with Customer Preference Registration Facility (CPRF) or DNC

118
Q

What is s46 of the IT Act?

A

An adjudicating officer appointed to discern IT Act violations

119
Q

What kind of claims does an Indian adjudicating officer have jurisdiction over?

A

Claims only to a max of INR 50 million. Jurisdiction for all claims exceeding INR 50 million is vested with the competent court

120
Q

Are the orders of the adjudicating officer appealable?

A

Yes before the Cyber Appellate Tribunal and thereafter, to the High Courts and the Supreme Court.

121
Q

What are the powers of the adjudicating officer?

A
  • Hear offences of a civil and criminal nature
  • Award compensation as damages in a civil remedy
  • Impose penalties for the contravention of the Act
122
Q

How soon must grievance officers redress grievances according to the IT Rules?

A

Within one month from date of receipt

123
Q

What is s72A of the IT Act?

A

Punishment for disclosure of information in breach of lawful contract - 3 yrs imprisonment and five lakh rupees

124
Q

What is the NCDRC and it’s function?

A

National Consumer Disputes Redressal Commission

Customers can lodge complaints and includes consumer disputes involving privacy issues

125
Q

What are the penalties for breaching the PDPA?

A

Up to $1 million. 10k per DNC breach.

126
Q

What are the penalties for breaching the PDPO?

A

HK$500k -1m of fines and 3-5 yrs jail.

127
Q

What is business contact info in SG?

A 
The personal data protection rules do not apply to business contact info, which is defined as:
- an individual’s name
- business title
- business telephone number 
- business address
- business email or fax 
- any other similar info 
Which is not provided by the individual solely for personal purposes
128
Q

What is the definition of “organisation” in Singapore

A

Any individual, company, association, body of persons, corporate or incorporated, whether or not formed or recognised under the law or Singapore, or resident, or having an office or a place of business, in Singapore.

129
Q

What is the definition of individuals in PDPA?

A

A natural person, whether living or deceased. Not data relating to corporate bodies and other legal persons.

130
Q

What is the definition of a data intermediary?

A

An organisation that processes personal data in behalf of another organisation but does not include an employee of that other organisation.

131
Q

What provisions apply for a deceased person who has been dead for 10 yrs or fewer

A

Only the disclosure and protection obligation.

132
Q

What is the definition of a “specified message”?

A

Under s37 PDPA, a message is a “specified message” if the purpose of the message, or one of its purposes is:
- to advertise, promote or offer to supply or provide any of the following:
> goods or services
> land or an interest in land or
> a business opportunity or an investment opportunity
- to advertise or promote a supplier/ provider or prospective supplier/ provider

133
Q

What are the exclusions from the scope of the DNC as set out in the 8th Schedule of the PDPA?

A

For voice calls, text and fax messages:

  • B2B Marketing
  • Personal calls and sms es
  • Market research / surveys
  • Messages by public agencies for non-commercial programmes
  • Servicing messages
  • Customer services (appointments)

For text and fax messages: Does not apply to voice calls

  • current ongoing relationship with recipient
  • message relates to subject of ongoing relationship
134
Q

What does the exemption for evaluative purposes mean?

A

Organisations may collect, use and disclose personal data without consent where this is necessary for evaluative purposes. (This is set out as exception 1(f) in the Second Schedule, 1(f) in the Third Schedule and 1(h) in the Fourth Schedule respectively).

The term “evaluative purpose” is defined in section 2(1) of the PDPA and includes, amongst other things, the purpose of determining the suitability, eligibility or qualifications of an individual for employment, promotion in employment or continuance in employment.

Hence, the evaluative purpose exception allows employers to collect, use and disclose personal data without the consent of the individual or employee concerned for various purposes that are common in the employment context, for example:

a) Obtaining a reference from a prospective employee’s former employer to determine his suitability for employment; or
b) Obtaining performance records or other relevant information or opinions to determine the performance of an employee.

135
Q

Is consent required when using personal data for managing and terminating the employment relationship in Singapore?

A

No consent required, only notification needed.

The PDPA does not prescribe the manner of notification and organisations should determine the form and manner that would provide the individual with the required information that allows him to understand the purposes for which his personal data would be collected, used and disclosed. For example, organisations may determine in the particular circumstances if it would be appropriate to inform their employees of these purposes through employment contracts, employee handbooks, or notices in the company intranet. Organisations should also keep their employees updated about new purposes for which an employee’s personal data may be collected, used and disclosed without consent.

For the avoidance of doubt, where an organisation has sufficiently provided a general notification to employees on the purposes for which their personal data may be collected, used and disclosed, for example for performance appraisals, the Commission does not expect organisations to notify employees of the same purpose prior to each time that the organisation engages in such activities.

