_commit_at,_commit_hash,_id,_item,_version,_commit,description,tags,date,pdf-url,nature,title,url,timestamp,pdf-content,decision,_item_full_hash,_changed_columns
2023-10-01T11:02:10+08:00,fbd32491db44d3d0c97aa12a99cefd61ec954264,70,70,1,952,"A financial penalty of $5,000 was imposed on BLS International Services Singapore for failing to put in place reasonable security arrangements to prevent the unauthorised disclosure of the personal data of individuals who had submitted a booking for an appointment on its website.","[""Protection"", ""Financial Penalty"", ""Information and Communications"", ""Inadequate scoping of testing"", ""URL manipulation""]",2021-01-14,"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/Decision---BLS-International-Services-Singapore-Pte,-d-,-Ltd,-d-,-30112020-(003).pdf",Protection,Breach of the Protection Obligation by BLS International Services Singapore,https://www.pdpc.gov.sg/all-commissions-decisions/2021/01/breach-of-the-protection-obligation-by-bls-international-services-singapore,2021-01-14,"PERSONAL DATA PROTECTION COMMISSION
Case No. DP-2007-B6563
In the matter of an investigation under section 50(1) of the
Personal Data Protection Act 2012
And
BLS International Services Singapore Pte. Ltd.

SUMMARY OF THE DECISION
1. BLS International Services Singapore Pte. Ltd. (the “Organisation”) provides
government-to-citizen services for the High Commission of India in Singapore, such as
visa and consular services.

2. On 7 July 2020, the Personal Data Protection Commission (the “Commission”) received
information that the URLs of the printable version of appointment booking confirmation
webpages could be manipulated to access other individuals’ personal data (the “Incident”).
The personal data comprised the individual’s name, passport number, contact number,
email address, type of service request, booking date/time, appointment date/time, and
number of booking applications.

3. The Organisation subsequently requested for this matter to be handled under the
Commission’s expedited breach decision procedure. In this regard, the Organisation
voluntarily provided and unequivocally admitted to the facts set out in this decision. It also

admitted that it was in breach of section 24 of the Personal Dara Protection Act (the
“PDPA”).

4. Investigations revealed that on 8 June 2020, which was about a month prior to the Incident,
the Organisation had implemented a new booking system for the High Commission of
India. Under this new booking system, users who submitted a booking for an appointment
at the High Commission of India would be provided with an URL, which led to a printable
version of the booking confirmation. In designing the booking system, the Organisation
had intended for the URLs to be encrypted. This would have made it more difficult for
people to manipulate the URL. However, the encryption was not done properly due to a
coding error. Although the Organisation had conducted some testing on the new booking
system, the testing was not extensive enough to detect the error.

5. Upon realising the occurrence of the Incident from the Commission on 16 July 2020, the
Organisation took immediate action to investigate and subsequently identified the coding
error. On the same day, the Organisation made changes to the booking system. It stopped
providing users with an URL to a printable version of their booking confirmation. Instead,
the booking confirmation would be sent to the user’s email account.

6. The Organisation’s records showed that a total of 3,357 individuals used the new booking
system from 8 June 2020 to 16 July 2020. This meant that the personal data of 3,357
individuals was at risk of exposure by URL manipulation.

7. The Deputy Commissioner for Personal Data Protection found that the Organisation was
in breach of the Protection Obligation under section 24 of the Personal Data Protection Act
2012 for failing to conduct adequate testing of the booking system before it went “live”.
Depending on how the URL encryption was implemented, URL encryption could had been
a reasonable security measure for the personal data type the Organisation was collecting.
However, because the Organisation had not conducted adequate testing of the booking
system before it went “live”, the Organisation did not detect the coding error, thereby
resulting in the Incident.

8. After considering the circumstances of the case, including: (i) the Organisation’s upfront
voluntary admission of liability which significantly reduced the time and resources required
for investigations; and (ii) the Organisation’s prompt remedial actions, the Deputy
Commissioner for Personal Data Protection directs that the Organisation pays a financial
penalty of $5,000 for the breach.

