At present, a patchwork of legislation is available to tackle issues relating to data protection, prevention of online harm, and digital assets in the metaverse.

Data Protection and Privacy

The Personal Data Protection Act 2012 (PDPA) is the primary legislation in Singapore that governs the protection of personal data by organisations. An “organisation” includes any individual, company, association or body of persons, corporate or unincorporated, whether or not they (i) are formed or recognised under the law of Singapore; or (ii) are resident, or have an office or a place of business, in Singapore. The PDPA will generally not apply to individuals acting in a personal or domestic capacity, employees acting in the course of their employment with an organisation, and any public agency in relation to the collection, use or disclosure of personal data.

Therefore, in the virtual world, organisations shall have to comply with the obligations set out in the PDPA. Some notable obligations include the consent obligation where, subject to exceptions, an organisation must obtain an individual’s consent before collecting, using or disclosing their personal data for a purpose and the protection obligation which requires an organisation to protect personal data in its possession or under its control by making reasonable security arrangements.

Section 48J of the PDPA provides that if an organisation fails to comply with the obligations under the PDPA, the Personal Data Protection Commission (PDPC) is empowered to impose the following financial penalties:

• in the case of a contravention by an organisation whose annual turnover in Singapore exceeds SGD10 million, the PDPC may impose financial penalties up to 10% of the annual turnover in Singapore of the organisation; and
• in any other case, the PDPC may impose financial penalties up to SGD1 million.

Online Harm

The Protection from Online Falsehoods and Manipulation Act 2019 (POFMA) aims to prevent the electronic communication of false statements of fact, suppress support for and counteract the effects of such communication and to safeguard against the use of online accounts for such communication and for information manipulation. Further, the Foreign Interference (Counter-measures) Act 2021 (FICA) empowers the Minister for Home Affairs to issue directions to various entities such as internet access service providers to help the authorities investigate and counter hostile communications activity that is of foreign origin.

With respect to the online safety of users, the Protection from Harassment Act 2004 (POHA) covers offences relating to the publication of personal information in order to harass, threaten or facilitate violence against a person.

When the Online Safety (Miscellaneous Amendments) Act 2022 (the “Online Safety Act”) comes into operation from 1 February 2023, the Broadcasting Act 1994 will be amended to contain measures that allow the government to improve online safety for users in Singapore, combat harmful content in online services accessible to users in Singapore, and empower users with the necessary information and tools to protect themselves from harmful or detrimental content.

The amended Broadcasting Act now contains provisions to regulate providers of Online Communication Services (OCS). OCS refer to an electronic service (or part of an electronic service) having the characteristics of a social media service, which may be provided in or from Singapore, or from outside Singapore. Such an OCS enables end-users to access or communicate content on the internet or deliver content to end-users. Under the amended Broadcasting Act, OCS with significant reach and impact in Singapore may be designated as Regulated Online Communication Services. The providers of such Regulated Online Communication Services has the duty to take all reasonably practicable steps to comply with applicable Codes of Practice and implement measures on their services to mitigate the risks of danger to Singapore users from exposure to harmful content and provide accountability to their users on such measures.

Further, under the amended Broadcasting Act, the Infocomm Media Development Authority (IMDA) is empowered to issue directions to deal with egregious content that can be accessed by Singapore users on an OCS. For instance, the IMDA may issue directions to an OCS provider to disable access by Singapore users to the egregious content on the service or to ensure that a specified account cannot continue to communicate to Singapore users. Moreover, the amended Broadcasting Act empowers the IMDA to issue directions to internet access service providers to block access by Singapore users to the non-compliant OCS if an OCS provider fails to comply with the IMDA’s direction.

Digital Assets

Two types of digital assets are likely to play prominent roles in the metaverse: cryptocurrencies and non-fungible tokens (NFTs). Cryptocurrencies or NFTs may be regulated by the Monetary Authority of Singapore (MAS) under the Payment Services Act 2019 (PSA) or the Securities and Futures Act 2001 (SFA).

Under the SFA, the offer or issue of digital assets such as cryptocurrencies or NFTs may be regulated if they constitute capital market products under Section 2(1). Capital markets products include any securities, derivatives contracts and contracts or arrangements for purposes of leveraged foreign exchange trading.

Digital assets which fall within the scope of digital payment tokens (DPTs) are subject to the regulatory regime under the PSA. The PSA defines a DPT as any digital representation of value that:

• is expressed as a unit;
• is not denominated in any currency, and is not pegged by its issuer to any currency;
• is, or is intended to be, a medium of exchange accepted by the public, or a section of the public, as payment for goods or services or for the discharge of a debt;
• can be transferred, stored or traded electronically; and
• satisfies such other characteristics as the MAS may prescribe.

