The Consent Obligation – changes as the good, the bad and the ugly?

On 2 November 2020, the Singapore Parliament passed the Personal Data Protection (Amendment) Bill 2020. There are numerous changes that relate to the Consent Obligation in the Personal Data Protection Act, the PDPA.

Here we will go back to basics first – some 'Consent 101' – and then go through the proposed changes to the Consent Obligation under the PDPA. In a separate paper, we will look at changes to the exceptions to the need for consent under the PDPA and the addition of new exceptions to the need for consent.

Consent 101

When it published its enforcement decision in a case involving the German European School Singapore (GESS) in June 2019, the Commission made the following points clear about various types of consent:

1. Express consent – where there is express consent an individual specifically signs up – or clicks, say, 'submit' as the electronic equivalent to signing – to something like 'I hereby consent to ________ '

2. Implied consent – as lawyers, we sometimes call this 'consent by conduct'

In the GESS case, the Commission found that by signing to confirm agreement with the school's by-laws annually the student's parent(s) gave implied consent to the rule in those bylaws that provided for random drug testing of students. 

In our everyday lives we may often give implied consent without really knowing that we are doing so. For example, when we receive a new credit card the terms and conditions will always say something like 'By your first use of this credit card, you consent to / accept our terms and conditions of use'.

3. Deemed consent – in the GESS case, the Commission made it clear that deemed consent under the PDPA is 'consent by operation of law'. This means that if the conditions set out in the PDPA are satisfied, consent is given irrespective of the intention of an individual. By contrast, under both express consent and implied consent there is an actual consent with an intention to give it (even while the individual may not be conscious of it in the case of an implied consent).

There are two sets of conditions in which deemed consent operates under the PDPA at present:

(1) first party deemed consent – where

(a) the individual voluntarily provides personal data for a purpose and

(b) it is reasonable that the individual would voluntarily provide personal data for that purpose and

(2) third party deemed consent – where

(a) an individual gives, or is deemed to have given, consent to the disclosure of personal data about the individual by one organisation (a 'disclosing organisation') to another organisation (a 'recipient organisation') for a particular purpose and

(b) the recipient organisation may collect, use or disclose that personal data for that particular purpose

Express consent can be given on either an 'opt-in' basis or on an 'opt-out' basis. (Perhaps there could be occasions when an opt-out basis might apply to implied consent, but examples do not