HMMS

An individual wants to know what personal data relating to him was disclosed in the organisation’s correspondence with its partner in a specified month within the last one year. How should the organisation respond to this request?

• The organisation should disclose every specific detail of the personal data that was shared with its affiliate during their correspondence.

• The organisation need not provide him with the copies of the actual correspondence with its partner, however it should provide the full set of personal data which is in its possession, and also inform the individual about how the data was used.

Melissa wants to purchase a spa service. The terms and conditions include a provision that the spa may sell her personal data to third-party marketing agencies. Melissa requests the spa not to disclose her personal data for such a purpose. Can the spa require Melissa to consent to the disclosure of her personal data to the marketing agencies as a condition for providing her the spa service?

• Yes, the spa can require Melissa to consent to such disclosure of her personal data as a condition of providing the spa service.

• No, Melissa should not be required to consent to such disclosure of her personal data as a condition of providing the spa service. The spa may, however, ask Melissa if she wishes to consent.

Identify the circumstances when organisations ceases to retain personal data.

• Personal data is destroyed or disposed in an appropriate manner.

• Personal data is returned to the individual concerned or transferred to another entity based on instructions of the individual.

• Personal data is anonymised so that it does not identify any particular individual.

• All of the above.

Identify the measures that help to ensure the accuracy and completeness of personal data.

• Collect all relevant parts of the personal data

• 
  

  Record personal data accurately while collecting

• Update the information where necessary

• 
  

  All of the above

Which of the following actions can an organisation take to cease retention of personal data?

• Destroying the documents containing personal data through a paper shredder

• Returning the documents containing personal data to the individual concerned.

• Anonymising the data by removing the means by which the personal data can be associated with particular individuals.

• All of the above

Identify the administrative measures that an organisation can employ to protect data from misuse.

• Have regular training sessions for staff to impart good practices in handling personal data

• Ensure that only the appropriate amount of personal data is held

• All of the above

Identify some measures that organisations can employ to demonstrate accountability?

• Conducting a Data Protection Impact Assessment (DPIA)

• Implementing a Data Protection Management Programme (DPMP)

• Obtaining the Data Protection Trustmark (DPTM) Certification

• All of the above

A company films a commercial at a public location in Singapore. The commercial captures images of individuals who pass by the filming location. The company wishes to transfer the commercial to its overseas partners for use in an advertising campaign. Can the company do so?

• Yes, the personal data in the commercial would be considered publicly available to the extent that the filming of images would be reasonably expected at that location.

• No, transfer limitation obligation does not allow transfer of personal data out of Singapore.

William contacts Organisation ABC to enquire about a product. The sales representative of Organisation ABC, Mary, is busy and informs William that she would call him back later. Does Mary need to check the Do Not Call (DNC) Registry before calling William to respond to his queries about the product?

• Yes, Mary needs to check the DNC Registry as she would be sending a specified message.

• No, Mary does not need to check the DNC Registry as she would not be sending a specified message.

Which of the following information is not required while sending a data breach notification to affected individuals in the event of a breach?

• Facts of data breach

• Information about other affected individuals

• Data breach management and remediation plan

• Contact details on how affected individuals may reach the organisation for further information or assistance