Since 2012, Singapore’s policy and regulation frameworks for data protection and privacy have undergone revisions and updates to reflect the changing digital landscape. The Personal Data Protection Act (PDPA) 2012 and a subsequent amendment to the Act, the Personal Data Protection (Amendment) Act 2020, established a general data protection law in Singapore which governs the collection, use, and disclosure of individuals’ personal data.⁸⁴ The Personal Data Protection Commission (PDPC) oversees the enforcement and administration of data protection policies and laws in Singapore. Through the PDPA, the PDPC mandates all private entities to recognize both the right of individuals to protect their personal data and the need of organizations to collect, use, and disclose personal data.

The PDPA contains two main sets of provisions with which private organizations are required to comply: one covers data protection, and the other the Do Not Call Registry, which allows individuals to opt out from receiving marketing messages on their phones. The amendments in 2020 introduced stronger protections for processing personal data through a revised consent framework based on legitimate interests and business improvements, and new data portability obligations, in line with similar regulations laid out in the EU’s GDPR.⁸⁵ It also aimed to strengthen accountability through mandatory data breach notifications and enhanced the enforcement powers of the PDPC. Other related laws and regulations put forth by the PDPC include the Personal Data Protection Regulations 2021.

Singapore participates in multiple digital economy frameworks. It concluded a Digital Economy Partnership Agreement (DEPA) with Chile and New Zealand in 2020, the same year Singapore and Australia’s Digital Economy Agreement (DEA) entered into force. Recently, Singapore concluded its DEA negotiations with the United Kingdom and South Korea.⁸⁶ Singapore has also signed the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) and the Regional Comprehensive Economic Partnership (RCEP).

Overall, these digital partnerships and agreements serve to facilitate regional and multilateral free trade and address digital trade issues to enhance Singapore’s competitiveness. DEAs allow Singapore to “align digital rules and standards and facilitate interoperability between digital systems”⁸⁷ of the countries involved in digital trade, especially for data flows. Cross-border data flows are critical to an increasingly digitalized world, and especially in the fast-rising digital economies of Southeast Asia. ASEAN member states are expected to gain a dramatic economic boost from digital trade and e-commerce, adding approximately USD1 trillion to their overall gross domestic product by 2030.⁸⁸ However, with such optimism comes practical challenges in safeguarding personal data and consumer rights. 

As Singapore punches above its weight in setting the stage for the region’s overall digital economy, it has advocated for regulatory and regional frameworks to preserve the core tenets of data privacy and security. Through its minister of communications and information and minister-in-charge of cybersecurity, Singapore plays an active role at the ASEAN Digital Ministers Meeting to shape ongoing digital initiatives that include the ASEAN Data Management Framework,⁸⁹ Model Contractual Clauses for Cross Border Data Flows⁹⁰, ASEAN CERT Information Exchange Mechanism, and the Digital Masterplan 2025.⁹¹

Usage and impact

Data is at the heart of Singapore’s ambition to become a leading Smart Nation in the Asia Pacific. But to understand the inherent socio-economic value of data for Singapore, one must take two broad views. First, data as the primary commodity fueling Singapore’s rapid growth in the digital economy. Second, data as an integral factor to the city-state’s formulation, implementation, and evaluation of public policies.

Data for digital economy

As mentioned, Singapore has been very proactive in signing up to various bilateral DEAs and regional trade arrangements to facilitate data transfers, research and development, and institutional collaboration to support its digital economy. In a study published by the Asian Development Bank over a two-decade period (Period 1: 2000–2012 and Period 2: 2014–2019) on the contribution of the digital economy to select countries’ GDP, Singapore recorded the largest digital economy in terms of GDP share in Southeast Asia, averaging at 8.2 percent from 2000 to 2010.⁹² Notwithstanding its slight dip to 6.8 percent from 2014 to 2019, the study concludes that digital products and industries will continue to make a substantial contribution to Singapore’s overall economic activities.⁹³

