On August 2, 2023, the Personal Data Protection Commission (PDPC) published its decision in Case No. DP-2210-C0378, in which it issued a fine of SGD 120,000 (approx. $90,680) on Keppel Telecommunications & Transportation Ltd. for violation of the Personal Data Protection Act (PDPA) following an investigation.

Background to the decision

The PDPC highlighted that it was notified by Geodis Logistics Singapore Pte. Ltd. (GLS) and Keppel about a data breach incident in October 2022, involving the exfiltration of personal data belonging to GLS. The personal data of 22,659 individuals was affected, including employee and ex-employee details such as passport and bank information, among other data.

Keppel was the sole shareholder of Keppel Logistics Pte Ltd., now known as GLS.

Findings of the PDPC

Following its investigation, the PDPC outlined that the server affected by the data breach belonged to GLS and that although relevant personal data had been migrated to a cloud-based storage solution in May 2020, Keppel did not delete personal data from the affected server after migrating such data to the cloud. The PDPC noted that Keppel had an opportunity to rectify such failure when it divested from GLS in July 2022, but failed to ensure the deletion of data from the affected server.

Accordingly, the PDPC determined Keppel to have violated Article 24 of the PDPA for failing to protect personal data in its possession or control by failing to implement reasonable security arrangements to prevent unauthorized access, collection, use, copying, modification, or disclosure.

Outcomes

In light of the above, the PDPC imposed the abovementioned fine on Keppel for the violation.

You can read the press release here and the decision here.