The Personal Data Protection Commission
('PDPC') carried out certain
investigations recently under Section 50(1) of the Personal Data
Protection Act 2012 ('PDPA'), and
subsequently issued a warning and financial penalty on the
respective errant entities below:
L'Oréal Singapore Pte. Ltd., Case
No. DP-1812-B3091
L'Oréal Singapore Pte. Ltd.
("L'Oréal") operated a
website which had a login portal that enabled its customers to view
their profile information, etc. (the "Customer Login
Page"). The customers' profile information
included their name, email address, postal address, mobile number
and date of birth (the "Personal Data").
The development and maintenance of the website were carried out by
a vendor engaged by L'Oréal. In order to improve the
loading speed of the website, L'Oréal instructed its
vendor to make some changes to the website. However,
L'Oréal failed to scope the User Acceptance Tests
("UATs") to include the login and
caching functions of the
