Question 1
At a project launch, salesperson Nadia asks a visitor, Mr Tan, to pose for a photo with her, and he agrees. The next day, without asking him again, she posts the photo on her public Facebook page, tagged with his name, to advertise the launch. Mr Tan complains that he never agreed to appear in her advertising, and Nadia protests that he consented when he posed for the photo, so she assumed she was free to use it as she wished.
Consider the following statements.
- (i) Consent to collect personal data automatically includes consent to disclose it publicly.
- (ii) The PDPA governs the collection, use and disclosure of an individual's personal data.
- (iii) Mr Tan's agreement to pose for the photo amounts to consent to collect his personal data.
- (iv) Posting the photo publicly to advertise the launch requires separate consent to disclose.
Show the answer and full explanation
Answer: B
The rule. The PDPA controls three actions — collect, use, disclose — each needing its own consent. Consenting to a photo is consent to collect; publishing it to advertise is a disclosure that needs separate consent. Collect consent does not roll up into disclose consent.
Why B is correct. (ii) the three regulated actions, (iii) posing as consent to collect, and (iv) publishing needing separate disclose consent are correct. (i) is false — collect ≠ disclose.
The other options.
- D adds the false (i), that collect consent includes disclose consent.
- A drops (iii), the consent-to-collect point.
- C drops (ii), the scope of the PDPA.
Exam note. Collect, use, disclose — three separate consents. A photo consent is not a publishing consent.
The PDPA controls three actions — collect, use, disclose — each needing its own consent →