Despite the onslaught of the COVID-19 pandemic, Singapore’s digital economy bounced back in 2021 with a 35 percent growth amounting to a Gross Merchandise Value (GMV) of USD15 billion from USD11 billion in 2020. If the current trend of economic recovery persists, Singapore might be on track to reach a GMV of USD27 billion by 2025.⁹⁴ With a regional average of 80 percent, Singapore has the highest share of digital consumers out of all internet users per country in Southeast Asia at 97 percent, due to increasing usage of digital services in the e-commerce and digital financial services sector.⁹⁵ Pre-pandemic, 10 percent of Singapore’s GDP was derived from digital products and services like cloud services, Internet of Things (IoT), and Artificial Intelligence (AI).⁹⁶ In the post-pandemic era, Singapore’s capacity to generate, capture, and use data will determine the continuing viability of its digital economy, and based on the trends assessed, its data generation is heading inexorably upward. As the world’s leading digital hub for business, finance, transportation, logistics, and advanced manufacturing and technology, Singapore’s sustained reliance on and integration of highly interconnected platforms from AI, IoT, Blockchain, to 5G will only accelerate its production of high densities of data. Combined with its digital capital of talent, skills, resources, and digital infrastructure, Singapore is well-positioned to develop new forms of technology and applications.⁹⁷

Data for public policy

The Organisation for Economic Co-operation and Development (OECD) considers data as a strategic asset which can be applied in practical ways that create public value in three areas—anticipation and planning, delivery, and evaluation and monitoring—making the case for data-driven policymaking in the public sector.⁹⁸ In other cases, big data analytics allow governments to improve resource optimization, tax collection, and forecasting and predicting.⁹⁹

Data has been foundational to Singapore’s formulation, implementation, and evaluation of public policies, shaping the government’s governance structure, management, and operations. The OECD identified Singapore’s Fusion AnalyticS for public Transport Emergency Response (FASTER) initiative as a case study on data’s public value in addressing emergencies, crises, and developing situations in the context of overcrowded and ageing transport infrastructure. Through FASTER’s anonymized location-based information combined with traffic feeds, Singaporean authorities can draw insights from transport networks, enabling the deployment of additional buses or advisories to customers when large crowds are detected.¹⁰⁰

Data science tools such as real-time data, data visualization, and machine learning are also being used for evidence-based policymaking. Other examples of how Singapore harnesses data to design and evaluate public policies include Pulse of the Economy, launched by the Government Technology Agency of Singapore (GovTech), which uses high-frequency big data drawn from rail systems, electricity consumption, social media sentiments and online apps to develop new indicators for economic and urban planning.¹⁰¹ Singapore’s Smart Nation initiative has also made Open Government Data available, allowing publicly available datasets from 70 public agencies, geospatial resources, and e-services tools to be used to create data-driven solutions.¹⁰²

Challenges and prospects

As the promise of data becomes deeply embedded in Singapore’s socio-economic progress and governance processes, key concerns and risks over data privacy and security have also started to surface.

Gaps in data governance regime and incidents of data breaches

In recent years, the Singaporean government has allowed commercial businesses and tech developers to access citizens’ data through the Open Data Resources portal. Under its Smart Nation strategy, which includes the National Digital Identity, e-payments, and the Smart Nation Sensor Platform, Singapore has utilized common and open platforms like the MyInfo app to create an integrated ecosystem that facilitates seamless digital transactions for public and private services.¹⁰³ Under the updated PDPA, local companies and organizations can use consumer data without prior consent. This means that local businesses can use, collect, and disclose data for legitimate purposes like business improvement and research and development.¹⁰⁴

The government’s Smart Nation strategy has faced intense scrutiny following the fallout from incidents of data breaches,¹⁰⁵ most notably the SingHealth controversy in 2018 that exposed the medical records of almost two million patients.¹⁰⁶ Additionally, civil society organizations have raised concerns about the “gold rush” surrounding the use of data without clear-cut industry guidelines. The non-profit Internet Society sounded the alarm on the double-edged sword that undergirds the city-state’s rapid digital transformation.¹⁰⁷ On the one hand, companies in Singapore are very enthusiastic in collecting and extracting data to generate new business models, while on the other hand, the collection process can be very invasive, and even extends to mundane and trivial transactions.¹⁰⁸ This raises severe issues over surveillance, especially among consumers who lack knowledge about the extent and reach of industry’s data extraction.¹⁰⁹

