More clarity sought over data privacy concession

Proposal allows use of Web-linked devices' data without consent

Experts are seeking greater clarity over a proposed concession that allows businesses to collect and use the personal data of consumers without their consent, if it is impractical to secure such permission.

The concession, which is going through a public consultation, will help businesses in the Internet of Things (IoT) space, allowing Web-connected devices like security cameras and refrigerators to glean data such as images, purchasing habits, payment details and names.

The Personal Data Protection Commission, however, will require these businesses to put up a notice on the purpose of the collection.

Lawyer Gilbert Leong, senior partner at Dentons Rodyk & Davidson, said it is not clear if businesses can overcollect data and then later put up a notice as a remedy.

"It would be preferable for the law to explicitly state that such a practice is not allowed to prevent abuse of the system," he said.

Mr Leong also said it is desirable to state that such notices have to be "effective" so consumers can easily find them, rather than allow notices to be obscurely buried in webpages, or not readily accessible or understood.

For instance, American firm iRobot, which makes the Roomba robotic vacuum cleaner, is now caught in a privacy row after its chief executive suggested earlier this week it might start selling the floor plans of customers' homes.

MAKE IT CLEAR

It would be preferable for the law to explicitly state that such a practice is not allowed to prevent abuse of the system.

LAWYER GILBERT LEONG, who said that it is not clear if businesses can overcollect data and then later put up a notice on the purpose of the collection as a remedy.

Floor plans may not be considered personal data, but the autonomous vacuum cleaners are fitted with cameras, which may allow images, including those of the homes' occupants, to be captured.

TSMP Law Corporation's joint managing director Thio Shen Yi warned about companies' potential liability when data is misused by the IoT or artificial intelligence (AI) systems.

"The interface between technology and personal privacy can be quite complex," he said.

While these systems can be programmed to prohibit the sharing or selling of data to a blacklist, AI systems can "learn", draw conclusions and develop further algorithms in a way that may not have been predicted by the original programmer.

But the upside from advances in this space cannot be ignored, said some.

Yesterday, Minister for Communications and Information Yaacob Ibrahim said that data sharing can generate value for consumers and spur Singapore's growth in the digital economy. In the future, for instance, a Web-enabled refrigerator maker could share a customer's grocery consumption with a smart-TV maker, which could use the data to display relevant advertisements on the TV screen.

Today, car insurance firms share the data of drivers with good records to allow them to benefit from lower premiums even if the drivers switch insurers. "These examples merely scratch the surface of what is possible with greater sharing of data," said Dr Yaacob.

A version of this article appeared in the print edition of The Straits Times on July 28, 2017, with the headline 'More clarity sought over data privacy concession'. Print Edition | Subscribe