Comparison
European Union
---------------------------------------------- 1. The term "cybersecurity" has not been defined consistently across the law and policy. The concept was defined and regulated in the 2019 Cybersecurity Act and NIS2 Directive, distinguishing it from the concept of data privacy, defined and governed in 2016 GDPR. ---------------------------------------------- The statutes and regulations have explicit territorial and extraterritorial reach. ---------------------------------------------- Directive 2008/114 on EPCIP and NIS2 Directive have clarified the specific scope, responsible entities as well as security obligations and requirements of CII operators; however, implementation varies by Member State. It primarily covers 10 sectors: energy, transportation, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, public administration, and space. ---------------------------------------------- The Cybercrime Directive requires EU member states to ensure that certain activities falling into the following categories are publishable under their national laws as criminal offences: 1. illegal access to information systems; 2. illegal system interference; 3. illegal data interference; 4. illegal interception; 5. production, sale, procurement, making available and similar of certain tools used for committing offences; and 6. incitement, aiding and abetting and attempt of the above. The criminal penalties must be determined by Member States by adhering to certain minimal penalties governed by Cybercrime Directive. ---------------------------------------------- The European Union Agency for Cybersecurity ---------------------------------------------- The Cybersecurity Act's Title III establishes centralized voluntary certification schemes for ICT products, processes, and services. Certification will be granted on the basis of a comprehensive set of rules, technical requirements, standards, and procedures established at the Union level and applicable to the certification or conformity assessment of specific ICT products, services, or processes, which will specify: 1.) the categories of products to be covered; 2. the cybersecurity requirements for each (referencing standards or technical specifications); and 3. the type of evaluation required (self-assessment: basic, substantial, or high). ---------------------------------------------- The 2016 GDPR differentiates between general personal data and sensitive personal data which are subject to a higher level of protection. These data include genetic, biometric and health data, as well as personal data revealing racial and ethnic origin, political opinions, religious or ideological convictions or trade union membership. ---------------------------------------------- The GDPR distinguishes and uses the concept and terms of data controller and data processor. ---------------------------------------------- The GDPR's requirements apply to a wide range of private (EU companies and non-EU companies doing business in the EU and/or collecting or transferring personal data of EU residents) and public sector entities, including government agencies, companies, and NGOs. The GDPR excludes from its application the processing of personal data by individuals for purely personal or household purposes. It also excludes from its application data processing in the context of law enforcement or national security, as well as anonymous data (pseudonymized data is still subjected to GDPR). It further provides requirements for specific processing situations including processing for journalistic purposes and academic, artistic or literary expression. ---------------------------------------------- The GDPR provides for the designation of a DPO by data controllers or data processors. ---------------------------------------------- The GDPR requires that an organization must report to a Data Protection Authority of a security breach that affects personal data (it is left to each Member State to establish a supervisory authority) without undue delay and, where feasible, not later than 72 hours after having become aware of it. ---------------------------------------------- Under GDPR, the fine framework can be up to 20 million euros, or in the case of an undertaking, up to 4 % of their total global turnover of the preceding fiscal year, whichever is higher. ---------------------------------------------- Individuals have a right to file a complaint and seek compensation from a data controller and data processor for violation under the GDPR. ---------------------------------------------- GDPR defines and treats consent as a legal foundation for data processing much more strictly. It sets six legal bases for personal data processing, namely consent, contractual necessity, controller's legal obligations, data subject's vital interest, public interest purposes, and data controller's legitimate interest. ---------------------------------------------- GDPR requires data controllers to inform data subjects about the purpose for which their personal data is collected and processed, as well as give data subjects the right to withdraw consent to the processing of their personal data and to access, object, rectify, erasure, or deletion of their personal data.