In response, the government rolled out the Trusted Data Sharing Framework to reinforce consumer confidence that sharing datasets among businesses adheres to legal, technical, and regulatory standards and methodologies. The Infocomm Media Development Authority clarified that the framework is only a guide for data-sharing agreements for the industry and not a tool for compliance to the PDPA.¹¹⁰ Adopting the framework, the Association of Banks in Singapore released its Data Sharing Handbook for Banks and Non-Bank Data Ecosystem Partners to produce a common approach in planning and implementing data-sharing arrangements.¹¹¹ The Monetary Authority of Singapore also called for operational resilience among financial organizations through the revised Technology Risk Management Guidelines, which aim to mitigate technology risks and disruptions to businesses and ensure swift recovery.¹¹² The revised guidelines will aid better understanding of cyber risk at the senior management level, dealing with third-party service providers, enhancing cyber threat intelligence and software development, and managing IoT devices.¹¹³ In 2019, the Ministry of Communications and Information also considered including a data portability component as part of the PDPA, to give consumers more control over their data and facilitate interoperability across different sectors to benefit start-ups as well as small and medium-sized businesses.¹¹⁴

Furthermore, the Singaporean government has also beefed up its enforcement of the PDPA. A non-profit group, Nature Society, was fined SGD14,000 (just over USD10,000) due to a data breach in November 2020 which affected the personal data of 5,131 people. The PDPC noted that the organization lacked written policies and practices on data privacy laws and did not have a data protection officer.¹¹⁵ Similarly, in March 2022 Yoshi Mobile was fined SGD21,000 (just over USD15,000) after an investigation revealed that customers’ personal data had been exploited without their consent for financial gain.¹¹⁶

Despite these interventions and initiatives, the ambiguity surrounding data-sharing remains a key concern in Singapore’s growing debate on data privacy and security. One main area of contention is the exclusion of the public sector from the country’s data protection act. Public sector agencies are expected to comply with a different set of mechanisms and guidelines under the Government Instruction Manual on Infocomm Technology and Smart Systems Management and the Public Sector (Governance) Act.

Erosion of public trust

Public worries on data privacy and security reached a fever pitch at the height of the COVID-19 pandemic, crystallized by the controversy over the TraceTogether app.¹¹⁷ Concerns and criticisms have erupted over the Singaporean government’s use of the app beyond its original purpose of contact tracing.¹¹⁸

Contrary to its initial claims, the government soon admitted that the data collected by the contact-tracing cloud solution could also be used for law enforcement under the Criminal Procedure Code.¹¹⁹ Minister of State for Home Affairs and Sustainability and the Environment Desmond Tan admitted in Parliament that the Singapore Police Force can obtain TraceTogether data for criminal investigations.¹²⁰ Although he assured the public that strict measures were being enforced to safeguard personal data, the government’s backtracking on its initial claims led some users to delete the app.¹²¹

This has undermined the Singaporean government’s credibility, especially among vulnerable groups like migrant workers who were mandated to install the app.¹²² This latest controversy has put the spotlight on Singapore’s broader Smart Nation initiatives, and specifically on longstanding issues of trust and privacy vis-à-vis data surveillance. The state’s extensive reach has been painted as “big government” possessing techno-authoritarian power.¹²³

The controversy over the TraceTogether app has exposed growing public concern about increased surveillance. In retrospect, the public backlash over the TraceTogether app may be symptomatic of the larger challenges that underwrite Singapore’s placing of corporate and political-security interests above the individual’s rights to privacy and the provision of public goods. The perceived lack of transparency on the part of the government has put into question the tradeoffs that come with Singapore’s ambition to become a Smart Nation and growing public expectations of privacy rights.¹²⁴

With its rapid digitalization, Singapore is standing at the crossroads of how to sustain its digital economic growth, while also confronting the growing needs of its society for privacy and transparency.¹²⁵ To its credit, the Singaporean government has paid close attention to the issue, addressing inclusion, gender parity, and the digital divide. It has revised existing laws, and crafted frameworks and guidelines after public consultations with key sectors across society. The Infocomm Media Development Authority (IMDA) has launched the SG Women in Tech initiative to diversify the workforce in the tech industry, as well as the Seniors Go Digital program, to mobilize digital ambassadors and get more senior citizens on board the digital transformation track. Mindful of the resource constraints among small and medium enterprises (SMEs) on cybersecurity capacity, IMDA established the SMEs Go Digital program, which provides consulting chief technology officers to assess and help implement digital plans. A Start Digital pack is also available to provide SMEs with easy-to-deploy digital solutions for a specific contract period.

