First Two Singapore Data Protection Enforcement Decisions Issued In 2019

On January 3, 2019, Singapore's Personal Data Protection Commission issued two grounds of decision against Bud Cosmetics and AIG Asia Pacific Insurance Pte Ltd & Toppan Forms (S) Pte Ltd.

Bud Cosmetics

The facts of this case were as follows:

• Bud Cosmetics is an organic and natural skincare retailer with retail outlets in Singapore and an online store.
• It collected customer information for membership registration and maintained two separate databases: one for online registrations and another for registrations in person at its retail outlets.
• As part of its marketing activities, Bud Cosmetics sent its customers e-newsletters with its latest promotional offers and products. Such e-newsletters were generated by selecting members' email addresses from both online and offline databases based on certain criteria. After an e-newsletter was sent out, the customer mailing list for that particular e-newsletter would be stored in an archive folder.