【跨境合规】新加坡《个人信息保护法》（PDPA ）中英对照摘录（四）

第四章 收集、使用和披露个人数据

第 1 节：同意

13. 取得同意

自 2014 年 7 月 2 日起，组织不得收集、使用或披露相关个人数据，除非符合以下情形：

 (a) 个人根据本法同意或被视为同意收集、使用或披露 (视情况而定)；

 (b) 根据本法以及其他成文法要求或授权而在无需个人同意的情况下收集、使用或披露信息 (视情况而定)。

14. 同意的作出

(1) 存在下列情形的，方视为个人同意某组织为某种目的收集、使用或披露其个人数据：

  (a) 个人已获知本法第 20 条规定所需提供的信息； 

  (b) 个人依据本法针对该目的作出同意。

(2) 组织不得实施以下行为：

  (a) 将个人同意收集、使用或披露其个人数据作为提供产品或服务的条件，且所要求收集、使用或披露的数据范围超出向该个人提供产品或服务所需的合理范围；  (b) 针对个人数据的收集、使用或披露事项提供虚假或具有误导性信息，或是采用欺骗、误导手段，获取或试图获取相关收集、使用、披露行为的同意。

(3) 个人在第 (2) 款任一情形下作出的同意，依据本法均属无效同意。 

(4) 在本法中，所称个人针对自身个人数据的收集、使用或披露作出同意或被视为同意，包括任何有权代表该个人行事之人，代表该个人就上述个人数据的收集、使用或披露作出同意或被视为同意。

15. 视为同意

(1) 满足以下条件的，视为个人同意某组织为特定目的收集、使用或披露其个人数据： 

(a) 个人虽未作出第 14 条所规定的明示同意，但自愿向该组织提供个人数据用于该目的；并且 (b) 个人自愿提供该数据具有合理性。 

(2) 若个人同意或被视为同意某组织为特定目的向另一组织披露其个人数据，则视为该个人同意另一组织为该特定目的收集、使用或披露该个人数据。 

(3) 在不限制第 (2) 款适用且遵守第 (9) 款规定的前提下，个人 (P) 为与组织 (A) 订立合同而向 A 提供个人数据，若相关行为对于订立 P 与 A 之间的合同具备合理必要性，则视为该个人同意下列事项： (a) A 向另一组织 (B) 披露该个人数据； (b) B 收集并使用该个人数据； (c) B 再向其他组织披露该个人数据。 [2020 年第 40 号法案] 

(4) 某组织依据第 (3) 款 (c) 项从 B 处获取被披露的个人数据的，视同该数据由 A 依据第 (3) 款 (a) 项向该组织披露，第 (3) 款 (b) 项、(c) 项适用于该组织。 [2020 年第 40 号法案] 

(5) 个人为与组织订立合同，在 2021 年 2 月 1 日之前向该组织提供个人数据，满足下列任一情形的，适用第 (3) 款、第 (4) 款： (a) 合同订立于 2021 年 2 月 1 日当日或之后；或者 (b) 合同于 2021 年 2 月 1 日之前订立，并在该日期仍然有效； 并且推定第 (3) 款、第 (4) 款： (c) 在个人提供该数据之时已经生效； (d) 持续有效至 2021 年 2 月 1 日。 [2020 年第 40 号法案] 

(6) 在不限制第 (2) 款适用且遵守第 (9) 款规定的前提下，个人 (P) 与组织 (A) 订立合同，并依据合同或与合同相关向 A 提供个人数据的，视为该个人同意下列事项： (a) A 向另一组织 (B) 披露该个人数据，且该披露具备合理必要性： (i) 为履行 P 与 A 之间的合同；或者 (ii) 为订立或履行 A 与 B 之间的合同，该合同系应 P 要求订立，或者理性普通人会认为该合同符合 P 的利益； (b) B 收集、使用该个人数据，且该收集、使用对于实现 (a) 项所列任一目的具备合理必要性； (c) B 向其他组织披露该个人数据，且该披露对于实现 (a) 项所列任一目的具备合理必要性。 [2020 年第 40 号法案]

 (7) 某组织依据第 (6) 款 (c) 项从 B 处获取被披露的个人数据的，视同该数据由 A 依据第 (6) 款 (a) 项向该组织披露，第 (6) 款 (b) 项、(c) 项适用于该组织。 [2020 年第 40 号法案] 