9. The Organisation must make payment of the financial penalty within 30 days from the date
of this direction, failing which interest, at the rate specified in the Rules of Court in respect
of judgment debts, shall accrue and be payable on the outstanding amount of the financial
penalty until it is paid in full.

10. No further directions are required as the Organisation had taken actions to address the gaps
in its security arrangements.

",Financial Penalty,258d44ffd944015c9b8f9f9ffd545a6b10bb6fee,"[""pdf-content"",""timestamp"",""decision"",""pdf-url"",""tags"",""nature"",""url"",""title"",""date"",""description""]"
2023-10-01T11:02:10+08:00,fbd32491db44d3d0c97aa12a99cefd61ec954264,71,71,1,952,"A financial penalty of $9,000 was imposed on The Future of Cooking for failing to put in place reasonable security arrangements to prevent the unauthorised disclosure of its customers’ personal data on its website.","[""Protection"", ""Financial Penalty"", ""Wholesale and Retail Trade"", ""Data Intermediary"", ""Protection"", ""Security""]",2021-01-14,https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/Decision---The-Future-of-Cooking-Pte-Ltd-20112020-(003).pdf,Protection,Breach of the Protection Obligation by The Future of Cooking,https://www.pdpc.gov.sg/all-commissions-decisions/2021/01/breach-of-the-protection-obligation-by-the-future-of-cooking,2021-01-14,"PERSONAL DATA PROTECTION COMMISSION
Case No. DP-2001-B5620
In the matter of an investigation under section 50(1) of the
Personal Data Protection Act 2012
And
The Future of Cooking Pte. Ltd.

SUMMARY OF THE DECISION
1. The Future of Cooking Pte. Ltd. (the “TFC”) operates an e-commerce website at
https://www.thermomix.com.sg (the “Website”), retailing kitchen appliances and
accessories.

2. On 3 January 2020, the Personal Data Protection Commission (the “Commission”)
received a complaint that a text file (the “File”) containing personal data was accessible via
the URL: https://thermomix.com.sg/wp-content/uploads/2019/10/woocommerce-orderexport-1.csv-1.txt. (the “Incident”).

3. The File contained the personal data of 178 unique individuals who had purchased items
from the Website. The File was accessible via the URL from 1 October 2019 until 6 January
2020. It contained the following types of personal data (the “Personal Data”):
a. Name;
b. Email Address;

c. Billing Address;
d. Shipping Address;
e. Customer Notes (e.g. delivery instructions);
f. Order information (such as payment status, mode of payment, and transaction ID);
g. Product ID of items;
h. Quantity of items ordered; and
i. Telephone number.

The Commission’s Findings
No breach by Hachi as a Data Intermediary
4. TFC had engaged Hachi Web Solutions Pte. Ltd. (“Hachi”) to re-design the Website and
also perform data backup and migration. Insofar as the data backup and migration activities
are concerned, Hachi was TFC’s data intermediary. The cause of the breach, however, did
not relate to the data processing activities but to the Website re-design. Therefore, Hachi
was not in breach of the Protection Obligation under section 24 of the Personal Data
Protection Act 2012 (the “PDPA”) by virtue of its role as a data intermediary.

TFC in breach of the Protection Obligation
5. The cause of the data breach may be traced to a WordPress plugin (the “Plugin”) which
was installed on the Website. The Plugin contained a bug which caused the File to be
generated and uploaded on the Website’s directory folder. Although this was a temporary
file, it was accessible to the public via the URL.

6. TFC had used the Website to collect the personal data of individuals. At the time of the
Incident, TFC’s database contained personal data of approximately 3,500 individuals. To
discharge its Protection Obligation under section 24 of the PDPA, TFC needed to have put
in place reasonable security arrangements to protect the personal data collected.