Subject to applicable exemptions provided for in the PSA, the PSA requires a person who carries on a business of providing a DPT service as defined under Part 3 of the First Schedule to the PSA (ie, dealing in DPTs or facilitating the exchange of DPTs) to apply for either a standard payment institution licence or a major payment institution licence.

On top of compliance with the PSA, licence holders must also take note and comply with the MAS’s guidelines and notices such as the Guidelines on Provision of Digital Payment Token Services to the Public. The MAS also intends to tighten the rules on cryptocurrency and has released a consultation paper on Proposed Regulatory Measures for DPT Services in October 2022.

In the metaverse, NFT trading is likely to become more commonplace and a part of transacting in the virtual space. While there is no legislation which specifically target NFTs, issues such as ownership continue to be governed by intellectual property and contract law principles. A contract for the purchase of NFTs usually contains three distinct subject matters which are capable of ownership by different people. The first is the code on the blockchain which may identify and authenticate the asset. The second is the asset itself. The third is the intellectual property rights in respect of the asset. The relevant intellectual property right is commonly copyright as most NFTs constitute a form of artistic expression that is afforded protection under the Copyright Act 2021 (CA). Therefore, contracts may include the assignment of copyright or a licence. Assignments of copyright must comply with the formalities stipulated in the CA and be in writing and signed by or on behalf of the assignor. However, this requirement can easily be met even in the virtual space through the application of the Electronic Transactions Act 2010 (ETA). See 9. Trust Services and Digital Entities for more details on the ETA.

Furthermore, the law in relation to NFTs is evolving rapidly. Most notably, the Singapore High Court recently held that NFTs are property and can be subject to proprietary injunctions. With the growing prominence of NFTs, courts and legislation can be expected to explore and address complex and novel legal issues raised by NFTs in the upcoming years.

At present, a patchwork of legislation is available, including in relation to consumer protection, sale of goods and services, payment services and personal data protection.

Digital Payment Solutions

Under the PSA, providers of digital payment solutions (such as e-wallet services) may need to apply for either a standard payment institution licence or a major payment institution licence (see 1. Metaverse (Digital Assets section)) if they offer the following services:

• account issuance service which involves issuing a payment account or any service relating to any operation required for operating a payment account;
• domestic money transfer service which involves providing a local fund transfer service;
• merchant acquisition service which involves accepting and processing payment transactions and payment receipts for and on behalf of a merchant; or
• e-money issuance service which involves issuance of e-money for persons to make payment transactions.

The PSA also imposes a stock and flow cap on personal payment accounts issued by major payment institution licensees to protect customers by limiting a customer’s potential loss from the customer’s account. Personal payment accounts issued by a MPI are subject to a load capacity of SGD5,000 and an annual transaction flow cap of SGD30,000. However, recognising that there may be changes in consumer behaviour, usage of e-wallets, and e-wallet business models in Singapore over time, the MAS released a consultation paper on 18 October 2022 proposing amendments to the currently prescribed stock and flow cap. In the consultation paper, the MAS proposed to raise the stock cap to SGD20,000 and raise the flow cap to SGD100,000.

E-Commerce

Further, e-marketplaces and e-retailers should ensure that they conform with the Consumer Protection (Fair Trading) Act 2003 (CPFTA). The CPFTA applies where the consumer or supplier is resident in Singapore or where the offer or acceptance relating to the consumer transaction is made in or is sent from Singapore. Therefore, in the digital economy where cross-border transactions are the norm, the CPFTA will apply where this nexus to Singapore is established.

The CPFTA accords customers rights and prohibits sellers from engaging in unfair practices or selling defective goods. If a supplier engages in unfair practices such as making false representations, deceiving consumers or taking advantage of consumers in certain circumstances, the consumer may take legal action against them under the CPFTA. Additionally, where a good does not conform to the agreement between the parties, the consumer has a right against the supplier to demand repair or replacement of the good at the supplier’s expense or alternatively, a price reduction or refund.

Moreover, in June 2020, the first national standard for e-commerce transactions, Technical Reference 76 (TR 76), was issued by Enterprise Singapore and the Singapore Standards Council. TR 76 serves as a practical reference for e-retailers and online intermediaries to build trust and transparency in online transactions. Recently, the TR 76 was revised to include additional anti-scam guidelines for e-retailers and e-commerce marketplaces, to offer better protection for consumers transacting online.

The Competition and Consumer Commission of Singapore (CCCS) has also updated its guidelines in relation to digital markets. For instance, the CCCS Guidelines on Market Definition have clarified issues related to market definition that are particularly relevant in digital markets which feature multi-sided platforms. Notably, the CCCS provided the definition of a “multi-sided platform” as an undertaking acting as a platform that facilitates interactions between two or more groups of users and creates value for sellers or buyers on one side of the platform by matching or connecting them with buyers or sellers on the other side of the platform.

