Executive Coach International, a Singapore-based coaching and personal development firm, has been warned by the Personal Data Protection Commission (PDPC) regarding the disclosure of a former employee's personal information.
PDPC probed the case in 2015 and found a director had shared highly sensitive information about a former staffer's drug problem and "issue with infidelity" with more than 50 members of a closed WhatsApp group comprising staff and volunteers, as reported by The Straits Times.
Under the Personal Data Protection Act, it is an offence to collect, use or disclose personal data from an individual without consent. Breaches can draw penalties of up to S$1 million or an order to ensure compliance, among other things.
This is the first case where a breach under the Act has been committed via an instant messaging platform.
The Straits Times reported that the commission in its decision issued last week said the company's ignorance of what happened was immaterial under the Act, highlighting that the director was a senior member of the firm.
It added that the disclosures were made in the context of an ongoing spat arising from her unamicable departure from the company. The director had expressed his disappointment with her and claimed she had tried to undermine his authority and convince others to leave the company.
This, the commission decided, meant the personal data was disclosed in the course of work by the director, and the "disclosure is treated as a disclosure by the organisation for which the organisation is responsible". It added the disclosures were internal and not to the public at large.
PDPC ruled that a "calibrated" approach should be taken based on the circumstances of the case, and issued a warning to the company for breaching two sections of the Act.
A spokesperson for Executive Coach International spoke to Human Resources, saying the firm respects the PDPC's decision, and deeply regrets the incident, adding that since then strict internal measures have been implemented to ensure that it never happens again.
The spokesperson said: "Two years later and with the PDPC's decision, we hope our mistake creates awareness for other organisations, whichever their field, on how to provide a safer environment for everyone, especially in an instant, digital world."
Human Resources has reached out to the PDPC for comments.
Photo / 123RF