Despite such practical interventions, it appears that finding the balance between individual privacy and the collective good remains elusive in Singapore’s ongoing digital and data revolution. As the fault lines surrounding data surveillance rupture, there is a growing consensus among the academic experts, industry representatives, and civil society practitioners interviewed for this study that it is imperative that there is a paradigm shift to bridge the current gaps and shortcomings on how data security and privacy is conceived of in the context of Singapore.

Inclusion and equity

The controversy over the TraceTogether app has illuminated the interrelated concepts of digital equity and data citizenship, whereby the citizen’s voice is amplified in order to tackle the potential disruptions of technology, while emphasizing pragmatism to build trust. Digital equity far exceeds the digital divide. The latter perpetuates a binary division between the haves and the have-nots, thus limiting the discussion on access and digital literacy. As mentioned, the Singaporean government has embarked on key initiatives to bridge the gap for vulnerable and underserved communities like women and the elderly, but its top-down approach could be complemented with more bottom-up initiatives to jump-start digital equity.

Framing the current issues and developments in Singapore from a digital equity perspective will empower society to consider more community-based or grass-roots types of approach toward data, beyond its economic value. Digital equity is a far more complex continuum that considers the interaction of social, economic, and technological variations. It means acquiring knowledge, capacity, and mechanisms to bring a whole-of-community approach. The COVID-19 pandemic has further highlighted the gap between the rich and poor in the city-state. The implementation of home-based learning revealed a shortage in household access to digital devices. It also underscored often overlooked yet salient factors, such as the physical environment, connectivity issues, and parenting skills that cannot be addressed merely by the distribution of laptops and tablets.

On data citizenship, experts also evaluated the role of data on public policies and as an economic commodity that should benefit not only tech firms, but the entire community. According to one informant, Singapore’s adoption of the means-testing approach in granting financial assistance based on household income has revealed lapses on inclusivity in the data collection process. It was found that it can disproportionately exclude underserved communities in hard-to-reach areas. This complicates the delivery of social services, which may appear to be good on paper, but is not as efficient in practice. For instance, over-reliance on data captured by digital tools may not provide the whole picture about who deserves financial assistance based on household income. Digital literacy also remains a key challenge in other segments of society. There were instances when families signing up for broadband services ended up paying more because they lacked the digital competency to understand the terms and conditions stipulated in such arrangements.¹²⁶

Sensitivity about using big data for either commercial or public research is further evident when one looks at Singapore’s pursuit of biomedical and health research. Although the current explosion of data in Singapore’s healthcare sector is considered another engine of economic growth, and will help combat the strain of its ageing population on its healthcare system, the issues of research ethics and safeguarding patients’ privacy remain significant challenges.¹²⁷ In spite of the Singaporean government’s proactiveness on its data privacy laws, its selective approach of applying the PDPA, which exempts government agencies and institutions, continues to raise suspicion. In the aftermath of the very public fallout from health-related data breaches in the city-state, an NGO called Big Brother Watch cautioned about the possibility of a further erosion of trust in the government’s ability to secure individual medical health records.¹²⁸

---

Case Study

Data Privacy Controversy surrounding COVID-19 Contact Tracing App 

In March 2020, Singapore launched TraceTogether, its nationwide COVID-19 contact-tracing application. The app uses Bluetooth to ping close contacts, and the information is then encrypted and stored privately. This information would then be decrypted by the Ministry of Health should the user test positive for COVID-19.

