_commit_at,_commit_hash,_id,_item,_version,_commit,description,tags,date,pdf-url,nature,title,url,timestamp,pdf-content,decision,_item_full_hash,_changed_columns
2023-10-01T11:02:10+08:00,fbd32491db44d3d0c97aa12a99cefd61ec954264,1,1,1,952,"A financial penalty of $9,000 was imposed on Century Evergreen for failing to put in place reasonable security arrangements to protect the personal data of jobseekers in its possession or under its control.","[""Protection"", ""Financial Penalty"", ""Employment"", ""URL manipulation""]",2023-09-15,https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/GD_Century_Evergreen_260723.pdf,Protection,Breach of the Protection Obligation by Century Evergreen,https://www.pdpc.gov.sg/all-commissions-decisions/2023/09/breach-of-the-protection-obligation-by-century-evergreen,2023-09-15,"PERSONAL DATA PROTECTION COMMISSION

[2023] SGPDPCS 5

Case No. DP-2212-C0526
In the matter of an investigation under section 50(1) of the
Personal Data Protection Act 2012
And
Century Evergreen Private Limited

SUMMARY OF THE DECISION

1. On 11 December 2022, the Personal Data Protection Commission (the
“Commission”) received a complaint against Century Evergreen Private Limited
(the “Organisation”) that images of identification documents (which includes the
National Registration Identity Card) submitted by jobseekers to the Organisation
were publicly accessible on the Organisation’s website (“Incident”). The
Organisation is a manpower contracting services company and required
jobseekers to submit their identification documents to verify the identity of and
suitability of the jobseeker in question.

2. Following the complaint received, the Commission commenced investigations to
determine the Organisation’s compliance with the Personal Data Protection Act
2012 (“PDPA”). The Organisation requested that the investigation be handled
under the Commission’s Expedited Decision Procedure (“EDP”). This means that
Page 1 of 5

the Organisation voluntarily provided and admitted to the facts set out in this
decision. The Organisation also admitted that it failed to implement reasonable
security arrangements to protect the personal data in its possession and control,
and was in breach of section 24(a) of the PDPA.

3. The Organisation admitted that the Insecure Direct Object References (“IDOR”)
vulnerability on its website, which allowed the complainant to manipulate the URL
had existed from the time the website was launched on 9 November 2015. As a
result of this vulnerability, 96,889 images of identification documents belonging to
23,940 individuals were downloaded from the Organisation’s website from 10 to 12
December 2022.

4. The Organisation admitted that it was in breach of section 24(a) of the PDPA as it
failed to include any security requirements to protect personal data in its contract
with the vendor who first developed and subsequently maintained the website. In
this regard, even though the Organisation had engaged an IT vendor from the time
the website was developed and launched, the Organisation remained solely
responsible for protecting the personal data in its possession and control at all
material times.

5. What is expected from organisations who engage professional services to build
their websites and other online portals is explained in the Commission’s Guide on
Building Websites for SMEs (revised 10 July 2018) (the “Guide”). The Commission
had consistently advised organisations of the need to emphasise the protection of

Page 2 of 5

personal data to their IT vendors, by making it part of their contractual terms.1 The
contract should clearly state the responsibilities of the IT vendor with respect to the
PDPA. In this regard, the Commission noted that there was a glaring omission of
clauses to protect personal data in the Organisation’s contract with its IT vendor.

6. The Organisation also admitted that apart from conducting functionality testing
when the website was first launched, the Organisation had no arrangements with
its IT vendor to conduct any security tests prior to the launch of the website, or
thereafter. The Organisation had also failed to impose any security requirements
on the IT vendor to protect personal data, via contract.

7. In view of the above, the Deputy Commissioner found that the Organisation had
contravened section 24(a) of the PDPA.

8. In deciding the appropriate outcome in this case, the Commission considered that
a financial penalty ought to be imposed as the personal data affected included not
just the identification numbers, but the images of the identification documents.
Furthermore, there was a long period of non-compliance. The vulnerability was not
addressed since 2015.

9. In deciding on the appropriate amount of financial penalty, the circumstances set
out above and the factors listed at section 48J(6) of the PDPA were considered,
specifically the impact of the personal data breach on the individuals affected and
the nature of the Organisation’s non-compliance with the PDPA. In the
circumstances, this was not an insignificant breach given the number of individuals

1

See Guide on Building Websites for SMEs (revised 10 July 2018) at [4.2.1] and Re EU Holidays Pte Ltd [2019]
SGPDPC 38.
Page 3 of 5

affected (ie 23,940) and the nature of personal data exfiltrated: 96,889 images of
identification documents.
10. The Organisation’s non-compliance with the PDPA was also not simply one of
mere negligence but that of gross negligence. There was a long period of noncompliance on the facts of this case. As set out above, the Commission had issued
the Guide to assist SMEs, and consistently cautioned the need for organisations
to ensure compliance with the PDPA even when they engage an IT vendor in our
previous decisions.2