7. In this case, investigations revealed that TFC had failed to discharge its obligations as data
controller when engaging Hachi to undertake data processing activities. First, TFC did not
specify any requirements for Hachi to implement any data protection measures to be
implemented in the Website, whether in its contract with Hachi or other project
documentation. Second, TFC did not conduct any pre-launch security testing (such as
vulnerability assessments) on the Website. Had security testing been conducted, TFC
would have been able to detect the presence of the publicly accessible temporary file, even
if it was unaware of the bug in the Plugin that caused it.

8. Once it knew about the Incident, TFC and Hachi removed the Plugin and disabled the
public’s access to the relevant directory folder. Hachi also contacted the developers of the
Plugin, who acknowledged the existence of the bug and fixed the bug in an updated version.
TFC subsequently engaged a vendor to perform penetration testing and other measures to
enhance the security of the Website.

9. The Deputy Commissioner found TFC in breach of the Protection Obligation under section
24 of the PDPA. After considering the circumstances of the Incident, including according
mitigatory weight to TFC’s cooperation with the Commission during investigations and the

remedial action taken by TFC after the Incident, the Deputy Commissioner directs TFC to
pay a financial penalty of $9,000 for its breach.

10. TFC must make payment of the financial penalty within 30 days from the date of this
direction, failing which interest, at the rate specified in the Rules of Court in respect of
judgment debts, shall accrue and be payable on the outstanding amount of the financial
penalty until it is paid in full.

11. No further directions are required as TFC had taken actions to address the gaps in its
security arrangements.

",Financial Penalty,7255b9fe4b2433c5774bed593dd6215b52226a70,"[""pdf-content"",""timestamp"",""decision"",""pdf-url"",""tags"",""nature"",""url"",""title"",""date"",""description""]"
2023-10-01T11:02:10+08:00,fbd32491db44d3d0c97aa12a99cefd61ec954264,72,72,1,952,Singapore Technologies Engineering was found not in breach of the PDPA in relation to the transfer of the personal data of its Singapore-based employees to its subsidiaries based in United States.,"[""Transfer Limitation"", ""Not in Breach"", ""Manufacturing"", ""Ransomware""]",2021-01-14,https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/Decision----ST-Engineering-Ltd---16112020.pdf,Transfer Limitation,No Breach of the Transfer Limitation Obligation by Singapore Technologies Engineering,https://www.pdpc.gov.sg/all-commissions-decisions/2021/01/no-breach-of-the-transfer-limitation-obligation-by-singapore-technologies-engineering,2021-01-14,"PERSONAL DATA PROTECTION COMMISSION

[2020] SGPDPC 21
Case No. DP-2006-B6426

In the matter of an investigation under section 50(1)
of the Personal Data Protection Act 2012
And
Singapore Technologies Engineering Limited
… Organisation

DECISION

Singapore Technologies Engineering Limited

[2020] SGPDPC 21

Singapore Technologies Engineering Limited
[2020] SGPDPC 21
Yeong Zee Kin, Deputy Commissioner — Case No. DP-2006-B6426
16 November 2020
Introduction
1

On 10 June 2020, Singapore Technologies Engineering Limited (the

“Organisation”) notified the Personal Data Protection Commission (the
“Commission”) that its subsidiary based in the United States of America
(“USA”), VT San Antonio Aerospace Inc. (“VT SAA”), had discovered a
cybersecurity incident where threat actors gained unauthorised access to VT
SAA’s US-based IT network and deployed a ransomware attack (the
“Incident”).
Facts of the Case
2

The Organisation is a Singapore incorporated company with a network

of subsidiaries in Asia, Europe, USA and the Middle East. The ransomware
attack was isolated to a limited part of VT SAA’s network, but also affected a
few of the Organisation’s subsidiaries based in the USA that were using IT
shared services provided by VT SAA. The Organisation’s IT network in
Singapore was not compromised during the Incident. However, the following
types of personal data belonging to 287 individuals in Singapore (“Affected

1

Singapore Technologies Engineering Limited

[2020] SGPDPC 21

Individuals”) were potentially exposed to the risk of unauthorised access
(collectively, the “Personal Data Sets”)1:
(a)

