← Back to the grievance

Recreated source · executive briefing

Core regulatory failures

Faithful recreation of the executive briefing; personal identifying details removed. (“The Applicant” is the complainant.)

Executive briefing: condominium managing-agent refusal, regulatory endorsement, and the erosion of PDPA access rights

1. Primary issue summary

• The core dispute centres on two Management Corporations (MCSTs) and their Managing Agents (MAs) denying the Applicant statutory access to CCTV footage under PDPA section 21.
• The denials relied on legally insufficient grounds (citing generic privacy risk, or limiting access solely to law enforcement), compounded by the PDPC’s subsequent delayed investigation — effectively legitimising the permanent deletion of the footage.

2. Core regulatory failures

Procedural failure

• The Managing Agents for both condominiums initially denied the Applicant’s verbal and written access requests — one citing broad “PDPA privacy concerns,” the other asserting access could only be granted via “police direct/order.”
• The PDPC disregarded the verbal request (17 April 2024) and written request (25 April 2024), instead adopting a later internal date (29 April 2024) as the official request trigger, thereby excusing the automatic deletion of the footage on 30 April 2024.
• The PDPC exhibited significant delay, taking over three months to reach out to the Managing Agents after the complaint was lodged (4 May 2024) — by which time the footage had been deleted.
• The PDPC repeatedly invoked civil or criminal “discovery” processes as the appropriate channel, stating the PDPA (s. 21) was “not the appropriate channel” — effectively deferring its statutory mandate.

Legal / policy failure

• The Managing Agent’s refusal — citing that access could only be given to law-enforcement agencies — directly contradicts the published “Advisory Guidelines for Management Corporations,” which explicitly state that MCSTs “may not limit the provision of access to personal data only to law enforcement or other relevant authorities.”
• The PDPC failed to enforce the Preservation Obligation (PDPA s. 22A) for MCST 4599 by concluding that because the data was overwritten on 30 April 2024, before the formal refusal on 2 May 2024, the deletion was lawful — creating a “serious loophole” that negates access rights.
• For MCST 3615, the PDPC ruled that the CCTV footage did not reasonably fall within the scope of “personal data” (PDPA s. 2(1)), ignoring the contextual information the Applicant provided (date, time, police report details) that already enabled on-site security staff to identify the individual.
• The PDPC/IMDA later endorsed the referral to police as a “protocol,” elevating it to a retrospective legal justification — even though the Managing Agents themselves never formally cited a Fifth Schedule exception for refusing the request.

3. Requested legislative intervention

• Clarify the statutory trigger date for data preservation under PDPA s. 22A.
• Prohibit non-statutory grounds (e.g. police referral) for rejecting PDPA s. 21 requests.
• Mandate verification of data-retention policies in cases involving auto-deletion.

4. Suggested follow-up questions

• Why was the Managing Agent’s illegal refusal ground regarding exclusive police access not deemed a PDPA breach?
• How does the PDPC ensure statutory preservation when organisations rely on short auto-overwrite cycles?
• What mechanism prevents the regulator from retrospectively justifying refusal grounds not cited at the time of denial?

5. Disclaimer

I am willing to be corrected, and I am not asserting that I must be right. However, the documentary record shows unresolved inconsistencies between the PDPA and the PDPC’s decisions in this case. I relied on the PDPA, and referred to the PDPC’s Advisory Guidelines only to illustrate these inconsistencies because the Guidelines state that they reflect the PDPA. PDPC later disowned the Guidelines by saying they are not legal advice, yet did not explain why its decisions departed from the PDPA itself. Because PDPC repeatedly changed its reasoning and stopped communicating immediately after each new reasoning was examined, there is a black hole of missing information. In the absence of clear explanations, I cannot be convinced that the decisions are consistent with the PDPA.