BCP - Basic Insurance Concepts and Principles Singapore Data Protection and Hygiene Questions and Answers

Question 1

A financial adviser representative stores digital copies of clients' application forms, which include NRIC numbers and health declarations, on a personal, unencrypted laptop. If this laptop is stolen, which primary obligation under Singapore's Personal Data Protection Act (PDPA) has been breached?

Accepted Answer

The Protection Obligation, as reasonable security arrangements were not made.

Answer

The PDPA's Protection Obligation requires organisations to make reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, or similar risks. Storing sensitive personal data on an unencrypted personal device fails this standard and constitutes a breach if the device is lost or stolen, leading to unauthorised access.

Question 2

To comply with the accountability principle under Singapore's Personal Data Protection Act (PDPA), what must every insurance agency, regardless of its size, do?

Accepted Answer

Appoint at least one individual as a Data Protection Officer (DPO).

Answer

The PDPA's Accountability Obligation requires an organisation to designate at least one individual as a Data Protection Officer (DPO) to be responsible for ensuring compliance with the Act. While the other options are good data hygiene practices, the appointment of a DPO is a mandatory, foundational requirement for all organisations.

Question 3

An insurance company obtains a list of phone numbers from a third-party vendor to market a new retirement plan. To comply with the Do Not Call (DNC) provisions of the PDPA, which action is mandatory before making unsolicited telemarketing calls?

Accepted Answer

Check the numbers against the national DNC Registry and only call those not listed.

Answer

The PDPA generally prohibits sending unsolicited marketing messages to Singapore telephone numbers listed in the Do Not Call (DNC) Registry. Organisations must check their call lists against the relevant DNC Register(s) before conducting telemarketing campaigns, unless they have received clear and unambiguous consent from the individual to be contacted.

Question 4

Mr. Tan provides his personal data to an insurance agent for the sole purpose of obtaining a quotation for a car insurance policy. A week later, the agent adds Mr. Tan's email to a monthly newsletter mailing list for investment-linked products. Which PDPA obligation has the agent most likely breached?

Accepted Answer

The Purpose Limitation Obligation.

Answer

The Purpose Limitation Obligation dictates that personal data can only be collected, used, or disclosed for purposes that a reasonable person would consider appropriate and for which the individual has given consent. Using the data for a new, unrelated purpose (marketing investment products) without fresh consent is a breach of this obligation.

Question 5

An insurer in Singapore discovers a cyber-attack has resulted in the unauthorised access of the NRIC numbers and policy details of 1,200 clients. According to the PDPA's mandatory data breach notification requirements, what is the insurer's primary obligation?

Accepted Answer

Notify the affected individuals and the Personal Data Protection Commission (PDPC).

Answer

The PDPA requires organisations to notify the Personal Data Protection Commission (PDPC) and the affected individuals of a notifiable data breach. A breach is considered notifiable if it results in (or is likely to result in) significant harm to individuals, or is of a significant scale (affecting 500 or more individuals). As this breach affects more than 500 people, both the PDPC and the individuals must be notified.

BCP Insurance Practice Test

BCP Insurance Practice Test

BCP - Basic Insurance Concepts and Principles Singapore Data Protection and Hygiene Questions and Answers