Binding law — in force
Use personal data to train or improve AI only on consent that is optional and can be withdrawn, or within an exception (Singapore PDPA)
An organisation may collect, use or disclose personal data only with the individual's consent or deemed consent, or where the Act or other written law authorises it without consent (PDPA s. 13), only for purposes a reasonable person would consider appropriate and that the individual has been told of (s. 18), and must tell the individual of any further purpose before using or disclosing the data for it (s. 20(1)(b)); consent counts only if it was given for that purpose after that notice (s. 14(1)). Using conversations, uploads and other user content to train, fine-tune or evaluate a model is such a use. An organisation must not make consent to collection, use or disclosure beyond what is reasonable to provide a product or service a condition of providing it, or obtain consent by false or misleading information or deceptive practices; consent so obtained is invalid (s. 14(2)-(3)). The individual may withdraw consent at any time, the organisation may not prohibit it, and on withdrawal it must stop (and cause its data intermediaries and agents to stop) collecting, using or disclosing the data unless that is authorised without consent (s. 16). Without consent, an organisation may use personal data to improve or develop its goods, services, methods or processes only where that purpose cannot reasonably be achieved without the data in an individually identifiable form and a reasonable person would consider the use appropriate (First Schedule Part 5 para. 1 for corporations; Second Schedule Part 2 Division 2 for other organisations), or by deemed consent by notification after an adverse-effect assessment and an opt-out period (s. 15A(4)). Detect a training or fine-tuning job built from user content with no consent filter and no de-identification step, consent to training bundled into sign-up, or a withdrawal handler that does not reach training sets, AI memory and the AI vendors that process the data.
sg-pdpa-ai-data.ai-training-use-consent-unbundled-and-withdrawable · PDPA 2012, s. 13 (consent required) · official source · jurisdictions: SG