The PDPA strikes a balance between safeguarding consumer’s personal data and commercial needs. Notably, while organisations are required to obtain the consent of individuals to collect, use or disclose personal data, the PDPA provides for exemptions to the consent obligation that may be useful to e-commerce providers. For example, the business improvement exception under the PDPA allows organisations to use, without consent, personal data for the purposes of:

• improving any goods or services provided;
• improving methods or processes for the operations of the organisation;
• learning the behaviour and preferences of the individual or another related individual in relation to the goods or services provided by the organisation; and
• identifying any goods or services provided by the organisation that may be suitable for the individual or another individual. 

There are limitations placed on organisations that seek to entrust certain processes or data to the cloud, although most of these limitations are in the context of personal data protection.

Applicable Laws and Guidelines

The main legislation governing the protection of personal data is the PDPA. “Personal data” is defined under the PDPA as data, whether true or not, about an individual who can be identified (i) from that data, or (ii) from that data and other information to which the organisation has or is likely to have access. The PDPA is administered and enforced by the PDPC.

There are cross-border data transfer restrictions in the PDPA. Under Section 26 of the PDPA, an organisation must not transfer any personal data to a country or territory outside Singapore except in accordance with prescribed requirements to ensure that the transferred personal data will be accorded a standard of protection that is comparable to that under the PDPA (the transfer limitation obligation).

The prescribed requirements, as set out in the Personal Data Protection Regulations 2021 (PDPR), require the transferring organisation to ensure that the recipient of the personal data is bound by legally enforceable obligations. These “legally enforceable obligations” include any laws in the jurisdiction to which the personal data is transferred, contracts, binding corporate rules (BCRs), and any other legally binding instrument.

BCRs may be used for recipients that are “related” to the transferring organisation (eg, a parent company or subsidiary), whilst contracts may be used for data transfers to any party. In particular, the BCRs and contracts must specify the countries and territories to which the personal data will be transferred under the BCRs or contract.

In addition, under the PDPR, an overseas recipient of personal data is taken to be bound by legally enforceable obligations to provide comparable protection for the transferred personal data if it holds an Asia Pacific Economic Cooperation (APEC) Cross Border Privacy Rules (CBPR) System or Privacy Recognition for Processors (PRP) System certification (which is granted or recognised under the laws of the country or territory to which the personal data is transferred). That said, transferring organisations that are seeking to rely on this transfer mechanism should ensure that they carry out the necessary due diligence to determine that the overseas recipient is indeed CBPR or PRP-certified under the laws of the country or territory in question.

Furthermore, the PDPC has published a chapter on cloud services in its non-legally binding Advisory Guidelines on the PDPA for Selected Topics which clarifies the application of the PDPA in respect of cloud services (the “Cloud Services Guidelines”). Specifically, an organisation should ensure that the cloud service providers (CSPs) that it engages only transfer personal data in accordance with the PDPA – namely, to locations with comparable data protection regimes – or otherwise has legally enforceable obligations to ensure a comparable standard of protection for the transferred personal data.

Industry Standards and Codes of Conduct

The Multi-Tier Cloud Security (MTCS) Singapore Standard (SS584) is the primary local industry standard for determining the level of cloud security provided by CSPs. The MTCS has three levels of security with Level 1 being the base standard and Level 3 being the most stringent standard. The adoption of the MTCS is voluntary for CSPs unless they are participating in bulk tenders for government procurement of public cloud services.

Per the PDPC’s Cloud Services Guidelines, MTCS Level 3 certification could provide organisations assurance of the CSP’s ability to comply with the protection obligation under the PDPA.

The PDPC has also published the 2018 Guidelines for Cloud Outage Incident Response (COIR) (TR 62:2018). Under the voluntary COIR framework, cloud service customers (CSCs) can choose appropriate outage protection measures that would complement their business continuity/discovery recovery capabilities through a set of guidelines which assist CSCs in identifying, evaluating and negotiating protection needs with CSPs to incorporate into their service-level agreements, and sharing of COIR practices by CSPs through the same set of common parameters.

While the adoption of the COIR guidelines is voluntary, CSPs are encouraged to self-disclose their service support capabilities with respect to service outages.

Sector-Specific Regulation

Apart from the PDPA and the Cloud Services Guidelines, the use of CSPs in the financial sector is subject to additional regulation by the sectoral regulator: the MAS. In this respect, the MAS has published guidelines for financial institutions (FIs) which set out its position on cloud computing and cloud outsourcing arrangements:

• Technology Risk Management Guidelines;
• ABS (Association of Banks in Singapore) Cloud Computing Implementation Guide 2.0;
• Guidelines on Outsourcing; and
• Advisory on Addressing the Technology and Cyber Security Risks Associated with Public Cloud Adoption.

