Section 33
Unauthorised re-identification of anonymised information
of Personal Data Protection Order, 2025
(1)
If-fa} an individual takes any action to re-identify or cause re-identification of the individual to whom anonymised information in the possession of or under the control of an organisation or a public agency relates (referred to in this section as the affected individual);
{b) the re-identification is not authorised by the organisation or public agency; and
{c) the individual does so-
(i)
knowing that the re-identification 1s not authorised by the organisation or public agency; or
(ii)
reckless as to whether the re-identification is or 1s not authorised by the organisation or public agency, the individual is guilty of an offence and liable on conviction to a fine not exceeding $5,000, imprisonment for a term not exceeding 2 years or both.
(2)
In proceedings for an offence under subsection ( 1), it is a defence to the charge for the accused to prove, on a balance of probabilities, any of the following-
36
(a} that-
(i)
the information on the identity of the affected individual is publicly available; and
(ii)
where that information was publicly available solely because of an applicable contravention, the accused did not know, and was not reckless as to whether, that was the case;
(b} the action to re-identify or cause re-identification is -
(i)
permitted or required by or under any other written law
(other than this Order); or
(ii)
authorised or required by an order of court;
(c} the accused-
(i)
reasonably believed that the re-identification was for a specified purpose; and
(ii)
notified the Authority or the organisation or public agency of the re-identification as soon as is practicable;
(d} the accused took the action to re-identify or cause re-identification in the reasonable belief that, and was not reckless as to whether, the accused had the legal right to do so, other than for a specified purpose;
(e}
in any other circumstances, or for any other purpose, prescribed.
(3)
For the avoidance of doubt, subsection (2) does not affect any obligation or limitation imposed on, or prohibition of, the re-identification of the affected individual by or under any other written law.
(4)
In this section -
"applicable contravention" means a contravention of subsection (1);
"specified purpose" means any purpose specified in Schedule 5.
37
PART9
ENFORCEMENT