Retail Store Let Off For Compliance With Its Data Protection Obligations

A recent decision of the Personal Data Protection Commission ("PDPC") demonstrates the importance of compliance with data protection obligations.

On 3 December 2020, Giordano Originals (s) Pte Ltd ("Giordano") reported to the PDPC of an illegitimate network access and ransomware virus of both the OS and server, which had taken place around 12 July 2020.

Due to the Incident, employees' personal data and members' personal data, were compromised. Employees' personal data consisted of their names, IC numbers, address, gender, age, phone number, e-mail contact, qualifications and salary information. Members' personal data consisted of their names, phone number and date of birth (without birth year). Giordano did not detect any dubious movements in the Singapore network, or any repercussions beyond the said network. The breach had probably taken place through use of information collected from phishing.