In general, these guidelines provide guidance to FIs on maintaining data, infrastructure and network security; sound practices on risk management of outsourcing arrangements; and the use of cloud computing platforms. FIs are encouraged to conduct appropriate due diligence on CSPs and evaluate the risks before entering into a cloud outsourcing arrangement. The risk assessment should also be performed periodically on existing outsourcing arrangements, as part of the approval, strategic planning, risk management or internal control reviews of the outsourcing arrangements of the FI.

Specific Issues Regarding Personal Data Protection

The transfer limitation obligation under the PDPA requires the contract or BCRs to expressly state the locations to which the personal data may be transferred. However, in the context of a CSP cloud outsourcing arrangement, an organisation may have to agree to a CSP’s standard contractual terms, which may include a term that confers discretion onto the CSP as to the exact jurisdictions to which personal data may be transferred.

According to the PDPC’s Cloud Services Guidelines, in such a situation, the organisation may be considered to have taken appropriate steps to comply with the transfer limitation obligation if:

• the CSP based in Singapore is certified or accredited as meeting relevant industry standards (such as MTCS Level 3 and ISO 27001); and
• the CSP provides assurances that all the data centres or sub-processors – in such overseas locations that the personal data is transferred to – comply with these standards.

At present, there is no specific legislation regulating the use of big data, machine learning and artificial intelligence (AI) technologies in Singapore. However, various government and regulatory agencies have developed non-legally binding frameworks to provide industry guidance on these subjects.

Applicable Frameworks

Examples of these frameworks include:

• the PDPC’s Model AI Governance Framework and its companion guide, the Implementation and Self-Assessment Guide for Organisations, which provide organisations with practical recommendations in implementing ethical principles and adopting responsible AI governance;
• the MAS’s Principles to Promote Fairness, Ethics, Accountability and Transparency (FEAT) in the Use of AI and Data Analytics in Singapore’s Financial Sector, which provides a set of principles for the use of AI in decision-making in the provision of financial products and services; and
• the MAS’s Veritas Initiative, which assists FIs in evaluating their AI and data analytics solutions against the MAS’s FEAT principles.

Notably, the PDPC’s Model AI Framework represents the efforts of Singapore’s policymakers and regulators to articulate a common approach, and a set of consistent definitions and principles in the governance of AI. Broadly, it sets out principles in four key areas, including the following.

• Internal governance structures and measures – organisations should ensure that there are clear roles and responsibilities as well as risk management and internal controls in place for the ethical deployment of AI.
• AI decision-making models – organisations should consider the risks of different AI models and determine the appropriate degree of human oversight based on the expected probability and severity of harm.
• Operations management – organisations should understand the lineage, provenance and quality of data used, as well as the transparency of algorithms chosen.
• Stakeholder interaction and communication – organisations should seek to build trust and maintain open relationships with individuals regarding the use of AI through general disclosure, transparency and policy explanations, and careful design of human-AI interfaces.

Furthermore, on 25 May 2022, the IMDA and PDPC launched A.I. Verify, which is the world’s first AI governance testing framework and toolkit for companies that wish to demonstrate responsible AI in an objective and verifiable manner. Developers and owners can verify the claimed performance of their AI systems against a set of principles through standardised tests. A.I. Verify packages a set of open-source testing solutions together, including a set of process checks into a toolkit for convenient self-assessment. The toolkit will generate reports for developers, management, and business partners, covering major areas affecting AI performance.

In 2018, the Advisory Council on the Ethical Use of AI & Data was established to advise the government on ethical, policy and governance issues arising from the use of data-driven technologies in the private sector and to support the Government in providing general guidance to businesses to minimise ethical, governance and sustainability risks, and to mitigate adverse impact on consumers from the use of data-driven technologies.

Autonomous Vehicles

In the context of autonomous vehicles (ie, self-driving cars), the Road Traffic (Autonomous Motor Vehicles) Rules 2017 provide that the trial or use of an autonomous motor vehicle on any road is prohibited unless specific authorisation is obtained. Parties wishing to do so must submit an application to the Land Transport Authority (LTA) stating matters such as the trial’s objectives, the type of autonomous vehicle to be used and its intended purposes. The LTA has the discretion to accept or reject the application and/or impose conditions.

Fake News

In the context of fake news and misinformation, POFMA was enacted to, amongst other things, prevent the electronic communication in Singapore of false statements of fact. Notably, POFMA prohibits the making or alteration of an automated computer program (ie, an AI “bot”) with the intention of using it to communicate or enabling any other person to communicate a false statement of fact in Singapore (Section 8, POFMA).

Data Protection

The collection and use of large datasets for big data analytics, machine learning and AI may trigger data protection concerns, especially where such data sets involve personal data (see 3. Cloud and Edge Computing for the definition of personal data). Moreover, it is not uncommon for AI systems to utilise data mining solutions to obtain data from third-party sources, in some cases without having obtained consent from the affected individual.

Another significant data protection challenge is the increasing ease with which researchers can re-identify individuals from previously pseudonymised or anonymised datasets by matching them against publicly available information or other datasets.

