Singapore Personal Data Protection Act 2012 (as applied to AI data flows)

Binding law — in force AI-adjacent law

Use personal data to train or improve AI only on consent that is optional and can be withdrawn, or within an exception (Singapore PDPA)

PDPA 2012, s. 13 (consent required) · official text · In force: applies since 2 Jul 2014 · Singapore (SG)

An organisation may collect, use or disclose personal data only with the individual's consent or deemed consent, or where the Act or other written law authorises it without consent (PDPA s. 13), only for purposes a reasonable person would consider appropriate and that the individual has been told of (s. 18), and must tell the individual of any further purpose before using or disclosing the data for it (s. 20(1)(b)); consent counts only if it was given for that purpose after that notice (s. 14(1)). Using conversations, uploads and other user content to train, fine-tune or evaluate a model is such a use. An organisation must not make consent to collection, use or disclosure beyond what is reasonable to provide a product or service a condition of providing it, or obtain consent by false or misleading information or deceptive practices; consent so obtained is invalid (s. 14(2)-(3)). The individual may withdraw consent at any time, the organisation may not prohibit it, and on withdrawal it must stop (and cause its data intermediaries and agents to stop) collecting, using or disclosing the data unless that is authorised without consent (s. 16). Without consent, an organisation may use personal data to improve or develop its goods, services, methods or processes only where that purpose cannot reasonably be achieved without the data in an individually identifiable form and a reasonable person would consider the use appropriate (First Schedule Part 5 para. 1 for corporations; Second Schedule Part 2 Division 2 for other organisations), or by deemed consent by notification after an adverse-effect assessment and an opt-out period (s. 15A(4)). Detect a training or fine-tuning job built from user content with no consent filter and no de-identification step, consent to training bundled into sign-up, or a withdrawal handler that does not reach training sets, AI memory and the AI vendors that process the data.

Who it applies to

• Duty falls on: organization
• Organisations (any individual, company, association or body of persons, whether or not formed, recognised, resident or with a place of business in Singapore, s. 2(1)) that collect, use or disclose personal data and use it in AI training, fine-tuning, evaluation, memory or personalisation; in force for Part 4 since 2014-07-02. Whether a given AI use falls within the business-improvement exceptions (identifiable form necessary; reasonable person) or deemed consent by notification, and whether the individual was told of the purpose, are for counsel (review flag).
• Not covered:
  • Individuals acting in a personal or domestic capacity, employees acting in the course of employment, and public agencies (s. 4(1)(a)-(c))
  • A data intermediary processing personal data on behalf of and for the purposes of another organisation under a written contract is not bound by Part 4; the organisation answers for it (s. 4(2)-(3))
• Whether it applies depends on facts outside the code; a person has to decide.

rows = db.execute(text('SELECT id, user_id, prompt, reply FROM messages')).all()
write_jsonl('train.jsonl', [to_chat_example(r) for r in rows])
f = client.files.create(file=open('train.jsonl', 'rb'), purpose='fine-tune')
client.fine_tuning.jobs.create(training_file=f.id, model=BASE_MODEL)

rows = db.execute(text("""
    SELECT m.id, m.user_id, m.prompt, m.reply FROM messages m
    JOIN consents c ON c.user_id = m.user_id
    WHERE c.purpose = 'model_training' AND c.granted AND c.withdrawn_at IS NULL""")).all()
write_jsonl('train.jsonl', [to_chat_example(r) for r in rows])
f = client.files.create(file=open('train.jsonl', 'rb'), purpose='fine-tune')
job = client.fine_tuning.jobs.create(training_file=f.id, model=BASE_MODEL)
lineage.record(job_id=job.id, dataset_file=f.id, content_ids=[r.id for r in rows])

Related incidents

• FTC order requires Everalbum to delete face-recognition models trained on users' photos (2017-09; alleged (not proven)). The FTC alleged that Everalbum's Ever photo app enabled face recognition by default for most users and that, from September 2017 to August 2019, the company combined facial images extracted from users' photos with public datasets to develop its face-recognition technology, in part without affirmative express consent. Everalbum settled without admitting or denying the allegations; the final order (May 2021) requires deletion of face embeddings from users who had not consented and of any models or algorithms developed in whole or in part with Ever users' biometric information. Source: U.S. Federal Trade Commission (press release, 2021-05-07) · evidence grade: primary · cited by Train on user content only with consent specific to that purpose

Rule id sg-pdpa-ai-data.ai-training-use-consent-unbundled-and-withdrawable · review status: primary source derived