Singapore
---------------------------------------------- Definition & Concept: 1. The term "cybersecurity" has not been defined consistently across the law and policy. The concept was defined and regulated in the 2018 Cybersecurity Act and 2013 Computer Misuse & Cybersecurity Act, distinguishing it from the concept of data privacy. Although data protection is not explicitly defined, its concept is governed by 2020 Personal Data Protection Act. ---------------------------------------------- Jurisdiction: The statutes and regulations have explicit territorial and extraterritorial reach. ---------------------------------------------- Critical Information Infrastructure Protection: The 2018 Cybersecurity Act provides a framework for the designation of CII and security obligations of CII operators. Article 7 of the act has designated 11 sectors which are energy, water, banking and finance, healthcare, transportation which includes land, maritime, and aviation, information communication technology, media, security and emergency services, and government. ---------------------------------------------- Cybercrimes: Part 2 of 2020 Computer Misuse Act regulates the following prohibited acts: 1. Unauthorised access to computer material, 2. Access with intent to commit or facilitate commission of offence; 3. Unauthorised modification of computer material; 4. Unauthorised use or interception of computer service; 5. Unauthorised obstruction of use of computer; 6. Unauthorised disclosure of access code; 7. Supplying, etc., personal information obtained in contravention of certain provisions. ---------------------------------------------- Responsible Entity: Cyber Security Agency of Singapore ---------------------------------------------- Cybersecurity Certification for ICT Products and Services: CSA has launched Singapore's Cybersecurity Labelling Scheme (CLS), which follows the EU's standard for IoT devices, and it has mutual recognition with Finland and Germany for the cybersecurity labels issued. It is a voluntary scheme and was first launched October 2020 for consumer smart devices e.g., IP cameras, Wi-Fi router, smart hub, smart door locks, smart lights, smart printers, and many others. In October 2022, the program was expanded to certifies medical devices that handle sensitive data or can connect to other devices, systems and services. ---------------------------------------------- Classification of Personal Data There is no distinction in the 2020 PDP Act between general personal data and specific/special/sensitive personal data. However, based on past PDPC decisions, certain types of personal data have been deemed more sensitive and subject to more stringent data security standards. Medical data, finance data, bankruptcy status, drug-related problems and infidelity, personal data of children, and personal identifiers are all examples of such data. ---------------------------------------------- The Terms Used The PDP Act does not utilize the term data processor and data controller, but the general concept is similar to that of a "organisation" and "data intermediary" under the PDP Act. ---------------------------------------------- Who Must Comply & Exemption (Data Privacy Law) Organizations, companies, and unincorporated entities operating in Singapore must comply with the PDPA when collecting, using, and disclosing personal data. The PDPA explicitly excludes the application of the data protection provisions to any individual acting in a personal or domestic capacity, as well as any employee acting in the course of his/her employment with an organisation. It also excludes from its application public agencies or organisations acting on behalf of a public agency, as well as anonymous data. It also makes certain exceptions to the need for consent, such as the use or disclosure of personal data for research purposes, the collection of personal data for artistic or literary purposes, and certain journalistic purposes. ---------------------------------------------- Data Protection Officer (DPO) Under the PDP Act, all organisations are required to appoint a DPO. ---------------------------------------------- Mandatory Breach Notification An organizations must notify the Singapore Personal Data Privacy Commissioner and the affected individuals as soon as practicable, and in any event within 72 hours of determining that the data breach is notifiable. ---------------------------------------------- Monetary Penalties PDP Act imposes financial penalties on organisations of up to SGD 1 million or 10% of an organisation’s annual turnover in Singapore, whichever is higher, for data breaches. ---------------------------------------------- Civil Remedies for Individuals Individuals who have personally suffered loss or damage may file a complaint and a private civil action under the PDP Act. ---------------------------------------------- Consent PDP Act also acknowledges consent as a legal foundation for data processing. However, it defines consent in a much broader sense and includes numerous outright exceptions such as deemed-consent by contractual necessity, deemed consent by notification, legitimate interests, and business development purposes. ---------------------------------------------- Rights of Data Subject Although under the PDP Act, users can request to access and correct data held by an organization, the PDP Act provides numerous exceptions to this right to request access. Organizations can also refuse to correct data. There is also extremely limited support in the PDP Act for the right to erasure of personal data.