The government announced that the use of the app or a similar TraceTogether token for non-smartphone users would be made mandatory. In the initial days following the launch of the app, Vivian Balakrishnan, the minister in charge of Singapore’s Smart Nation initiative said, at a press conference in June 2020, that the “TraceTogether app… and the data generated, is purely for contact-tracing. Period.” However, it was later revealed that the data collected from TraceTogether could be accessed by the police for criminal investigations. At that point, such data had already been used in investigations regarding a murder case.

While such a level of surveillance is not necessarily surprising to Singaporeans, there was anger and displeasure over the fact that the government had made false claims regarding the level of data protection and privacy users of the application received. The government then worked on passing new legislation that would limit police access to contact-tracing data for investigations in seven classes of offenses only.

---

Despite claims of its robust data regulation practices, by at least one metric Singapore was found to still have relatively weak data privacy and security compared to the Philippines.¹²⁹ Singapore’s technocratic approach, which promotes open-data platforms to achieve transformative governance, has also been accused of perpetuating the status quo instead.¹³⁰ There is an expectation that data can spur new ways of tackling social problems, whereas it often reinforces the same structural inequities.¹³¹

Amid growing interest in privacy and consent, advocates of data citizenship have called for a review of the current data-sharing frameworks in Singapore. The distinction between data ownership, control, and management has disintegrated with the growing power of data brokers and controllers. Data controllers have blurred the process of capturing and analyzing data into a single transaction. In any single transaction, the public is dealing with unknown and multiple entities. Citizens can no longer identify or distinguish who controls their data. One informant suggested exploring alternative data approaches to challenge the dominant private-sector driven model, which overwhelmingly benefits big tech companies. Large ICT firms have the tendency to hoard or over-share data that could expose individuals and communities to undue risks without their knowledge or consent. Devising more community-based data arrangements can make the value creation surrounding data more equitable, and that can benefit the larger public compared to the winner-takes-all model of major western-based tech firms.¹³²

To be fair, most of the informants recognized the Singaporean government’s varied initiatives to address issues such as inclusion, access, and diversity, but building human agency starts not just with top-down strategies but also with an empowered community. The Singaporean government has started to organize dialogue oriented around community engagements. It has launched the Alliances for Action, an industry-led coalition of 25 alliances that unites a multi-stakeholder task force from key communities, as well as the private and public sectors.¹³³ It aims to mobilize local communities to identify solutions on complex social problems. But one expert pointed out, “the devil is in the details,” as the government continues to have a heavy hand in selecting the people who participate in these forums, thus influencing the overall outcomes and directions. Nevertheless, multistakeholder activities like Alliances for Action are a good start.¹³⁴

As a concrete way forward, one of the experts stressed the importance of reorienting discussions on data privacy and security to the community level. This involves finding alternative governance structures that can complement state-driven interventions. Creating a network of knowledgeable and aware communities can reframe discussions on digital equity, ensuring stronger buy-in from the public rather than just compliance.

Conclusion

As data-driven technologies mature, their socio-economic value can bring exponential benefits. However, potential harms can also arise from such prospects. For highly industrialized countries like Singapore, the paradox is even more evident and glaring. But despite Singapore’s enthusiasm in embracing data as the backbone of its economy and society in the context of Industry 4.0., it has maintained a pragmatic outlook on its potential benefits, risks, and harms. It has been very methodological in addressing these issues from a regulatory perspective, reinforced by periodic assessments and adjustments of laws, guidelines, and regulations in consultation with the public and the private sectors.

Reflecting on our conversations and consultations with experts on these issues, they seek to advance a more radical paradigm shift that goes beyond regulation or multi-stakeholder consultation, given Singapore’s vast intellectual and social capital. The overwhelming spotlight on a technocratic approach often obfuscates the imperative to arrive at a new social consciousness in the digital age, whereby ordinary citizens are cognizant of their digital rights that transcend offline and online platforms. The proposed paradigm shift necessitates a rethinking of what it means to be a digital citizen or native in the emerging digital society. A digital society where citizens are not only treated as passive subjects but proactive agents who can participate in a meaningful way.