(8) 个人在 2021 年 2 月 1 日之前，基于一份此前已订立、且在 2021 年 2 月 1 日仍然有效的合同向组织提供个人数据的，推定第 (6) 款、第 (7) 款： (a) 在个人提供该数据之时已经生效； (b) 持续有效至 2021 年 2 月 1 日，相关情形适用第 (6) 款、第 (7) 款。 [2020 年第 40 号法案] 

(9) 第 (3)、(4)、(5)、(6)、(7)、(8) 款不影响 P 与 A 之间合同约定的下列义务： (a) 约定 A 可向其他组织披露的、由 P 提供的个人数据范围；或者 (b) 约定 A 可向其他组织披露 P 提供的个人数据的目的。 [2020 年第 40 号法案]

第 15A 条 通知型视为同意

(1) 本条适用于组织在 2021 年 2 月 1 日当日及之后开展的个人数据收集、使用或披露活动。 [2020 年第 40 号法案] 

(2) 在不违反第 (3) 款的前提下，同时满足以下条件的，视为个人同意组织收集、使用或披露其个人数据： (a) 该组织满足第 (4) 款各项要求；并且 (b) 个人未在第 (4) 款 (b)(iii) 项规定期限届满前通知该组织，表明不同意组织拟实施的个人数据收集、使用或披露行为。 [2020 年第 40 号法案] 

(3) 第 (2) 款不适用于为任何法定指定目的收集、使用或披露个人数据的情形。 [2020 年第 40 号法案] 

(4) 为适用第 (2) 款 (a) 项，组织在收集、使用或披露个人数据前，应当： (a) 开展评估，认定拟实施的个人数据收集、使用或披露行为不大可能对个人造成不利影响； (b) 采取合理措施，使个人知悉以下信息： (i) 组织拟收集、使用或披露个人数据的意向； (ii) 收集、使用或披露个人数据的目的； (iii) 个人可在合理期限内、以合理方式通知组织，表示不同意组织拟开展的个人数据收集、使用或披露； (c) 满足其他法定要求。 [2020 年第 40 号法案]

(5) 针对第 (4) 款 (a) 项所述评估，组织应当： (a) 识别基于相关目的拟收集、使用或披露个人数据可能给个人带来的任何不利影响； (b) 制定并落实合理措施，实现下列任一目标： (i) 消除不利影响； (ii) 降低不利影响发生概率；或者 (iii) 减轻不利影响； (c) 遵守其他法定要求。 [2020 年第 40 号法案]

16. 撤回同意

(1) 个人向组织发出合理通知后，可随时撤回依据本法作出或被视为作出的、针对该组织为任一目的收集、使用、披露其个人数据的同意。 

(2) 组织收到第 (1) 款所述通知后，应当告知个人撤回同意可能产生的后果。 

(3) 组织不得禁止个人撤回针对个人数据收集、使用或披露的同意，但本条不影响撤回同意所产生的一切法律后果。 

(4) 除本法第 25 条另有规定外，个人撤回同意的，除非依据本法或其他成文法规定无需个人同意即可开展相关活动，组织应当停止（并要求其数据中介、代理人停止）收集、使用或披露该个人数据（视情形而定）。

17. 未经同意的收集、使用和披露

(1) 组织可实施下列行为：

   (a) 在附表 1 或附表 2 第 1 部分规定的情形、目的范围内并遵守相应条件，未经个人同意，或从个人以外渠道收集个人数据；

   (b) 在附表 1 或附表 2 第 2 部分规定的情形、目的范围内并遵守相应条件，未经个人同意使用个人数据； 

   (c) 在附表 1 或附表 2 第 3 部分规定的情形、目的范围内并遵守相应条件，未经个人同意披露个人数据。 [2020 年第 40 号法案] 

(2) 除本法另有规定外： 

   (a) 组织可接收他人向其披露的个人数据并予以收集，前提为： (i) 该披露发生于 2021 年 2 月 1 日当日或之后，且符合第 (1) 款 (c) 项；或者 (ii) 该披露发生于 2021 年 2 月 1 日之前，且符合当时有效的第 17 (3) 条，使用目的与披露目的保持一致，或是第 (1) 款 (a) 项允许的目的；

   (b) 组织可使用或披露个人数据，前提为： (i) 该数据由组织于 2021 年 2 月 1 日当日或之后依据第 (1) 款 (a) 项收集；或者 (ii) 该数据由组织于 2021 年 2 月 1 日之前依据当时有效的第 17 (1) 条收集，使用、披露目的与原始收集目的保持一致，或是第 (1) 款 (b) 项、(c) 项允许的目的（视情况而定）。

PART4 COLLECTION,USE AND DISCLOSURE OF PERSONAL DATA

Division 1—Consent

13. Consent required

An organisation must not,on or after 2 July 2014,collect,use or disclose personal data about an individual unless—

(a)the individual gives,or is deemed to have given,his or her consent under this Act to the collection,use or disclosure,as the case may be;or

(b)the collection,use or disclosure(as the case may be)without the individual's consent is required or authorised under this Act or any other written law.