Intellectual Property

At present, it remains unclear whether and how existing intellectual property frameworks may be applied in protecting AI-generated works. Under Singapore copyright law, the creative elements of a work must be attributable to a natural person in order for copyright protection to vest.

AI-related inventions may, however, be patentable. In April 2019, the Intellectual Property Office of Singapore (IPOS) launched an Accelerated Initiative for Artificial Intelligence (AI2) scheme under which AI-related patent applications may be granted on an accelerated basis if various conditions are satisfied – most notably, the application must be an AI invention. Additionally, under the Patents Act 1994, in order for an invention to be patentable, it must be new, involve an inventive step, and be capable of industrial application.

Furthermore, the new Copyright Act 2021, which came into force on 21 November 2021, includes a new exception to copyright infringement for the purpose of computational data analysis (regardless of whether commercial or non-commercial). This exception allows inventors seeking to use lawfully accessed data in their AI machines for computational data analysis, under certain conditions, without the fear of being liable for copyright infringement.

While Singapore has not enacted any laws which specifically govern the internet of things (IoT), there are existing laws and regulations which may apply to various aspects of such IoT projects or applications. Additionally, the IMDA and the IT Standards Committee’s IoT Technical Committee have developed and published Technical References in this area (eg, TR 47:2016, TR 50:2016 and TR 64:2018)

Telecommunications

Firstly, the IMDA, as established under the Info-communications Media Development Authority Act 2016 (IMDA Act), is responsible for regulating, amongst others, the telecommunications sector in Singapore pursuant to its exclusive privilege under the Telecommunications Act 1999 (TA).

Under the TA, “telecommunications” is defined very broadly as any transmission, emission or reception of signs, signals, writing, images, sounds or intelligence of any nature by wire, radio, optical or other electromagnetic systems whether or not such signs, signals, writing, images, sounds or intelligence have been subjected to rearrangement, computation or other processes by any means in the course of their transmission, emission or reception.

As the primary legislation governing the telecommunications industry in Singapore, the TA sets out the broad licensing and regulatory framework for the telecommunications sector. Unless an exemption applies, the IMDA’s jurisdiction may potentially extend to the licensing of IoT projects or applications if such projects or applications may be regarded as involving the operation or provision of telecommunications systems or services under the TA. Where applicable, such persons would therefore need to comply with the general obligations and any specific conditions of approval under their respective licences which have been granted by the IMDA (see 7. Telecommunications for more details on the licensing of telecommunication systems and services).

Data Protection

The applicability of the PDPA may be triggered insofar as the IoT device in question can be used to collect personal data in Singapore and transfer it wirelessly through the network. In such a case, the organisation that collects or transfers the personal data (which may be an IoT service provider) will need to comply with the data protection obligations in respect of such data, unless an exception applies.

Cybersecurity

The primary cybersecurity legislation is the Cybersecurity Act 2018 (CA), which sets out a framework for the designation and monitoring of critical information infrastructure (CII) in essential sectors such as energy, info-communications, media, water, healthcare, banking and finance, security and emergency services, aviation, land transport, maritime, and services relating to the functioning of the Government.

Under the CA, a computer or computer system may be designated by the Commissioner of Cybersecurity as CII if it is:

• necessary for the continuous delivery of an essential service, and the loss or compromise of the computer or computer system will have a debilitating effect on the availability of the essential service in Singapore; and
• the computer or computer system is located wholly or partly in Singapore.

Owners of CII are subject to various obligations under the CA, including reporting of cybersecurity incidents, conducting of regular cybersecurity audits and risk assessments, and furnishing of relevant information.

Recently, on 11 April 2022, the licensing framework for cybersecurity service providers came into effect, along with the Cybersecurity (Cybersecurity Service Providers) Regulations 2022. The licensing framework, which covers cybersecurity service providers providing penetration testing services and managed security operations centre monitoring services, aims to improve the standard of cybersecurity service providers and address the information asymmetry between consumers and service providers.

With the increasing adoption of IoT solutions amongst various stakeholder groups – including consumers, enterprises and governments – organisations which deploy IoT projects or solutions in the essential sectors discussed above may wish to pay particular attention to the possibility of their systems being designated as CII and subjected to the obligations under the CA.

The IMDA has also published an IoT Cyber Security Guide which provides baseline recommendations, foundational concepts and checklists relating to the security aspects of IoT systems.

Regulation of the Media Sector

Similar to telecommunications, the IMDA is also responsible for the regulation of the media (including broadcasting and film) sector. With regard to the media sector, “media” is defined in the IMDA Act as:

• a film (as defined in the Films Act 1981);
• a newspaper (as defined in the Newspaper and Printing Presses Act 1974);
• a broadcasting service (as defined in the BA);
• a publication (as defined in the Undesirable Publications Act 1967); or
• such other medium of communication of information, entertainment or other matter to the public (or a section of the public) as the Minister may specify by order in the Gazette.