Name;

(b)

Address;

(c)

Email address;

(d)

Telephone number;

(e)

NRIC number and date of issue;

(f)

Passport details;

(g)

Photograph;

(h)

Date of birth;

(i)

Citizenship;

(j)

Country of residence;

(k)

Place of birth;

(l)

USA Social Security number;

(m)

USA visa information;

(n)

Details regarding government or military service, where applicable;

(o)

CV information;

(p)

Foreign identification numbers;

(q)

Government issued identification (ID) information;

1

This list sets out the personal data types potentially affected in the Incident. Not all of these
types of personal data were affected for each Affected Individual, and the type(s) of personal
data affected for each Affected Individual varies. The Personal Data Sets of 49 Affected
Individuals were assessed to have been “likely exfiltrated”, with the remaining Personal Data
Sets were assessed to have been “likely affected, may have been exfiltrated”.

2

Singapore Technologies Engineering Limited

[2020] SGPDPC 21

(r)

Associated information about minors; and

(s)

Employee status.

3

In this regard, the Affected Individual’s Personal Data Sets had been

transferred from the Organisation (in Singapore) to VT SAA and the
Organisation’s other subsidiaries (based in the USA). The purposes of the
transfer included making regulatory filings with the USA authorities,
secondment or transfers of employment and security clearance in connection
with visits to facilities.
4

Upon discovery of the Incident, the Organisation and VT SAA

immediately took the following remedial actions:
VT SAA
(a)

Notified the federal law enforcement officials in USA;

(b)

Immediately disconnected certain systems from the network and
retained leading third-party forensic advisors to investigate the Incident;

(c)

Conducted a rigorous review of the Incident and its systems, including
deploying advance tools to remediate the intrusion and to restore the
affected systems;

(d)

Strengthened its overall cybersecurity architecture, including enhanced
endpoint security controls, additional network monitoring and other
security hardening measures; and

(e)

Implemented a Security Operations Centre to provide 24/7 monitoring,
detection and response capabilities.

3

Singapore Technologies Engineering Limited

[2020] SGPDPC 21

The Organisation
(f)

Reprioritised and accelerated its existing IT harmonisation plan
(including the enhancement and hardening of internal controls and
external program elements) for all its entities.

Findings and Basis for Determination
5

As a preliminary point, the data protection obligations in the Personal

Data Protection Act 2012 (“PDPA”) did not apply to VT SAA and the
Organisation’s other subsidiaries (based in the USA) with respect to the
Incident. This is because they did not carry out any activities in relation to the
collection, use or disclosure of the Affected Individual’s Personal Data Sets in
Singapore. The Commission will defer to the ongoing investigations by the US
federal law enforcement officials into VT SAA and the Organisation’s
subsidiaries based in the USA. The Commission’s investigations in the present
case focused on whether the Organisation’s transfer of the Affected Individual’s
Personal Data Sets from Singapore to the USA met the requirements under the
PDPA.
The Transfer Limitation Obligation under Section 26 of the PDPA
6

Section 26(1) of the PDPA provides that an organisation shall not

transfer any personal data to a country or territory outside Singapore except in
accordance with requirements prescribed under the PDPA to ensure that
organisations provide a standard of protection to personal data so transferred
that is comparable to the protection under the PDPA (the “Transfer Limitation
Obligation”). The relevant requirements are prescribed in Part III of the
Personal Data Protection Regulations 2014 (“PDPR”). In particular:

4

Singapore Technologies Engineering Limited

(a)

[2020] SGPDPC 21

Regulation 9(1)(b) of the PDPR requires an organisation that transfers
personal data to a country or territory outside of Singapore to take
appropriate steps to ensure that the recipient of personal data is bound
by legally enforceable obligations (in accordance with Regulation 10) to
provide to the transferred personal data a standard of protection that is
at least comparable to that under the PDPA;

(b)

Regulation 10(1)(c) of the PDPR provides that such legally enforceable
obligations include, amongst other things, any binding corporate rules
in accordance with Regulation 10(3) of the PDPR; and

(c)

Regulation 10(3) of the PDPR provides that such binding corporate rules
must require every recipient of the transferred personal data to provide
a standard of protection for the transferred personal data that is
comparable to that of the PDPA, and must specify (i) the recipients of
the transferred personal data to which the binding corporate rules apply;
(ii) the countries and territories to which the personal data may be
transferred under the binding corporate rules; and (iii) the rights and
obligations provided by the binding corporate rules. Further such
binding corporate rules may only be used by recipients that are related
to the transferring organisation.

