C3 Law Revision

During check-in at hotels, guests are informed via the registration card that they are legally required to provide all of the information required as per

• Innkeepers Act.

• Hotels Licensing Regulations.

• Personal Data Protection Act.

• Singapore Tourism Board Regulations.

Answer explanation

C3.1 According to Hotels Act (Chapter 127) Regulation 27, the hotel licensee shall require every guest seeking accommodation in the hotel to furnish the following particulars:

a) His full name;

b) Particulars of any identify card, passport or other travel document issued to him;

c) The place whence he arrived and his address there;

d) The probably duration of his stay and his intended destination;

e) His occupation and place of employment;

f) His nationality; and

g) The hour and date of his arrival.

Which one of the following information is NOT mandatory for a hotel’s registration card during check-in?

• Full name.

• Nationality.

• Passport number.

• Credit card details.

Answer explanation

C3.1 According to Hotels Act (Chapter 127) Regulation 27, the hotel licensee shall require every guest seeking accommodation in the hotel to furnish the following particulars:

a) His full name;

b) Particulars of any identify card, passport or other travel document issued to him;

c) The place whence he arrived and his address there;

d) The probably duration of his stay and his intended destination;

e) His occupation and place of employment;

f) His nationality; and

g) The hour and date of his arrival.

The Telephone Operator (TO) receives an external phone call requesting to know the room number of her husband, Guest D. Upon checking the hotel’s Property Management System, the TO noticed that the Guest D is on “Incognito” stay. How should the TO respond?

• Inform the caller that Guest D is not registered with the hotel.

• Take down caller’s message and advise that Guest D will call her later.

• Call Guest D’s room and pass the phone to caller when Guest D answers.

• Advise the caller that Guest D is on “Incognito” stay and should not be disturbed.

Answer explanation

C3.1, TB29 - Should guest requests for Incognito Stays, guest is not to be contacted at all. There should not be any call transferred to the room unless authorised by guest. In most cases, guest will provide an alias name.

Which one of the following statements describes how hotels should handle the personal data collected from guests?

• The data collected is owned by the hotel for a period of 60 days before it is disposed. 

• Hotel guest information will be disclosed to anyone who asks for the information.

• The data of a guest will be stored and secured with appropriate security technology.

• Hotels need to employ a personal information manager to store the information provided by guest to the hotel.

Answer explanation

C3.2 - In line with Personal Data Protection Act (PDPA), hotel guests’ information will not be disclosed to anyone without their consent. The personal data of a guest will be adequately stored and secured with appropriate security technology.

New students of the Taekwondo school were informed that their personal data are collected for enrolment. Even after the students are no longer with the school, the data is retained. Is this a valid purpose for retention?

• Yes, the information gathered belongs to the Taekwondo school.

• Yes, because the Taekwondo school wants to maintain an alumni network.

• No, because the information is no longer valid for its enrolment purpose.

• No, because the information is valid only for a maximum of one week after students complete the classes.

Answer explanation

3.5.2 Components of Personal Data Protection Act and its application

The PDPA takes into account the following concepts:

• Consent
• Purpose

• Reasonableness

The retention limitation obligation recommends that organisation should not retain personal data in perpetuity. Which one of the following statements explains the reason for this recommendation?

• Keeping personal data for an unknown duration of time increases risk of contravention of the data protection provisions.

• Hotels should constantly upgrade their systems and since the lifespan of the system is 5 years and thus, personal data is not kept in perpetuity.

• Holding personal data should be only for short term as customers come and goes. Thus, there is no need to keep the information for a long period of time.

• It is necessary for hotels to do regular housekeeping of their database information and thus, personal data of customers who have not been patronising the organisation should be deleted.

Answer explanation

3.4 State the length of time to retain different types of guest data

The Retention Limitation Obligation prevents organisations from retaining personal data in perpetuity where it does not have legal or business reasons to do so. Holding personal data for an indeterminate duration of time, increase risk of a contravention of the Data Protection Provisions.

Length of time kept dependent on specific business needs, and assessed by reasonableness.

As of September 2019, the latest revision to Personal Data Protection Act (PDPA) states that private sector organisations are not allowed to collect, use or disclose

• dates of birth.

• NRIC numbers.

• email addresses.

• mobile phone numbers.

Answer explanation

3.6.1 Collection, use or disclosure of NRIC numbers (or copies of NRIC) - permitted when seeking medical treatment / checking into hotel as examples.

Organisations are generally not allow to collect, use, or disclose NRIC numbers (or copies of NRIC). They may do so only in the following specific circumstances:

a) Collection, use or disclosure of NRIC numbers (or copies of NRIC) is required under the law (or exception under the PDPA applies);

b) Collection, use or disclosure of NRIC numbers (or copies of NRIC) is necessary to accurately establish or verify the identities of the individuals to a high degree of fidelity.

Which one of the following activities require the collection, use or disclosure of the NRIC numbers?

• Renting of bicycle.

• Redemption of free parking.

• Purchase of movie tickets online.

• Subscription of a new mobile line.

Answer explanation

3.3 Case Scenario 1

John signs up for a mobile service with a telecommunications service provider. John consents to his personal data being collected and used by the service provider for the purposes of providing him the mobile service. The service provider collects and analyses some of John’s personal data for the purposes of managing its network and short term planning enhancements to improve the quality of mobile services provided to him. Such activities would likely fall within the original purpose John consented to.

After his staycation, Guest E receives a phone call from the hotel’s Quality Manager (QM) asking for feedback on his recent stay experience. Guest E recalls that he is registered on the Do Not Call (DNC) Registry and questions why the hotel is still calling him. Which one of the following explanations is the correct reason the QM should provide?

• DNC Registry does not apply to voice calls.

• Singapore Hotels Act overrides DNC Registry.

• DNC Registry does not apply for market survey and research.

• Her call is categorised as personal and thus not covered by DNC Registry.

Answer explanation

C3.8 The DNC Registry is meant to focus on telemarketing calls or messages of a commercial nature sent to consumers. Messages for pure market survey or research; messages that promote charitable or religious causes; personal messages sent by individuals; public messages sent by government agencies; and political messages will not be covered under the DNC provisions. Telemarketing calls or messages of a commercial nature that target other businesses are also excluded from the DNC provisions

In preparation for a new product launch in the first week of February 2022, the Marketing Communications Executive (MCE) has submitted a list of 800 telephone numbers to the DNC Registry for checking on 10 Jan 2022. The list was returned with 600 numbers which are not registered with the DNC Registry. Due to some issues, the promotion launch date has been changed to mid-March instead. How should the MCE handle the mass sending of the marketing messages?

• Ensure the marketing messages are approved by the DNC registry before sending it to the 600 numbers.

• Proceed to send the marketing messages to the 600 numbers as it has been verified by the DNC registry.

• Submit the whole list of numbers to the registry again before sending the marketing messages to the numbers who are not registered in the DNC registry.

• Submit the list of 200 numbers that were registered with the DNC registry again and confirm if they are still not registered before sending the marketing message.

Answer explanation

3.8.1 Duties of an organisation under the DNC provisions in the Act

Before an organisation starts to send any marketing message to a Singapore telephone number, it should check that;

1. The number it is sending/calling to is not registered with the DNC Registry;

2. The messages it is sending contain clear and accurate information identifying the organisation, as well as its contact details; and

3. If making a phone call, the telephone number it is making the call from is not concealed.

To check, the organisation shall submit a list of the telephone numbers that it is planning to send the messages to. The DNC Registry will then indicate on the list, whether each number is in any of the Registers. The organisation may then send its marketing messages to the numbers that are not in the relevant Registers.