{"id":1222,"date":"2025-01-30T06:50:26","date_gmt":"2025-01-30T06:50:26","guid":{"rendered":"https:\/\/lexplosion.in\/singapore\/?p=1222"},"modified":"2025-02-14T06:57:01","modified_gmt":"2025-02-14T06:57:01","slug":"navigating-privacy-a-comparative-analysis-of-privacy-laws-in-the-asean-region-part-iii","status":"publish","type":"post","link":"https:\/\/lexplosion.in\/singapore\/navigating-privacy-a-comparative-analysis-of-privacy-laws-in-the-asean-region-part-iii\/","title":{"rendered":"Navigating Privacy: A Comparative Analysis of Privacy Laws in the ASEAN Region (Part III)"},"content":{"rendered":"\n

Summary of the series so far:<\/strong><\/h3>\n\n\n\n

In our first blog<\/a>, we explored an overview of privacy laws in Singapore, Malaysia, and Thailand, setting the foundation for understanding the regulatory landscape in the ASEAN region.<\/p>\n\n\n\n

On our second blog<\/a>, we have discussed the applicability of the Data Protection Acts in Singapore, Malaysia, and Thailand.<\/p>\n\n\n\n

Summary of the series so far:<\/strong><\/h4>\n\n\n\n

Singapore’s Personal Data Protection Act (PDPA) provides a comprehensive framework for safeguarding personal data, balancing privacy rights with data processing needs. It emphasizes consent, accountability, and data retention. The Act applies to organizations handling personal data in Singapore, excluding individuals acting in personal capacities or employees within their employment scope and generally to business contact information.<\/p>\n\n\n\n

Malaysia’s Personal Data Protection Act (PDPA) governs personal data processing in Malaysia, focusing on notice, security, retention, and integrity. It applies to commercial transactions involving personal data, excluding NGOs and archival purposes. It covers individuals and entities in Malaysia, including foreign data processors using Malaysian equipment.<\/p>\n\n\n\n

Thailand’s Personal Data Protection Act (PDPA) regulates the collection, use, and disclosure of personal data within Thailand or for Thai citizens, covering both physical and digital records. It applies to businesses, including those outside Thailand, offering goods\/services to Thai residents. Exemptions include personal use, media activities, and credit bureaus.<\/p>\n\n\n\n

In this instalment, we will detail the definitions and the categories of personal data and data controllers across the Personal Data Protection Act\u2019s in Singapore, Malaysia, and Thailand.<\/p>\n\n\n\n

Definition & Categorization of Personal Data<\/h2>\n\n\n\n

Singapore<\/strong><\/h4>\n\n\n\n

The PDPA \u2013 Singapore defines \u2018personal data\u2019 as information pertaining to an individual, capable of identifying them directly from that information alone or when combined with other accessible data. The term \u201cpersonal data\u201d is construed broadly, encompassing various data types regardless of their veracity, accuracy, or format, whether electronic or otherwise.<\/p>\n\n\n\n

Notably, Singaporean courts have clarified that content of email messages is not considered \u2018personal data\u2019 unless supplemented by additional details about an individual, such as their employment or medical history.[1]<\/a> Similarly, private communications like WhatsApp messages and chats are exempt from this classification and not considered as personal data[2]<\/a>. Conversely, customer databases, including compiled extracts, and communications aimed at identifying or blacklisting specific individuals do fall under the purview of personal data[3]<\/a>. Moreover, information concerning one individual may inadvertently disclose details about another, rendering it personal data for both individuals.[4]<\/a> However, the PDPA \u2013 Singapore does preclude certain categories of data from its application, such as data existing for over 100 years or the business contact information of an individual as mentioned in Part II of this series.<\/p>\n\n\n\n

Malaysia<\/strong><\/h4>\n\n\n\n

The Malaysia PDPA regulates two categories of data:<\/p>\n\n\n\n

(a) personal data and<\/p>\n\n\n\n

(b) sensitive personal data.<\/p>\n\n\n\n

\u201cPersonal data\u201d includes information processed by automated means or recorded in filing systems, which relates to an identified or identifiable individual, incorporating sensitive personal data and opinions about the data subject, but does not include any information that is processed for the purpose of a credit reporting business carried on by a credit reporting agency.<\/p>\n\n\n\n

Conversely, \u201csensitive personal data\u201d relating to a data subject\u2019s health, political views, religious beliefs, criminal record, or alleged commission of any offence is subject to stricter regulation. <\/p>\n\n\n\n

The Act also imposes additional obligations for data controllers with respect to sensitive personal data. Notably, the processing of sensitive personal data mandates explicit consent from the data subject unless an exemption applies. In contrast, for personal data excluding sensitive categories, explicit consent is not compulsory as long as consent obtained from the data subject can be documented and appropriately maintained by the data user.<\/p>\n\n\n\n

Thailand<\/strong><\/h4>\n\n\n\n

\u201cPersonal Data\u201d[5]<\/a> has been defined under PDPA- Thailand to include any information relating to a Person, which enables the identification of such Person, whether directly or indirectly. Additional obligation to obtain explicit consent of data subject is mandated prior to collecting Personal Data specific to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal records, health data, disability, trade union information, genetic data or biometric data[6]<\/a>.<\/p>\n\n\n\n

Personal data can be categorised into general personal data and sensitive personal data, for which different requirements and exemptions apply (e.g. exception of household activity).<\/p>\n\n\n\n

With regards to territorial extent of the law, the PDPA applies to collection, use, and\/or disclosure of personal data by a personal data controller or a personal data processor within Thailand, irrespective of whether such actions occur within the Thailand\u2019s borders.<\/p>\n\n\n\n

Additionally, this law has extra-territorial applicability over entities beyond Thailand borders engaged in collecting, using, and\/or disclosing personal data belonging to individuals \/ data subjects who are in Thailand under two circumstances:<\/p>\n\n\n\n