136
Q

When would consent be invalid under the PDPA?

A

Consent is invalid if:

  • individual is forced to give consent
  • individual has not been notified of the purpose
  • purposes are beyond what is reasonable
  • The organisation gives false or misleading info to mislead or deceive to obtain consent
137
Q

What are the exceptions to consent for collection in SG?

A

Emergency, publicly available data, public agency

138
Q

What are the exceptions to consent for usage in SG?

A

Employment, business purposes, professional purposes, business asset transactions.

139
Q

What are the exceptions to consent for disclosure in SG?

A

Recover debts, make payment, evaluative purposes.

140
Q

What are the options to satisfy the requirement of comparable standard of protection in SG?

A
  • Recipient country has adequate data protection law
  • getting informed consent
  • coming within an exception
  • getting contractual protection or
  • relying on binding corporate rules
141
Q

When was the PDPC established?

A

2 Jan 2013

From 1 Oct 2016, the IMDA is designated as the PDPC

142
Q

Individuals who suffer loss or damage directly as a result as a result of a contravention of which provisions of the PDPA have a right of action for relief in civil proceedings?

A

Part IV- Collection, use and disclosure of personal data
Part V- Access to and correction of personal data
Part VI- Care of person data

143
Q

What is the liability for breaches of the Banking Act?

A

Liability for fine up to 125k and/or imprisonment up to 3 yrs or fine up to 250k for non individuals

144
Q

Outsourcing Risk Management key requirements

A

Institutions should perform:

  • The necessary due diligence and apply sound governance and risk management practices when subscribing to cloud services
  • take active steps to address the risks associated with data access, confidentiality, integrity, sovereignty, recoverability, regulatory compliance and auditing
  • Ensure that the service provider possesses the ability to clearly identify and segregate customer data using strong physical or logical controls
145
Q

What directions can PDPC give to Ensure compliance with the PDPA?

A
  • To stop collecting, using or disclosing of personal data in contravention of PDPA
  • To destroy personal data collected in contravention of PDPA
  • To comply with any directions concerning access and correction
  • Except where any failure to comply with the PDPA is an offence, pay a financial penalty not exceeding $1m
146
Q

What are the possibilities for appeal or individuals or orgs dissatisfied with PDPC decisions?

A

28 days to appeal to Data Protection Appeal Panel (DPAP)

Will be heard by an Appeal Comm (3 or more members). Appeal Committees will have all the powers and duties of the PDPC necessary for their work, plus those of a district court.

There can also be appeals to the HC (On a point of law or amount of a financial penalty) or the COA. No appeals thus far.

147
Q

How should organisations handle data breaches under PDPC guidance?

A

Containing the breach
Assessing risks and impact
Reporting the incident
Evaluating the response and recovery to prevent future breaches

148
Q

Is it an offence to make an access or correction request about another individual without the authority of that individual in SG?

A

Yes under s51(1) PDPA.

A person who commits an offence under s51(1) is liable to a fine not exceeding 5k or to imprisonment for a term not exceeding 12 months or to both.

149
Q

Is it an offence to alter, destroy documents to evade an access and/or correction request in SG?

A

Yes under s53(3)(a) of PDPA.

An org or person that commits an offence under s53(1)(a) is liable:

  • in the case of an individual, to a fine not exceeding 5k
  • in any other case, to a fine not exceeding 50k
150
Q

What PDPA offence is under s51(3)(b) and (c)?

A

(A)Obstructing or hindering the PDPC in the exercise of their powers or performance of their duties; or
(B) Knowingly or recklessly make a false statement to the PDPC; or
(c) knowingly misleads or attempts to mislead the PDPC in the course of the performance of the duties or powers of the PDPC under the PDPA

151
Q

What is the penalty for breaching 51(3)(b) and (c) PDPA?

A

In the case of an individual, to a fine not exceeding 10k or to imprisonment for a term not exceeding 12 months or to both

In any other case, to a fine not exceeding $100,000

152
Q

What are the penalties for breaching the DNC

A

Fine is 10k per offence. In appropriate cases, PDPC may compound the offence for a sum of up to 1k

153
Q

Outsourcing arrangements in the 2012 amendments of the HK PDPO are requirements under which data protection principles?

A

Security principle (DPP 4) as well as Accuracy and Retention (DPP 2)

154
Q

What is the significance of the Do No Evil Mobile App case in HK?

A

Issue of aggregating data from publicly available sources- The Commissioner ruled that the use of personal data obtained from the public domain for due diligence review and background check was inconsistent with the original purpose of data collection by the Judiciary, ORO and Companies Registry, as well as their purposes of making the data publicly available.

155
Q

The Octopus Rewards case was a breach of which data protection principles under the PDPO?