Although imperfect, a community-based approach can lay the foundation for pragmatic and alternative paths towards realizing data governance frameworks that can help achieve data equity and digital citizenship. Embarking on the proposed radical shift will not be easy, especially for Singapore, whose track record of success among its ASEAN peers owes much to its political stability and relatively tight control of both governance and reforms. However Singapore has started to think seriously about such issues and has carefully laid the initial groundwork. The next challenge ahead is finding the right balance between progress and parity to build a profound and equitable digital Singapore.

---

Selected Legal Instruments Related to Data Protection in Singapore

1. Cybersecurity
   The Computer Misuse Act (Cap. 50A) 1993
2. Cybersecurity
   The Cybersecurity Act 2018
3. Data Protection
   Personal Data Protection Act of 2012
4. Data Protection
   Personal Data Protection (Amendment) Act 2020
5. E-Commerce/Trade
   Electronic Commerce Act 2006
6. Sectoral Law
   The Banking Act 1970, revised 2003
7. Sectoral Law
   Code of Practice for Competition in the Provision of Telecommunication Services 2005
8. Sectoral Law
   The Private Hospitals and Medical Clinics Act, revised 1985

---

Endnotes

⁸⁴  Republic of Singapore, “ Personal Data Protection (Amendment) Act 2020,” No. 40, signed November 25, 2020.

⁸⁵ Republic of Singapore, “Personal Data Protection (Amendment) Act 2020.” 

⁸⁶ “Digital Economy Agreements,” Ministry of Trade and Industry Singapore, accessed Apr 6, 2022.

⁸⁷ “Digital Economy Agreements,” Ministry of Trade and Industry Singapore.

⁸⁸ Mark Manantan, “U.S., Japan, and Southeast Asia Cooperation: Building a Data Governance Blueprint,” East West Center Asia Pacific Bulletin, no. 505 (April 30, 2020).

⁸⁹ “ASEAN Data Management Framework: Data governance and protection throughout the data lifecycle,” ASEAN Digital Senior Officials’ Meeting, January 2021.

⁹⁰ “ASEAN Model Contractual Clauses for Cross Border Data Flows,” 2nd ASEAN Digital Senior Officials’ Meeting, January 2021.

⁹¹ MCI, IMDA, and CSA, “1st ASEAN Digital Ministers’ Meeting Approves Singapore-led Initiatives on ASEAN Data Management Framework, ASEAN Model Contractual Clauses for Cross Border Data Flows and ASEAN CERT Information Exchange Mechanism,” press release, January 22, 2021.

⁹² Capturing the Digital Economy: A Proposed Measurement Framework and its Applications; a Special Supplement to Key Indicators for Asia and the Pacific 2021, (Philippines: Asian Development Bank, August 2021), 32-33.

⁹³ Asian Development Bank, Capturing the Digital Economy: A Proposed Measurement Framework and its Applications; a Special Supplement to Key Indicators for Asia and the Pacific 2021, 33-34.

⁹⁴ Aadarsh Baijal, Alessandro Cannarsi, Florian Hoppe, Willy Chang, Stephanie Davis, and Rohit Sipahimalani, “e-Conomy SEA 2021,” Bain & Company, November 10, 2021.

⁹⁵ Ibid.

⁹⁶ Singapore News Center, “Digital transformation to contribute US$10 billion to Singapore GDP by 2021,” Microsoft, February 21, 2018. 

⁹⁷ “Digital Capitals Singapore Report,” Digital Reality, November 2019.

⁹⁸ OECD, “The application of data in the public sector to generate public value,” in The Path to Becoming a Data-Driven Public Sector, OECD Digital Government Studies, (Paris: OECD Publishing, 2019).

⁹⁹ Diaan-Yi Lin and Vidhya Ganesan, “Using Data to Create Better Government,” Civil Service College Singapore 16, January 19, 2017.

¹⁰⁰ OECD, “The application of data in the public sector to generate public value.”

¹⁰¹ Do Hoang Van Khanh, “Data Science in Public Policy – The New Revolution,” Civil Service College Singapore 17, June 30, 2017.

¹⁰² “Open Data Resources,” Smart Nation Singapore.

¹⁰³ “Myinfo - A ‘Tell Us Once’ Service that Facilitates Online Transactions for Individuals,” Singapore Government Developer Portal, April 29, 2022. 

