On 23 April 2019, Singapore's Personal Data Protection
Commission (commission) issued two separate grounds of decision
against PAP Community Foundation and Tutor City.
In both cases, the commission issued warnings to the
organisations for breaching the protection obligation under section
24 of the Personal Data Protection Act (PDPA), but no financial
penalty was imposed.
PAP Community Foundation (PCF)
The facts of this case were as follows:
- PCF provides kindergarten services, and organises various
school trips.
- In connection with a particular school trip, a teacher at PCF
sent a photograph of a consolidated attendance list to a WhatsApp
chat group comprising parents of students of the school. The
attendance list contained the personal data of 15 students and
their parents, including the contact and National Registration
Identity Card (NRIC) numbers of five of the parents.