14. Provision of consent

(1)An individual has not given consent under this Act for the collection,use or disclosure of personal data about the individual by an organisation for a purpose unless—

(a)the individual has been provided with the information required under section 20;and

(b)the individual provided his or her consent for that purpose in accordance with this Act.

(2)An organisation must not—

(a)as a condition of providing a product or service,require an individual to consent to the collection,use or disclosure of personal data about the individual beyond what is reasonable to provide the product or service to that individual;or

(b)obtain or attempt to obtain consent for collecting,using or disclosing personal data by providing false or misleading information with respect to the collection,use or disclosure of the personal data,or using deceptive or misleading practices.

(3)Any consent given in any of the circumstances in subsection(2)is not validly given for the purposes of this Act.

(4)In this Act,references to consent given,or deemed to have been given,by an individual for the collection,use or disclosure of personal data about the individual include consent given, or deemed to have been given,by any person validly acting on that individual's behalf for the collection,use or disclosure of such personal data.

15. Deemed consent

(1)An individual is deemed to consent to the collection,use or disclosure of personal data about the individual by an organisation for a purpose if—

(a)the individual,without actually giving consent mentioned in section 14, voluntarily provides the personal data to the organisation for that purpose;and

(b)it is reasonable that the individual would voluntarily provide the data.

(2)If an individual gives,or is deemed to have given,consent to the disclosure of personal data about the individual by one organisation to another organisation for a particular purpose, the individual is deemed to consent to the collection,use or disclosure of the personal data for that particular purpose by that other organisation.

(3)Without limiting subsection(2)and subject to subsection(9),an individual(P)who provides personal data to an organisation(A)with a view to P entering into a contract with A is deemed to consent to the following where reasonably necessary for the conclusion of the contract between P and A:

(a)the disclosure of that personal data by A to another organisation(B);

(b)the collection and use of that personal data by B;

(c)the disclosure of that personal data by B to another organisation.

[40/2020]

(4)Where an organisation collects personal data disclosed to it by B under subsection(3)(c), subsection(3)(b)and(c)applies to the organisation as if the personal data were disclosed by A to the organisation under subsection(3)(a).

[40/2020]

(5)Subsections(3)and (4)apply to personal data provided before 1 February 2021 by an individual to an organisation with a view to the individual entering into a contract with the organisation—

(a)on or after 1 February 2021;or

(b)which contract was entered into before 1 February 2021 and remains in force on that date,

as if subsections(3)and (4)—

(c)were in force when the personal data was so provided;and

(d)had continued in force until 1 February 2021.

[40/2020]

(6)Without limiting subsection(2)and subject to subsection(9),an individual(P)who enters into a contract with an organisation(A)and provides personal data to A pursuant or in relation to that contract is deemed to consent to the following:

(a)the disclosure of that personal data by A to another organisation(B),where the disclosure is reasonably necessary—

(i)for the performance of the contract between P and A;or

(ii)for the conclusion or performance of a contract between A and B which is entered into at P's request,or which a reasonable person would consider to be in P's interest;

(b)the collection and use of that personal data by B,where the collection and use are reasonably necessary for any purpose mentioned in paragraph(a);

(c)the disclosure of that personal data by B to another organisation,where the disclosure is reasonably necessary for any purpose mentioned in paragraph(a).

[40/2020]

(7)Where an organisation collects personal data disclosed to it by B under subsection(6)(c), subsection(6)(b)and(c)applies to the organisation as if the personal data were disclosed by A to the organisation under subsection(6)(a).

[40/2020]

(8)Subsections(6)and(7)apply to personal data provided before 1 February 2021 by an individual to an organisation in relation to a contract that the individual entered into before that date with the organisation,and which remains in force on that date,as if subsections(6) and(7)—

(a)were in force when the personal data was so provided;and

(b)had continued in force until 1 February 2021.

