IAPP Certified Information Privacy Professional/Asia (CIPP-A) Exam Syllabus

- The Organisation of Economic Cooperation and Development (OECD) ‘Guidelines Governing the Protection of Privacy and Trans-border Data Flows of Personal Data.” (1980)
- The Asia Pacific Economic Cooperation (APEC) privacy principles
- Fair Information Practices (FIPs)
- Universal Declaration of Human Rights (1948)

• Political structure

- Social attitudes toward privacy and data protection
- Surveillance and identification
- Constitutional protections
- Common law protections
- Sector-specific protections

• PDPA predecessor: National Internet Advisory Committee (NIAC) 2002 Report, Report on a Model Data Protection Code for the Private Sector.
• Extraterritorial reach
• PDPA definitions
  - Personal data
  - ‘Business contact information’
  - ‘Data intermediary’
  - Publicly available
  - Survivorship
• Do Not Call Registry
  - ‘Specified message’
• PDPA in an employment setting
• Exemptions
  - Public-sector
  - Response to emergency
  - National interest
  - Investigations in legal proceedings
  - Evaluative purposes
  - Journalism and media

- Key concepts and practices

• Data protection officer
• Staff training
• Consent and exceptions to consent
• Use
• Disclosure
• Safeguarding/Security
• Accountability and openness
• Access and correction
• Retention and deletion
• Transfer out (e.g. APEC, CBPR and PRP)
• Data breach notification obligation

• Regulations and guidances
• ‘Notices on Prevention of Money Laundering and Countering the Financing of Terrorism’
• Individual’s access and rights
• Protection of customer data
• Outsourcing

- Personal Data Protection Commission (PDPC)
- Decision in appealed commissioner rulings, complaints

• Complaint-based vs. audit-based

- Commissioner guidance and published positions
- Managing consent opt-out mechanisms: their use and limitations, consent to new purposes and documentation
- Penalties and sanctions
- Policy development and implementation

• Freedom of information legislation
• Data transfers: doctrine of privity of contract for thirdparties

• Meaning under PDPO
  - Personal data
  - Publicly available data
  - Sensitive personal data
  - ‘Prescribed consent’
  - Rights of data subject
• Personal Data (Privacy) (Amendment) Ordinance 2012
  - ‘The New Guidance on Direct Marketing’
• Major Exemptions
  - Staff planning and Employment related (including Personal References)
  - Relevant process (Evaluation)
  - Crime, etc.
  - Legal proceedings, etc.
  - Legal professional Privilege and Self-incrimination
  - Health and Emergency
  - Statistics and Research
  - Journalism and news media

- Key concepts and practices

• Six Data Protection Principles (DPPs) and the Internet Data Guidance
  - DPP1: Data Collections
  - DPP2: Accuracy and retention
  - DDP3: Data Use
  - DPP4: Data security
  - DPP5: Openness
  - DPP6: Data access and correction
• Due diligence exemption and exercise
• Guidance on Personal Data Erasure and Anonymisation
• Guidance on employment matters
• Data Transfer/Export, Ordinance Section 33
  - Data processors
  - Model contracts

• Octopus Rewards Ltd.

- Decisions in appealed commissioner rulings, complaints
- Personal Data (Privacy) Advisory Committee
- Managing consent opt-out mechanisms: their use and limitations, consent to new purposes and documentation
- Enforcement notice
- Policy development and implementation

• Law reform proposals for third-party benefit exception

- Privacy incidents: trends in commissioner expectations

• Political structure

- Social attitudes toward privacy and data protection
- Surveillance and identification

• Credit Information Companies (Regulation) Act 2005

- Constitutional protections

• Article 21
• The Right to Information Act 2005
• The Protection of Human Rights Act 1993

- Common law protections (e.g. 2017 Supreme Court judgment on the Right to privacy - Puttaswamy judgment)

• Information Technology Act 2000
  - Section 43
  - Section 66A and its removal
• Information Technology (Amendment) Act 2008 (ITAA)
  - Section 43A
  - Definitions
  1. Personal data
  2. Sensitive personal data
  3. Body corporate
  4. Rights of data subjects
• Exemptions
  - Religious and social, charitable organisations
  - Non-commercial organisations
  - Non-automated data

- Section 43A and the 2011 Rules: Rules 3-8

• Privacy policies required: Rule 3
• Data protection principles: Rule 4
  - Consent and purpose limitation
  - Lawful purpose and minimal collection
  - Notice and purpose limitation
  - Retention
  - Use
  - Subject access and correction
  - Option to refuse or withdraw consent
  - Security
  - Complaint handling
• Disclosure imitations and exceptions: Rule 5
• Data processing: Rule 6
• Data export restriction: Rule 7
• Reasonable security: Rule 8
• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021

- The Ministry of Communication and Information Technology
- The Department of Electronics and Information (DeitY)
- The Telecom Regulatory Authority of India (TRAI) and Do Not Call Registry

• Banning Free Basics and Net Neutrality

- Commissioner rulings, appeals and complaints
- Penalties and sanctions

• IT Act Sections 43(b) and (g)
• IT Act Sections 72 and 72A

- Commissioner guidance and published positions
- Grievance officers
- Managing consent opt-out mechanisms: their use and limitations, consent to new purposes and documentation
- Policy development and implementation

• Data transfers: doctrine of privity of contract for third-parties

- Public-sector exemption

• National identity systems
  - SingPass
  - HKID
  - India’s UIDAI
• Legislation
• Hong Kong: PCPD Code of Practice on Identity Card Number and Other Personal Identifiers, 1997

- Data processing and export
- Intermediaries
- Extraterritorial operations

• Hong Kong
  - Chinese central government organisations
  - Media
• Singapore
  - Public-sector
  - Public authorities
  - Publicly available information
  - ‘Public agency’
  - Business contracted by Singapore government
• India
  - Limited application for ‘sensitive data’
  - Limited application to ‘providers’ not data subjects
  - Freedom of speech
  - Lack of openness