Singapore to expand public sector data sharing law

Background to the PSGA

Enacted in 2018, the PSGA established a legal framework for lawful data sharing among Singapore’s public sector agencies. Under the PSGA, data sharing amongst Singapore’s public sector agencies were permitted if carried out for one of seven prescribed public interest purposes:

• Upholding and promoting the values of the Singapore public sector.
• Securing economies or efficiencies for the Singapore public sector.
• Improving (directly or indirectly) the efficiency or effectiveness of policies, programme management or service planning and delivery by Singapore public sector agencies (whether by carrying out data analytics work or otherwise).
• Ensuring business continuity.
• Ensuring accountable and prudent stewardship of Singapore public sector finances and resources.
• Managing risks to the financial position of the Government.
• Supporting a whole-of-government approach in the discharge of the Singapore public sector agencies’ functions.

Since its introduction, the PSGA has facilitated the effective use of data within government, leading to the smoother and more targeted delivery of Singapore’s public services for its citizens.

In particular, the PSGA has unlocked deeper insights into how public services can be effectively delivered, thereby improving policy outcomes across the public sector.

At the same time, Singapore’s government agencies are increasingly collaborating with external organisations, such as social service agencies, community groups and trade associations, to deliver these public services.

As these partnerships expand, the need for public agencies to securely share data with external partners has grown. For example, community organisations providing social or health‑related assistance may require timely access to lists of eligible individuals and their contact details, or trade associations may need business information to tailor support schemes for small and medium enterprises.

Under the current framework, data sharing with external parties requires either obtaining consent, or conducting complex legal analysis to establish that the data sharing is indeed in the public interest. These processes are time intensive and can ultimately delay the delivery of public services to citizens.

To address these challenges, the amendments to the PSGA provide a framework for data sharing between public agencies and external parties helping to deliver public services on behalf of public agencies.

Key amendments

The Bill introduces several important changes to the PSGA:

• Legal Basis for External Sharing: Under the proposed changes, public sector agencies can share data with authorised external partners who are delivering services on behalf of the public agency, provided that any one of the seven public interest purposes are recognised and prescribed under the PSGA, is met. As mentioned above, these are:
  • Upholding and promoting the values of the Singapore public sector.
  • Securing economies or efficiencies for the Singapore public sector.
  • Improving (directly or indirectly) the efficiency or effectiveness of policies, programme management or service planning and delivery by Singapore public sector agencies (whether by carrying out data analytics work or otherwise).
  • Ensuring business continuity.
  • Ensuring accountable and prudent stewardship of Singapore public sector finances and resources.
  • Managing risks to the financial position of the Government.
  • Supporting a whole-of-government approach in the discharge of the Singapore public sector agencies’ functions.
• Accountability of External Partners: External partners will be subject to data governance obligations equivalent to those imposed on public agencies. Misuse of data by the external partner, including unauthorised disclosure or re‑identification of anonymised information shared with the external partner, will attract the same criminal penalties applicable to public agency officers.
• Continued PDPA Oversight for External Partners: External partners will remain bound by the obligations applying to the collection, use and disclosure of personal data under the Personal Data Protection Act 2012 (PDPA), applicable to processing of personal data by private sector entities, thereby providing a dual layer of statutory safeguards in respect of the data sharing.
• Public Agency Same-Use Clarification: The Bill clarifies that public agencies may share the data they are permitted to use with other public agencies, so long as it is shared with that other public agency for the same prescribed legal purpose.

Notably, the Bill does not mandate that external partners adopt a prescribed data governance framework. This is of importance because although government agencies already operate under established data governance processes, smaller external partners may lack comparable data governance structures. To ensure consistency and safeguard data integrity, Singapore’s Ministry of Digital Development and Information may develop operational guidelines in future to bridge this gap and align standards across external partners.

Legislative status

Following its passage in Parliament, the Public Sector (Governance) (Amendment) Bill will proceed to the President for assent before being published in the Government Gazette. A commencement order will then be issued to bring the provisions into force, either in full or in phases. It is further expected that subsidiary regulations and operational guidelines will be developed in due course, to clarify authorisation procedures, data governance standards, and enforcement mechanisms in connection with the PSGA amendments.

Conclusion

The Public Sector (Governance) Amendment Bill marks a refinement of the rules applicable to data sharing involving the public sector in Singapore. It recognises the legitimate need of Singapore’s public sector to process data for worthy public interest goals, while at the same time, ensuring that there is a clear statutory framework in place to accord protection and accountability across the supply chain.

Should you need assistance or have enquiries about whether and how this legislative development affects your organisation, please reach out to your usual contact at Hogan Lovells or the authors.

Authored by Charmian Aw and Ciara O'Leary.