Indonesia
---------------------------------------------- 1. The concept of cybersecurity is still relatively new. The term was first used in 2014 Ministry of Defense Regulation, but this definition is limited to national defense and security. A bill on cybersecurity was once proposed, but it was failed to be enacted in 2019. This concept has spread to many laws and regulations, but sometimes overlaps with data privacy law, e.g., in 2016 Electronic Information Technology Law and 2022 Personal Data Protection Law. ---------------------------------------------- The statutes and regulations have explicit territorial and extraterritorial reach. ---------------------------------------------- Government Regulation 71/2019 and President Regulation 82/2022 have specified the frameworks, responsible entities as well as security obligations and requirements of CII operators; however, implementation varies by Member State. It primarily covers 9 sectors: government administration, energy and mineral resources, transportation, financial and banking, healthcare, information and communication technology, food, defense, and other strategic sectors determined by the President. ---------------------------------------------- Chapter VII of 2016 Electronic Information & Technology Law regulates following prohibited acts: 1. distributing illegal content such as propriety, gambling, insults and/or defamation, extortion and/or threat; 2. false and misleading information; 3. hatred/discord against individual/group based on ethnicity) 4. breach of data protection; 5. unauthorized access to another computer/electronic system; 6. illegal and unauthorized interception or wiretapping; 7. production, sale, procurement, making available and similar of certain tools used for committing offences (e.g., spread of malicious viruses and code); and 8. incitement, aiding and abetting and attempt of the above. ---------------------------------------------- The National Cyber and Encryption Agency ---------------------------------------------- Indonesia does not yet have any patents on technological products to ensure the safety of the products widely used by society for both personal and work needs. However, Indonesia has created a software to assess the maturity and completeness level of Indonesian National Standard ISO/IEC 27001:2013 implementation, which is mandatory for government agencies and electronic system operators in strategic/high-risk sectors. ---------------------------------------------- The 2022 PDP Law distinguishes between general personal data and specific personal data that are subject to greater protection. Specific personal data categories include health data, biometric data, genetic data, criminal records, children data, and personal financial data. ---------------------------------------------- The PDP Law also distinguishes and employs the concepts and terms data controller and data processor. ---------------------------------------------- The PDP Law applies to individuals, corporations, public bodies, NGOs, and international organizations that process personal data or otherwise conduct out legal acts in Indonesia. The PDP Law excludes from its application the processing of personal data by individuals for purely personal or household purposes. It also excludes from its application data processing in the context of law enforcement, national security, public interest purposes, supervision in the financial services sector, monetary, payment, or financial stabilization, or statistical and scientific research purposes. The Law does not address anonymous or pseudonymous material. ---------------------------------------------- The PDP Law provides for the designation of a DPO by data controllers or data processors. ---------------------------------------------- The PDP Law stipulates that in the event of such a personal data protection failure, the personal data controller must deliver a written notification within 72 hours to the affected data subjects and the regulatory authorities. ---------------------------------------------- PDP Law imposes financial penalties on organisations of up to of up to 6 billion rupiah (USD 400,000) or 2% of an organisation’s annual turnover in Indonesia, whichever is higher. ---------------------------------------------- Individuals who have personally suffered loss or damage may file a complaint and a private civil action under the PDP Law. ---------------------------------------------- PDP Law defines and treats consent as a legal foundation for data processing much more strictly. Similar to GDPR, it sets six legal bases for personal data processing, namely consent, contractual necessity, controller's legal obligations, data subject's vital interest, public interest purposes, and data controller's legitimate interest. ---------------------------------------------- PDP Law introduces and recognizes rights of data subjects such as right of access, right to rectification, right to erasure, right to data portability and right to object.