¹⁰⁴ Dean Koh, “MyInfo Developer & Partner Portal launched by GovTech for developers and businesses,” OpenGov Asia, November 13, 2017.  

¹⁰⁵ Cristine Lago, “The Biggest data Breaches in Southeast Asia,” CSO, January 18, 2020.  

¹⁰⁶ “Comment: Singapore Data Breach Could Damage Banks’ Health,” Yahoo! News, July 29, 2018. 

¹⁰⁷ Eileen Yu, “Singapore industry Needs Stronger Codes of Conduct as Consumer Data Gains Value,” ZDNet, March 17, 2018. 

¹⁰⁸ Ibid.

¹⁰⁹ Ibid.

¹¹⁰ “Trusted Data Sharing Framework,” Infocomm Media Development Authority of Singapore and Personal Data Protection Commission, 2019.

¹¹¹ “Data Sharing Handbook: For Banks and non-Bank Data Ecosystem Partners,” The Association of Banks in Singapore, August 30, 2021.

¹¹² “Technology Risk Management Guidelines,” Monetary Authority of Singapore, January 2021.

¹¹³ Sin Yee Koh, “Demystifying the MAS’ 2021 Technology Risk Management Guidelines,” Kroll, April 5, 2021.

¹¹⁴ “Public Consultation on review of the Personal Data Protection Act 2012 – Proposed Data Portability and Data Innovation Provisions,” Personal Data Protection Commission Singapore, May 22, 2019.

¹¹⁵ Choo Yun Ting, “Nature Society Fined $14,000 for Personal Protection Breaches,” The Straits Times, January 18, 2022.

¹¹⁶ “Singapore: PDPC Fines Yoshi Mobile SGD 21,000 for Break of Consent and Purpose Limitation Provisions,” DataGuidance, March 11, 2022.

¹¹⁷ Andreas Illmer, “Singapore Reveals Covid Privacy Data Available to Police,” BBC News, January 5, 2021; Kirsten Han, “In Singapore, Covid vs privacy is no contest,” Lowy Institute, The Interpreter, April 7, 2021.

¹¹⁸ Sebastian Strangio, “Singapore Backtracks on COVID-19 Tracking App Privacy Pledge,” The Diplomat, January 7, 2021.  

¹¹⁹ Matthew Mohan, “Singapore Police Force can obtain TraceTogether data for criminal investigations: Desmond Tan,” CNA, January 4, 2021; Han, “In Singapore, Covid vs privacy is no contest.” 

¹²⁰ Mohan, “Singapore Police Force can obtain TraceTogether data for criminal investigations: Desmond Tan.”  

¹²¹ Navene Elangovan and Tan Yin Lin, “Some TraceTogether users upset with Govt’s revelation on police access to data, say they’ll use it less,” Today, January 7, 2021.  

¹²² Kirsten Han, “Singapore is Trying to Forget Migrant Workers are People,” Foreign Policy, May 6, 2020.  

¹²³ Teo Yi-Ling and Muhammad Faizal Abdul Rahman, “Someone to Watch Over Me: Trusting Surveillance in Singapore’s ‘Smart Nation’,” The Diplomat, January 26, 2021. 

¹²⁴ Ibid.

¹²⁵ Stakeholder consultation.

¹²⁶ Stakeholder consultation.

¹²⁷ Harisan Unais-Nasir and Kershia Tan Wei, “Big Data, Big Problems: How Should Singapore Approach the Privacy Challenge of Big Data Research?,” ScholarBank@NUS Repository 1-17, (March 1, 2018). 

¹²⁸ Stakeholder consultation.

¹²⁹ Paul Bischoff, “Data privacy laws & government surveillance by country: Which countries best protect their citizens?,” Comparitech, October 15, 2019.  

¹³⁰ Hallam Stevens, “Open data, closed government: Unpacking data.gov.sg,” March 5, 2019.  

¹³¹ Ibid.

¹³² Stakeholder consultation. 

¹³³ “25 Singapore Together Alliances for Action and Updates,” SG Together, 2021. 

¹³⁴ Davina Tham, “’Steady progress’ in 25 Alliances for Action launched under Singapore Together movement over past year,” CNA, June 26, 2021.