O2 Advertising slapped with SG$10k fine for retaining personal data from 2015

Advertising firm O2 Advertising has been fined SG$10,000 by the Personal Data Protection Commission (PDPC) for retaining personal data collected during an ad campaign in 2015. According to the case filing seen by Marketing, O2 did not cease retention of individuals' personal data and failed to put in place security measures.PDPC was alerted by an individual who had participated in O2's ad campaign back in 2015. The affected party found certain of his personal data accessible over the Internet without his consent. A Google search results of his name and NRIC number included a link to a database maintained by O2 Advertising, said the statement from PDPC. The case filing stated that the database contained personal data of numerous individuals including the individual’s.Upon concluding the investigation, PDPC stated that O2 is required to cease retaining personal data once the purpose for which the data was collected has been served, unless further retention can be justified for legal or business purposes.O2 had admitted that it had overlooked deleting the data and that there were no reasonable grounds to continue retaining them after the engagement with the client ceased in 2016.PDPC, however, found that the data was only deleted by O2 after it was informed by the commission of the complaint, therefore breaching section 25 of the Personal Data Protection Act.In addition, the investigation led by PDPC also concluded that O2 had not conducted any vulnerability scanning on its website since it went live five years ago. The commission found flaws in the security of O2's website during its investigation. As such, O2 is required to put in place a data protection officer as well as develop and implement data protection policies and practices. Marketing has reached out to O2 for comment.In the course of settling this decision, PDPC also took into consideration O2's "weak" financial performance for the past few years has been and its current "dire financial straits". The case filing also stated that O2 was a victim of a fraud in 2016 involving the misappropriation of company funds amounting to approximately SG$3.2 million. This resulted in former finance manager Gene Chong sentenced to 11 years in jail for defrauding the ad agency over eight years.Chong, who worked with the agency for 15 years and resigned in 2015 for unspecified reasons, was responsible for paying suppliers and handling petty cash, The Straits Times previously reported. The firm filed a police report against Chong on 24 March 2016 for misappropriating company funds, and she faced her sentence in April 2018.O2 has over the years serviced clients such as La Mer, Bobbi Brown, Bentley, Nikon, SK Jewellery, Microsoft, Singapore Police Force and many others. The firm provides creative services, digital services and media planning and buying for clients, and is also part of the Ad Planet Group which includes Kinetic, Ace Daytons, Ace Communication, Industrie and 3Aces.[Digital Marketing Asia Conference 2019 in Singapore is back! Join us on 8-9 October as we hear from experienced practitioners and thought-leaders on how they are managing complex digital transitions and reimagining new ways for their marketing to become more customer focused, agile and interactive. Check out the agenda and book your seats today.](Photo courtesy: 123RF)