A

Data collection and data use

156
Q

Can a complainant appeal the decision of the AAB in HK?

A

There is no appeal against the decision to court, but aggrieved parties can seek judicial review of the AAB decision.

157
Q

Out of SG, HK and India, which relates to personal identifiable information that relates directly or indirectly to the individual?

A

HK and India

HK: Data relating directly or indirectly to a living individual (data subject). From which it is practicable to identify the individual in a form in which access to or processing of the data is practical.

India: Defined as any info that relates to a natural person, which, either directly or indirectly, in combination with other info available or likely to be available with a body corporate, is capable of identifying such a person.

Singapore does not make such references in the PDPA

158
Q

What kind of individuals are not covered by Singapore’s PDPA?

A

An employer or domestic maid is not covered as the PDPA does not apply to any individual acting in a personal or domestic capacity.

Would cover a financial advisor or a Real Estate agent.

159
Q

What kind of records are exempted by PDPA?

A

Personal data that is in a record more than 100 yrs old

160
Q

Which telephone lines applies to SG’s DNC registry?

A

Fixed residential lines and business numbers (a telemarketer May target a CEO and call him or her at his office line).

161
Q

What kind of records are exempted by PDPA?

A

Personal data that is in a record more than 100 yrs old

162
Q

Which telephone lines applies to SG’s DNC registry?

A

Fixed residential lines and business numbers (a telemarketer May target a CEO and call him or her at his office line).

163
Q

The following are requirements under the SG DNC registry rules except:

A

Providing opt in consent at point of collection.

Real requirements: Organisations must check against DNC registry within 30 days before doing marketing unless they have clear and unambiguous consent in evidential form, display their ID, contact info and originating number.

164
Q

What are the exceptions to getting consent in Singapore?

A
  • Emergency situation
  • Publicly available data
  • When the information consists of documents produced for employment business or professional purposes (eg. a business contract which involves personal data)
  • When two companies merge or there is an acquisition (business asset transactions)
165
Q

Which of the following does not apply when managing opt outs?

A

Clear and unambiguous consent required under the Consent obligation (as this is under the DNC provisions not Consent).

Fresh consent for new purposes is required under the consent obligation and purpose Limitation obligation.

166
Q

Is there a common law tort of invasion of privacy in Hk or SG?

A

No

167
Q

Which are the ways in which there is constitutional protection of privacy in HK?

A
  • Basic Law specifically provides the protections in relation to privacy
  • HK’s Bill of Rights Ordinance
  • Basic Law (1990) provides for the application of the ICCPR
168
Q

Does the PDPO distinguish between automated and non automated data or processing?

A

No

169
Q

How is “person” defined in HK PDPO?

A

Includes any public body and any body of persons, corporate or unincorporate

170
Q

What is the definition of a data user?

A

A person who, either alone or jointly or in common with other persons, controls and collection, holding, processing or use of the data

171
Q

Is fabricated or untrue data relating to an individual considered as personal data under Hk PDPO?

A

No.

However biometric data, mobile phone numbers and exam scripts on their own will not be considered personal data unless coupled with other personally identifiable information.

172
Q

What are the key amendments in the Personal Data (Privacy) (Amendment) Ordinance 2012?

A

The Amendment Ordinance changes took effect on 1 Oct 2012 :

  • use of personal data for direct marketing (new sections 35B to 35H)
  • provision of personal data to another for use in direct marketing (new sections 35I and 35M)
  • exclusions for social services, welfare dept, health care services
  • disclosure of personal data obtained without consent
  • regulating data processors
  • enforcement notices
  • legal assistance for aggrieved individuals
173
Q

What is a general vs partial exemption under Hk PDPO?

A

General exemption: personal data held for domestic or recreational purposes

Partial exemption: publicly available data, employment related matters, legal proceedings and legal privilege

174
Q

What are the constitutional protections that may relate to privacy in India?

A

Constitution of India does not contain any express provisions on the right to privacy. It is only implicit in two fundamental rights of the India Constitution:

  • Right to freedom of speech and expressions (Art 19(1)(a))
  • Right to life and personal liberty (Article 21)

Other Constitutional Protections

  • The Right to Information Act 2005
  • The Protection of Human Rights Act 1993
175
Q

Section 43A and the 2011 Rules are also know as

A

Reasonable security practices and procedures

176
Q

Which of the three jurisdictions has a code of practice for the national ID?

A

PCPD Code of Practice on ID card numbers and other personal identifiers

177
Q

Section 43A and the 2011 Rules are also know as

A

Reasonable security practices and procedures

178
Q

Which of the three jurisdictions has a code of practice for the national ID?

A

PCPD Code of Practice on ID card numbers and other personal identifiers

CIPP/A (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions