National Youth Council mistakenly leaks personal data of 600 SG Youth Forum participants

The names and NRIC numbers of about 600 participants of the SG Youth Forum were mistakenly sent to a private e-mail address by the National Youth Council (NYC).

Minister for Culture, Community and Youth David Neo said the incident on Aug 25 was caused by a human error, and NYC is now looking to strengthen safeguards for its data handling processes.

He was responding to a parliamentary question from Abdul Muhaimin Abdul Malik (Sengkang GRC) on Oct 7.

The SG Youth Forum is an annual event organised by NYC, bringing together the Government, youth and stakeholders to discuss issues that matter to young Singaporeans.

It was most recently held in July at the Suntec Convention Centre, where the SG Youth Plan was launched.

Neo said NYC discovered the data leak on the same day the file containing the data was sent, and requested the recipient to delete the information. But repeated attempts to contact the recipient were unsuccessful.

NYC then assessed that no further action could be reasonably taken and e-mailed the affected participants on Sept 3 to notify them of the incident.

In the e-mail, NYC had apologised and offered channels for those affected to connect with them on the incident.

Neo said NYC officers had also personally engaged participants who had further queries and concerns.

As NYC is a public service agency, it is not governed by the Personal Data Protection Act and does not fall under the Personal Data Protection Commission’s (PDPC) purview.

Instead, it has to comply with the Public Sector (Governance) Act.

Under the Act, an individual found guilty of unauthorised disclosure and improper use of information can be jailed for up to two years and fined $5,000.

Neo said the NYC and the Ministry of Culture, Community and Youth take the protection of personal data seriously.

“In response to this incident, NYC has taken immediate action to review its data transfer processes and address vulnerabilities that could result in similar scenarios.

“It is also reviewing other data handling processes in the organisation to strengthen them and institute additional safeguards,” he added.

Two major data breaches were reported in the media in September.

The first involved telco Simba, which revealed that the personal information of more than 23,500 customers was compromised, including their names, identity card numbers, dates of birth, mobile numbers and e-mail addresses.

The second incident involved more than 95,000 Bee Cheng Hiang customers, in which a bad prompt generated code that sent out marketing e-mails with all the recipients’ addresses visible to everyone.

It was the first reported case of AI-related data breach in Singapore.

PDPC was notified in both instances.

It is investigating the Simba case, and has accepted a voluntary undertaking by Bee Cheng Hiang to improve its compliance with the Personal Data Protection Act.

Source: The Straits Times © SPH Media Limited. Permission required for reproduction.

How your AI agent may level the playing field against companies: Opinion Singapore refreshes cyber strategy with new measure to block malware and phishing sites