[40/2020]

(9)Subsections(3),(4),(5),(6),(7)and(8)do not affect any obligation under the contract between P and A that specifies or restricts—

(a)the personal data provided by P that A may disclose to another organisation; or

(b)the purposes for which A may disclose the personal data provided by P to another organisation.

[40/2020]

15A. Deemed consent by notification

(1)This section applies to the collection,use or disclosure of personal data about an individual by an organisation on or after 1 February 2021.

[40/2020]

(2)Subject to subsection(3),an individual is deemed to consent to the collection,use or disclosure of personal data about the individual by an organisation if—

(a)the organisation satisfies the requirements in subsection(4);and

(b)the individual does not notify the organisation,before the expiry of the period mentioned in subsection(4)(b)(iii),that the individual does not consent to the proposed collection,use or disclosure of the personal data by the organisation.

[40/2020]

(3)Subsection(2)does not apply to the collection,use or disclosure of personal data about the individual for any prescribed purpose.

[40/2020]

(4)For the purposes of subsection(2)(a),the organisation must,before collecting,using or disclosing any personal data about the individual—

(a)conduct an assessment to determine that the proposed collection,use or disclosure of the personal data is not likely to have an adverse effect on the individual;

(b)take reasonable steps to bring the following information to the attention of the individual:

(i)the organisation's intention to collect,use or disclose the personal data;

(ii)the purpose for which the personal data will be collected,used or disclosed;

(iii)a reasonable period within which,and a reasonable manner by which,the individual may notify the organisation that the individual does not consent to the organisation's proposed collection,use or disclosure of the personal data;and

(c)satisfy any other prescribed requirements.

[40/2020]

(5)The organisation must,in respect of the assessment mentioned in subsection(4)(a)—

(a)identify any adverse effect that the proposed collection,use or disclosure of the personal data for the purpose concerned is likely to have on the individual;

(b)identify and implement reasonable measures to—

(i)eliminate the adverse effect;

(ii)reduce the likelihood that the adverse effect will occur;or

(iii)mitigate the adverse effect;and

(c)comply with any other prescribed requirements.

[40/2020]

16. Withdrawal of consent

(1)On giving reasonable notice to the organisation,an individual may at any time withdraw any consent given,or deemed to have been given under this Act,in respect of the collection, use or disclosure by that organisation of personal data about the individual for any purpose.

(2)On receipt of the notice mentioned in subsection(1),the organisation concerned must inform the individual of the likely consequences of withdrawing his or her consent.

(3)An organisation must not prohibit an individual from withdrawing his or her consent to the collection,use or disclosure of personal data about the individual,but this section does not affect any legal consequences arising from such withdrawal.

(4)Subject to section 25,if an individual withdraws consent to the collection,use or disclosure of personal data about the individual by an organisation for any purpose,the organisation must cease(and cause its data intermediaries and agents to cease)collecting,using or disclosing the personal data(as the case may be)unless such collection,use or disclosure(as the case may be)without the individual's consent is required or authorised under this Act or other written law.

17. Collection,use and disclosure without consent

(1)An organisation may —

(a)collect personal data about an individual,without the individual's consent or from a source other than the individual,in the circumstances or for the purposes,and subject to any condition,in the First Schedule or Part 1 of the Second Schedule;

(b)use personal data about an individual without the individual's consent,in the circumstances or for the purposes,and subject to any condition,in the First Schedule or Part 2 of the Second Schedule;or

(c)disclose personal data about an individual without the individual's consent,in the circumstances or for the purposes,and subject to any condition,in the First Schedule or Part 3 of the Second Schedule.

[40/2020]

(2)Unless otherwise provided under this Act,an organisation may—

(a)collect personal data about an individual that the organisation receives by way of a disclosure to the organisation—

(i)on or after 1 February 2021 in accordance with subsection(1)(c); or

(ii)before 1 February 2021 in accordance with section 17(3)as in force before that date,for purposes consistent with the purpose of that disclosure,or for any purpose permitted by subsection(1)(a); or

(b)use or disclose personal data about an individual that—

(i)is collected by the organisation on or after 1 February 2021 in accordance with subsection(1)(a);or

(ii)was collected by the organisation before 1 February 2021 in accordance with section 17(1)as in force before that date,for purposes consistent with the purpose of that collection,or for any purpose permitted by subsection(1)(b)or(c),as the case may be.

[40/2020]