11. In deciding on the appropriate amount of the financial penalty, the following factors
were considered – the Organisation’s turnover and profitability, its cooperation
throughout the investigation, its voluntary admission of breach of the Protection
Obligation under the EDP, and the prompt remedial actions taken after the
Organisation became aware of the IDOR vulnerability. This included rectifying the
IDOR vulnerability, making server configuration changes to improve security,
implementing vulnerability scans, migrating its backup server to an encrypted
remote server, deploying additional security software and subscription to security
services, and securing a new contract with its vendor to manage the security of its
website. In addition to its prompt remedial actions, its poor performance in the most
recent financial year was also taken into consideration. Finally, the organisation
had admitted to its culpability at an early stage and elected to proceed under the
EDP.

2

Re EU Holidays Pte Ltd [2019] SGPDPC 38 and Re Vhive Pte Ltd (Case No. DP-2013-B8138).
Page 4 of 5

12. For the reasons above, the Deputy Commissioner for Personal Data Protection
hereby finds the Organisation in breach and directs the Organisation to pay a
financial penalty of S$9,000 within 30 days from the notice accompanying date of
this decision, failing which interest at the rate specified in the Rules of Court in
respect of judgement debts shall accrue and be payable on the outstanding amount
of such financial penalty until the financial penalty is paid in full.

The following section of the Personal Data Protection Act 2012 had been cited in the
above summary:
Protection of personal data
24. An organisation shall protect personal data in its possession or under its control
by making reasonable security arrangements to prevent –
(a) unauthorised access, collection, use, disclosure, copying, modification, disposal or
similar risks; and
(b) the loss of any storage medium or device on which personal data is stored.

Page 5 of 5

",Financial Penalty,3a409dde7f16bfa6ec2d01d5c2d7e80c9ec98146,"[""pdf-content"",""timestamp"",""decision"",""pdf-url"",""tags"",""nature"",""url"",""title"",""date"",""description""]"
2023-10-01T11:02:10+08:00,fbd32491db44d3d0c97aa12a99cefd61ec954264,2,2,1,952,"A financial penalty of $3,000 was imposed on Autobahn Rent A Car for failing to put in place reasonable security arrangements to protect the personal data in its possession or under its control. Directions were also issued to strengthen access control measures to administrator accounts and to conduct reasonable security review of technical and administrative arrangements for the protection of personal data.","[""Protection"", ""Financial Penalty"", ""Directions"", ""Others""]",2023-09-15,https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Commissions-Decisions/GD_Autobahn-Rent-A-Car-Pte-Ltd_090623.pdf,Protection,Breach of the Protection Obligation by Autobahn Rent A Car,https://www.pdpc.gov.sg/all-commissions-decisions/2023/09/breach-of-the-protection-obligation-by-autobahn-rent-a-car,2023-09-15,"PERSONAL DATA PROTECTION COMMISSION

[2023] SGPDPCS 4

Case No. DP-2210-C0345

In the matter of an investigation under section 50(1) of the
Personal Data Protection Act 2012

And

Autobahn Rent A Car Pte. Ltd.

SUMMARY OF THE DECISION

1

On 21 October 2022, Autobahn Rent A Car Pte. Ltd. (the “Organisation”)

notified the Personal Data Protection Commission (the “Commission”) of a personal
data breach (the “Incident”).

2

The Organisation operates a car-sharing service, Shariot, in Singapore. On 24

September 2022, the Organisation received customer feedback that a photograph on
its mobile application had been replaced with a pornographic photograph. The
Organisation discovered that the pornographic photograph had been uploaded
through an unrevoked administrator account belonging to an ex-employee, who had
Page 1 of 6

left the Organisation in May 2022. The ex-employee received an email from an
unknown sender on 10 September 2022 stating that his personal laptop had been
hacked and demanding Bitcoins as ransom payment. The threat actor was able to log
into the Shariot’s mobile application administrator portal through the administrator
account belonging to the ex-employee, and used the export CSV function to download
a copy of the Shariot’s users personal data.

3

Subsequently, on 21 October 2022, a cybersecurity solutions provider alerted

the Organisation of a cybercrime forum post offering the sale of a Shariot database
containing personal data. The Commission commenced investigations to determine
whether the Incident disclosed any breaches of the Personal Data Protection Act 2012
(“PDPA”) by the Organisation.

4

The Organisation requested, and the Commission agreed, for this matter to

proceed under the Expedited Decision Breach Procedure. To this end, the
Organisation voluntarily and unequivocally admitted to the facts set out in this decision.
It admitted to a breach of the Protection Obligation under Section 24 of the PDPA.

