National Youth Council mistakenly leaks personal data of 600 SG Youth Forum participants

SINGAPORE – The names and NRIC numbers of about 600 participants of the SG Youth Forum were mistakenly sent to a private e-mail address by the National Youth Council (NYC).

Minister for Culture, Community and Youth David Neo said the incident on Aug 25 was caused by a human error, and NYC is now looking to strengthen safeguards for its data handling processes.

He was responding to a parliamentary question from Abdul Muhaimin Abdul Malik (Sengkang GRC) on Oct 7.

The SG Youth Forum is an annual event organised by NYC, bringing together the Government, youths and stakeholders to discuss issues that matter to young Singaporeans.

It was most recently held in July at the Suntec Convention Centre, where the SG Youth Plan was launched.

Neo said NYC discovered the data leak on the same day the file containing the data was sent, and requested the recipient to delete the information. But repeated attempts to contact the recipient were unsuccessful.

NYC then assessed that no further action could be reasonably taken and e-mailed the affected participants on Sept 3 to notify them of the incident.

In the e-mail, NYC had apologised and offered channels for those affected to connect with them on the incident.

Neo said NYC officers had also personally engaged participants who had further queries and concerns.

As NYC is a public service agency, it is not governed by the Personal Data Protection Act and does not fall under the Personal Data Protection Commission’s (PDPC) purview.

Instead, it has to comply with the Public Sector (Governance) Act.

Under the Act, an individual found guilty of unauthorised disclosure and improper use of information can be jailed for up to two years and fined $5,000.

Neo said the NYC and the Ministry of Culture, Community and Youth take the protection of personal data seriously.

“In response to this incident, NYC has taken immediate action to review its data transfer processes and address vulnerabilities that could result in similar scenarios.

“It is also reviewing other data handling processes in the organisation to strengthen them and institute additional safeguards,” he added.

There were two major data breaches reported in the media in September.

The first involved telco Simba, which revealed that the personal information of more than 23,500 customers was compromised, including their names, identity card numbers, dates of birth, mobile numbers and e-mail addresses.

The second incident involved more than 95,000 Bee Cheng Hiang customers, in which a bad prompt generated code sent out marketing e-mails with all the recipients’ addresses visible to everyone.

It was the first reported case of AI-related data breach in Singapore.

PDPC was notified in both instances.

It is investigating the Simba case, and has accepted a voluntary undertaking by Bee Cheng Hiang to improve its compliance with the Personal Data Protection Act.

David Sun is The Straits Times’ crime correspondent. He has a background in criminology and is a licensed private investigator.