This month, the Commission has issued one Decision and two Undertakings.

The Decision this month involved an incident where an individual was approached to join a research study, raising concerns about the use and disclosure of his personal data without proper notification. The Commission found the organisation not in breach of the PDPA, as implied consent was obtained through prominently displayed notices and the individual’s continued visits to the clinic. This case highlights that while implied consent may be valid in certain circumstances, the best practice is to obtain express consent from individuals.

In the Undertakings, two organisations implemented remediation plans to improve its compliance with the PDPA. The PDPC has accepted these undertakings having considered the number of affected individuals, the types of personal data involved and the impact of the Incident.

Access the Decisions here and Undertakings here.