PDPA Singapore 17: Collection, use and disclosure without consent: the First and Second Schedule exceptions

What does 17 require?

An organisation may collect, use or disclose personal data without consent, or collect it from a source other than the individual, only in the circumstances and subject to the conditions in the First Schedule (vital interests, matters affecting the public including publicly available data, legitimate interests where the public benefit outweighs the adverse effect and an assessment is made, business asset transactions, business improvement purposes for use within the organisation or group, research, and other listed circumstances) or the relevant Part of the Second Schedule, and may then collect, use or disclose for purposes consistent with the original exception; the legitimate-interests and business-improvement exceptions do not permit direct marketing and the legitimate-interests exception requires disclosure of the reliance.