Two organisations were issued directions for breaching the PDPA and another one issued a warning.

Friends Provident International was issued a warning for failing to protect the personal data of its policyholders from unauthorised disclosure via its online portal.

A financial penalty of $5,000 was imposed on Executive Link Services for failing to appoint a data protection officer (DPO) and not having written policies and practices to comply with the PDPA.

Directions, including a financial penalty of $10,000, were imposed on O2 Advertising for failing to put in place reasonable measures to protect individuals' personal data collected from an advertising campaign and did not cease retention of such data when it was no longer required. The organisation was also directed to appoint a DPO and put in place data protection policies and practices.

Access the Decisions here.