Generally, the provision of audio-visual services in or from Singapore (eg, TV or radio) would be regulated under the BA and the IMDA may grant a broadcasting licence for the provision of:

• free-to-air nationwide, localised and international television services;
• subscription nationwide, localised and international television services;
• special interest television services;
• free-to-air nationwide, localised and international radio services;
• subscription nationwide, localised and international radio services;
• special interest radio services;
• audiotext, videotext and teletext services;
• video-on-demand services;
• broadcast data services; and
• computer on-line services.

In addition, the BA provides for a class-licensing regime, under the Broadcasting (Class Licence) Notification and Broadcasting (Class Licence – Broadcasting to Digital Display Panels) Notification 2020, for:

• audiotext, videotext and teletext services;
• broadcast data services;
• virtual area network computer on-line services;
• computer on-line services that are provided by internet content providers and internet service providers; and
• distribution network digital display panels services.

In particular, it should be noted that “internet content providers” is broadly defined under the Broadcasting (Class Licence) Notification to include any individual in Singapore who provides any programme, for business, political or religious purposes, on the World Wide Web through the internet, as well as any corporation or group of individuals (whether registrable or incorporated under Singapore law or not) who provides any programme on the World Wide Web through the internet.

In such cases, it is possible that companies operating video-sharing platform services on YouTube, for example, may be automatically deemed to be class-licensed, and must comply with the conditions of the class licence and the Internet Code of Practice. Amongst other requirements, broadcasting class licensees may be asked by the IMDA to remove or prohibit the broadcast of certain programmes which the IMDA has deemed to be against the public interest, public order or national harmony or to offend against good taste or decency.

Furthermore, from 1 February 2023, the amended Broadcasting Act will contain measures to regulate providers of OCS. The IMDA will also be empowered to issue directions to deal with egregious content that can be accessed by Singapore users on an OCS (see 1. Metaverse for more details on the Online Safety Act).

Eligibility, Fees and Charges

In general, broadcasting companies are required to be Singapore-incorporated companies or the registered local branches of a foreign company in order to hold a “relevant licence” (unless exempted by the Minister for Communications and Information).

A “relevant licence” (which excludes class licences) refers to any free-to-air licence or any broadcasting licence under which a subscription broadcasting service may be provided, and which permits broadcast which is capable of being received in 50,000 dwelling-houses or more.

Different types of broadcasting licences may come with different licence fees, for instance:

• for free-to-air nationwide television service licences, licensees must pay 2.5% of their total revenue or SGD250,000 per annum, whichever is higher, and provide a performance bond of SGD200,000;
• for free-to-air nationwide radio service licences, licensees must pay 2.5% of their total revenue per annum, and provide a performance bond of SGD200,000 in the form of a banker’s guarantee;
• for subscription international television service licences (for satellite television service broadcasters), licensees must pay SGD5,000 per annum, and provide a performance bond of SGD50,000 in the form of a banker’s guarantee, if they are not based or registered in Singapore;
• for nationwide subscription television service licences, licensees must pay 2.5% of their total revenue or SGD50,000 per annum, whichever is higher, and provide a performance bond of SGD200,000; and
• for niche television service licences (which applies to providers of television services targeting niche market segments and over-the-top television services delivered through the internet), no licence fee is required

For completeness, yearly fees are payable for certain types of services under the Broadcasting (Class Licence) Notification as follows.

• Teletext services – SGD2,000.
• Computer on-line services by internet access service providers – SGD1,000.
• Computer on-line services by non-localised internet service resellers – SGD100 (if less than 500 user accounts) or SGD1,000 (for 500 accounts or more).
• Computer on-line services by localised internet service resellers – SGD100 for each premise at which the computer on-line services are provided.

As noted in the definition of “telecommunications” (see 5. Internet of Things), the licensing and regulatory framework for telecommunication systems and services under the TA is sufficiently broad to cover almost every technological application, even if there are no specific references to individual applications such as RFID tags, Voice over Internet Protocol (VoIP) or instant messaging. That said, service-specific issues may be covered in various regulations, codes of practice, standards of performance, directions, advisory guidelines and licences issued by the IMDA pursuant to its powers under the TA.

For instance, issues pertaining to the licensing and use of the radio frequency (RF) spectrum and the operation of radio stations and networks are regulated under the Telecommunications (Radio-communication) Regulations, while the Telecommunications (Dealers) Regulations set out the framework in relation to the manufacturing, importation and sale (amongst other things) of telecommunication equipment.