Whether the Organisation complied with the Transfer Limitation Obligation
7

The Commission’s investigations revealed that the Organisation had

complied with the Transfer Limitation Obligation for the reasons explained
below.
8

At the material time, the Organisation had put in place binding corporate

rules set out in the St Engineering’s Group Binding Corporate Rules for

5

Singapore Technologies Engineering Limited

[2020] SGPDPC 21

Transfers of Personal Data (PDP-04) (“BCRs”), which met the requirements of
Regulation 9(1)(b) read together with Regulations 10(1)(c) and 10(3) of the
PDPR:
(a)

The BCRs were applicable to and legally binding upon all of the
Organisation’s direct and indirect subsidiaries worldwide (each a
“Group Company” and collectively, the “Group”), concerning the
transfers (including international transfers) of personal data within the
Group;

(b)

The BCRs specified the countries and territories to which personal data
may be transferred (which included the USA);

(c)

Each Group Company that received transferred personal data was bound
by legally enforceable obligations to provide a standard of protection for
the personal data transferred that is at least comparable to the protection
under the PDPA. In particular:
“5.6

The Receiving Company shall protect the transferred Personal

Data in its possession or under its control by making reasonable security
arrangements to prevent unauthorised access, collection, use,
disclosure, copying, modification, disposal or other similar risks to the
transferred Personal Data.

6.1

Each Group Company warrants and undertakes that it has

implemented and maintained appropriate security, technological and
organisational measures in accordance with the Group Company’s
legal obligations under the PDPA or other applicable Data Protection
Laws to protect Personal Data and to prevent unauthorised access,

6

Singapore Technologies Engineering Limited

[2020] SGPDPC 21

collection, use, disclosure, copying, modification, disposal or other
similar risks to the transferred Personal Data.”
(d)

Rights and obligations provided by the BCRs are specified. These
included the permitted purposes for transfer of personal data, data
protection obligations of the receiving company, and protection and
security of personal data. The permitted purposes set out in the following
clauses in the BCRs included the purposes of transfer of the Affected
Individual’s Personal Data Sets at [3]
“1.

Managing or terminating the employment relationship …

… (xvii) Preparing and making travel arrangements for employees’
work or business travel (including visa applications, transport and
accommodation arrangements) …
… 2.

Evaluative purposes …

… (iii) Evaluation for secondment / transfer of employment to another
entity within the Group / for extension of contract (for contract staff) /
termination / redundancy / restructuring …
… 3.

Group’s business operations, including the Group’s internal

business management, administration and operations: …
… (vi) Submission to government agencies and authorities for permits
and approvals …
… (xiii) To facilitate security clearance / entry access into premises of
customers, vendors, consultants and other business partners”.
9

Having carefully considered all the relevant circumstances and for the

reasons set out above, I find that the Organisation complied with the Transfer

7

Singapore Technologies Engineering Limited

[2020] SGPDPC 21

Limitation Obligation in relation to its transfer of the Affected Individual’s
Personal Data Sets to VT SAA and its other subsidiaries based in the USA.

YEONG ZEE KIN
DEPUTY COMMISSIONER
FOR PERSONAL DATA PROTECTION

8

",Not in Breach,e80b77152c3052ff0a5870f8773669cd59a36872,"[""pdf-content"",""timestamp"",""decision"",""pdf-url"",""tags"",""nature"",""url"",""title"",""date"",""description""]"