5

The Organisation’s internal investigations discovered that compromise of the

dormant administrator account credentials enabled the unauthorised access to Shariot
backend admin web portal, leading to the exfiltration of 53,000 personal data sets of
Shariot users. The personal data that were affected in the Incident included names,

Page 2 of 6

email addresses, mobile phone numbers, NRIC numbers and general location data
(e.g. Bishan, Toa Payoh or Orchard).

6

Following the Incident, the Organisation took the following remedial action:
(a)

Immediately conducted an internal audit of its administrator accounts to

ensure that any employee access that was not required was revoked;
(b)

Enhanced its software code and admin panel user interface to mask

displayed or exported NRIC numbers to show only the last 4 characters; and
(c)

Conducted cyber hygiene and awareness training for all staff handling

personal data.

7

The Organisation admitted that it had failed to ensure it had reasonable security

arrangements in place to prevent the unauthorized access or disclosure of the
personal data in its possession or control, as it failed to implement and ensure
reasonable access control to its backend admin web portal. First, the Organisation
failed to revoke the login credentials of an administrator account belonging to an exemployee once the employment relationship came to an end in May 2022. As a result,
the ex-employee’s administrator login credentials remained active, which – when
compromised – enabled the malicious actor access into its network.

8

Second, the Organisation also admitted that the Incident would not have

happened if it had implemented multi-factor authentication (“MFA”) as an additional
Page 3 of 6

access control for its administrator accounts that had access to its sizeable user
database. In Re Lovebonito [2022] SGPDPC 3, the Commission had highlighted the
need for organisations to strengthen access control, through the use of a one-time
password (“OTP”) or 2FA/MFA, to such accounts. Indeed, regardless of whether an
account is an administrative account, once an account is granted access rights to a
database containing sensitive personal data records or a significant volume of
personal data that would adversely impact the affected individuals in the event of a
personal data breach, we would encourage organisations to consider implementing
enhanced access controls to the account such as through the use of a OTP or
2FA/MFA to better safeguard the personal data.

9

For the above reasons, the Organisation was determined to have breached the

Protection Obligation.

The Deputy Commissioner’s Decision
10

In determining whether the Organisation should be required to pay a financial

penalty under Section 48J of the PDPA or if directions would suffice, I considered that
a financial penalty was appropriate as the personal data breach was not insignificant.
In deciding the appropriate financial penalty amount, I first considered all the relevant
factors listed at Section 48J(6) of the PDPA, in particular, the impact of the personal
data breach on the individuals affected and the nature of Organisation’s noncompliance with the PDPA. In this regard, while the NRIC numbers and general

Page 4 of 6

location data was affected, this is less serious than if the NRIC images and specific
GPS location had been disclosed.

11

In deciding what would be the appropriate financial penalty amount, I also

considered the organisation’s turnover to arrive at a figure that would, in my mind, be
a proportionate and effective amount, to ensure compliance and deter non-compliance
with the PDPA. On the facts of this particular case, the organisation’s turnover has
been taken into consideration to arrive at a proportionate and effective financial
penalty. I also considered the following mitigating factors, which led to a further
reduction in the financial penalty:
(a)

The Organisation was cooperative during the course of our

investigations;
(b)

The Organisation voluntarily admitted to breach of the Protection

Obligation under the Commission’s Expedited Decision Procedure; and
(c)

The Organisation took prompt remedial actions following discovery of

the Incident.

12

For the reasons above, I hereby require the Organisation to pay a financial

penalty of $3,000 within 30 days of the date of the relevant notices accompanying this
decision, failing which interest at the rate specified in the Rules of Court in respect of
judgment debts shall accrue and be payable on the outstanding amount of such
financial penalty until the financial penalty is paid in full.

Page 5 of 6

13

In addition to the financial penalty imposed, the Organisation is also directed to

do the following:
(a)

Implement processes for systems and applications revocation within a

reasonable window of cessation of need for access by an employee;
(b)

Strengthen access controls measures to administrator accounts with

access to databases holding personal data;
(c)

Conduct reasonable security review of technical and administrative

arrangements for the protection of personal data in possession or under control
of the Organisation within 60 days of the date of this Direction;
(d)

Rectify any security gaps identified in the security review directed above;

and
(e)

Inform the Commission within 1 week of the completion on the steps

directed above.

The following are the provision of the Personal Data Protection Act 2012 cited in the above summary:
Protection of personal data
24. An organisation must protect personal data in its possession or under its control by making
reasonable security arrangements to prevent –
(a) unauthorised access, collection, use, disclosure, copying, modification or disposal or similar risks
and;
(b) the loss of any storage medium or device on which personal data is stored.

Page 6 of 6

","Financial Penalty, Directions",458ca2b78344d38cc2dec8a4e89a493c8a7475a2,"[""pdf-content"",""timestamp"",""decision"",""pdf-url"",""tags"",""nature"",""url"",""title"",""date"",""description""]"