It should also be noted that although the IMDA was formally established on 1 October 2016 as a converged regulator for both the info-communications and media sectors, in general, the telecommunications and media sectors continue to be governed by separate regulatory frameworks. For instance, the TA does not presently apply to the licensing of broadcasting services or any broadcasting apparatus, which falls under the Broadcasting Act 1994 instead. On 2 May 2022, the Code of Practice for Competition in the Provision of Telecommunication and Media Services 2022 (Telecom and Media Competition Code) came into operation. The Telecom and Media Competition Code was issued by the IMDA to promote the efficiency and competitiveness of both the media and telecommunications industry.

Licensing for the Operation and Provision of Telecommunication Systems and Services

Generally, licences for the operation and provision of telecommunication systems and services in Singapore would fall into either of two categories, namely facilities-based operations (FBOs) or services-based operations (SBOs), and where RF spectrum is required for the provision of wireless services, additional licensing is required under the Telecommunications (Radio-communication) Regulations.

Taking the provision of VoIP services as an example, it is noted in the IMDA’s Guidelines on Licensing and Regulatory Framework for IP Telephony Services in Singapore that applicants need to first obtain either an FBO or SBO licence from the IMDA in order to provide IP telephony services. IP telephony services are defined as any VoIP services offered using an E.164 telephone number allocated to customers in Singapore, which allow customers to make and receive voice, data and/or video calls using the same IP telephone number from any domestic or overseas location where broadband internet access is available.

An FBO licence is required if applicants intend to deploy and/or operate any form of telecommunication network, systems and/or facilities for the purpose of providing telecommunication (eg, IP telephony services) and/or broadcasting services outside of their own property boundaries to third parties (which may include other licensed telecommunication operators, business customers or the general public).

In contrast, only an SBO licence is required if applicants intend to lease telecommunication network elements from any FBO licensee to provide telecommunication services (eg, IP telephony services), or to resell the telecommunication services of such FBO licensees to third parties.

While there are two licensing schemes under the SBO framework (ie, class-licensing and individual licensing), operators that lease international transmission capacity for the provision of their services are usually required to obtain an SBO (Individual) Licence. The SBO (Class) Licence is a licensing scheme where the terms and conditions are gazetted in the Telecommunications (Class Licences) Regulations. Anyone who provides the services within the scope of the SBO (Class) Licence will be deemed to have read and agreed to the terms and conditions of the class licence.

The IMDA’s licensing framework is formulated on a hierarchical basis, with FBO licences placed on a higher level than SBO licences. This means that FBO licensees are able to offer telecommunication services that would ordinarily require an SBO licence without having to obtain a separate SBO licence, but not vice versa. If an SBO licensee subsequently wishes to undertake FBO-related activities – such as deploying or operating any telecommunication network, systems or facilities – it will need to apply for a new FBO licence to replace its existing SBO licence.

Eligibility, Fees and Charges

In terms of eligibility, the IMDA’s current practice is to issue FBO licences only to Singapore-incorporated companies, although such companies can be wholly owned by a foreign entity. In the case of SBO (Individual) licences, local registered branches of foreign companies are eligible to apply, while SBO (Class) licences may also be held by limited liability partnerships or limited partnerships. Further details regarding the application process for an FBO or SBO licence and the information required can be found in the respective application guidelines issued by the IMDA on their website.

In terms of applicable fees and charges, FBO licensees are subject to a minimum annual recurrent licence fee of SGD80,000 or SGD200,000 (depending on whether the licensee is an FBO or a designated public telecommunication licensee), with further fees chargeable as a percentage of their incremental annual gross turnover (AGTO) exceeding SGD50 million as follows:

• 0.8% of the incremental AGTO between SGD50 million and SGD100 million; and
• 1% of the incremental AGTO above SGD100 million.

SBO (Individual) licensees are subject to a minimum annual recurrent licence fee of SGD4,000, with further fees chargeable as a percentage of their incremental AGTO exceeding SGD50 million as follows:

• 0.5% of the incremental AGTO between SGD50 million and SGD100 million; and
• 0.8% of the incremental AGTO above SGD100 million.

As of the time of writing, there are no annual recurrent licence fees for SBO (Class) licensees. Depending on the type of services provided, SBO (Class) licensees may need to make a one-time payment of SGD200 upon registration with the IMDA.

Data Security

One challenge that some organisations may face when entering into IT service agreements relates to obligations surrounding data security, particularly where personal data is involved. It is common for organisations seeking to engage third-party IT service providers to enter into a written data processing agreement which sets out each party’s roles and responsibilities in relation to the personal data in question, as well as the specific security measures that would be put in place.

In addition, the PDPC requires organisations to design and organise their security arrangements to fit the nature of the personal data held by the organisation and the possible harm that might result from a security breach, and identify reliable and well-trained personnel responsible for ensuring information security.

In cases where the contract for IT services is with an FI, for instance, the organisation should be aware that FIs in Singapore are also subject to the regulations and guidelines promulgated by the MAS. These regulations and guidelines include but are not limited to the MAS’s Guidelines on Outsourcing, Notice on Technology Risk Management, Notice on Cyber Hygiene, and Technology Risk Management Guidelines, which, amongst other things, may require FIs to exercise strong oversight of arrangements with third-party service providers to ensure system resilience as well as maintain data confidentiality and integrity. As a result, there may be a need for organisations entering into IT service agreements with FIs to include applicable provisions in relation to the conduct of security audits and reporting with regard to breaches or cyber-attacks.

Data Localisation

In Singapore, there are no express laws in relation to data localisation or data residency. The PDPC has notably taken a stance against data localisation and emphasised the importance of the free flow of data through coherent and efficient cross-border data transfer mechanisms.

Where the IT service agreement involves a cross-border transfer of personal data (eg, storage of data in the cloud or in a data centre located outside of Singapore, or the solution involves cloud computing), the organisation should also consider compliance with cross-border data transfer requirements under the PDPA and PDPR (see 3. Cloud and Edge Computing (Specific Issues Regarding Personal Data Protection section) for more details on the transfer limitation obligation and specific issues for CSPs).

Digital Identity

Launched in 2003, SingPass is a secure personal authentication system that allows users to access various government services online. Under the National Digital Identity initiative, SingPass, MyInfo (a service that automatically fills out selected personal details for online forms) and MyInfo Business (a service that enables businesses to manage the use of its corporate and applicant’s personal data for simpler online transactions) were brought together to provide greater transactional security and ease of use. All SingPass users are automatically provisioned with a MyInfo profile which allows users to provide personal data once to digital services and then consent to have their personal data retrieved from government sources to pre-fill forms for digital transactions.

As SingPass and MyInfo are managed by the Government Technology Agency (“GovTech”), the data protection provisions in the PDPA do not apply to them and other public agencies. Instead, data management by public agencies is governed by the Public Sector (Governance) Act 2018 and guided by the Government Instruction Manual on Infocomm Technology & Smart Systems Management (previously known as IM8).

However, private organisations utilising SingPass and MyInfo to facilitate their transactions are subject to the obligations under the PDPA. As personal data on these platforms is often sensitive data, organisations should take into account the sensitivity of the personal data and implement robust policies and procedures to ensure appropriate levels of protection and security. For instance, when collecting national identification numbers, organisations should comply with the Advisory Guidelines on the Personal Data Protection Act for NRIC and Other National Identification Numbers issued by the PDPC.

Electronic Signatures

The ETA makes a distinction between electronic signatures, secure electronic signatures and digital signatures.

An electronic signature could conceivably take various forms such as a scanned physical signature or typing one’s name where a signature is required.

According to Section 18 of the ETA, an electronic signature will be recognised as a “secure electronic signature” if, through the application of a specified security procedure or a commercially reasonable security procedure agreed to by the parties, it can be verified that, at the time the signature was made, it was:

• unique to the person using it;
• capable of identifying such person;
• created in a manner or using a means under the sole control of the person using it; and
• linked to the electronic record to which it relates in a manner such that if the record were changed the electronic signature would be invalidated.

The key difference between a secure electronic signature and an electronic signature is that the former raises the following statutory presumptions pursuant to Section 19 of the ETA:

• In any proceedings involving a secure electronic record, it is presumed, unless evidence to the contrary is adduced, that the secure electronic record has not been altered since the specific point in time to which the secure status relates.
• In any proceedings involving a secure electronic signature, it is presumed, unless evidence to the contrary is adduced, that the secure electronic signature is the signature of the person to whom it relates; and the secure electronic signature was affixed by that person with the intention of signing or approving the electronic record.

Furthermore, the ETA defines a digital signature as an electronic signature consisting of a transformation of an electronic record using an asymmetric cryptosystem and a hash function such that a person having the initial untransformed electronic record and the signer’s public key can accurately determine: (i) whether the transformation was created using the private key that corresponds to the signer’s public key; and (ii) whether the initial electronic record has been altered since the transformation was made. A digital signature can be treated as a secure electronic signature if the digital signature was created during the operational period of a valid certificate and is verified by reference to the public key listed in such certificate. The certificate must also meet the prescribed requirements under the ETA and be considered trustworthy.

On 5 November 2020, GovTech launched the “Sign with SingPass” service. This was rolled out through GovTech’s subsidiary, Assurity Trusted Solutions, an accredited Certification Authority under the ETA. The “Sign with SingPass” service allows SingPass users to electronically sign certain documents with some government agencies and private sector businesses. Signatures made using the “Sign with SingPass” service can be regarded as secure electronic signatures under the ETA.

However, the use of electronic or digital signatures in the following matters warrants further consideration:

• the creation or execution of a will;
• the creation, performance, or enforcement of an indenture, a declaration of trust or a power of attorney, with the exception of implied, constructive and resulting trusts;

• any contract for the sale or other disposition of immovable property or any interest in such property; and
• the conveyance of immovable property or the transfer of any interest in immovable property.