Personal Data Protection Order, 2025 · As enacted · Part · Preliminary
32. Improper use of personal data
Official textFrom Attorney General's Chambers, unchanged
If-
(a} an individual makes use of personal data in the possession or under the control of an organisation or a public agency;
the use is not authorised by the organisation or public agency;
{c) the individual does so -
knowing that the use is not authorised by the organisation or public agency; or
reckless as to whether the use is or is not authorised by the organisation or public agency; and
the individual, as a result of that use -
obtains a gain for the individual or another person;
causes harm to another individual; or
causes a loss to another person, the individual is guilty of an offence and liable on conviction to a fine not exceeding $5,000, imprisonment for a term not exceeding 2 years or both.
In proceedings for an offence under subsection (1), it is a defence to the charge for the accused to prove, on a balance of probabilities, any of the following-
proceedings
"proceedings" means any civil, criminal or administrative proceedings by or before a court, tribunal or regulatory authority that is related to the allegation of - (aJ a breach of an agreement; 13 8th. JANUARY, 2025 (b) a contravention of any written law or any rule of professional conduct or other requirement imposed by any regulatory authority in exercise of its powers under any written law; or (c) a wrong or a breach of a duty for which a remedy is claimed under any law;
35
(a} that-
the personal data in the possession or under the control of an organisation or a public agency that was used was, at the time of the use, publicly available; and
where the personal data was publicly available solely because of an applicable contravention, the accused did not know, and was not reckless as to whether, that was the case;
the accused used the personal data in the possession or under the control of the organisation or public agency -
as permitted or required by or under any other written law
(other than this Order);
as authorised or required by an order of court;
in the reasonable belief that, and was not reckless as to whether, the accused had the legal right to do so; or
in any other circumstances, or for any other purpose, prescribed.
For the avoidance of doubt, subsection (2) does not affect any obligation or limitation imposed on, or prohibition of, the use of personal data in the possession or under the control of an organisation or a public agency by or under any other written law.
personal data
"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
In this section, "applicable contravention" means a contravention of section 31(1) or 33(1).
Terms defined in this Act
gain
Defined · s 30"gain" means - {a} a gain in property or a supply of services, whether temporary or permanent; or {b) an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of remuneration;
harm
Defined · s 30"harm", in relation to an individual, means - {a} any physical harm; or {b) harassment, alarm or distress caused to the individual;
loss
Defined · s 30"loss" means - {a} a loss in property or a supply of services, whether temporary or permanent; or (b) a loss of an opportunity to earn remuneration or greater remuneration or to gain a financial advantage otherwise than by way of remuneration, but does not include, in relation to an individual, the loss of personal data about the individual.
organisation
Defined · s 2"organisation" includes any individual, company, association or body of persons, corporate or unincorporated, whether or not- (a} formed or recognised under the law of Brunei Darussalam; or (bJ resident, or having an office or a place of business, in Brunei Darussalam;
personal data
Defined · s 2"personal data" means data, whether true or not, about an individual who can be identified - (a} from that data; or (bJ from that data and other information to which the organisation has or is likely to have access;
proceedings
Defined · s 2"proceedings" means any civil, criminal or administrative proceedings by or before a court, tribunal or regulatory authority that is related to the allegation of - (aJ a breach of an agreement; 13 8th. JANUARY, 2025 (b) a contravention of any written law or any rule of professional conduct or other requirement imposed by any regulatory authority in exercise of its powers under any written law; or (c) a wrong or a breach of a duty for which a remedy is claimed under any law;
public agency
Defined · s 2"public agency" includes - (a} the Government, including any ministry, department, agency, or organ of State; (b) any tribunal appointed under any written law; or (c) any statutory body as the Minister may, by notification published in the Gazette, specify to be a public agency for the purposes of this Order;
publicly available
Defined · s 2"publicly available", in relation to personal data about an individual, means personal data that is generally available to the public, and includes personal BRUNEI DARUSSALAM GOVERNMENT GAZETTE data which can be observed by reasonably expected means at a location or an event- (a} at which the individual appears; and (b} that is open to the public.
Part
Appeals
Part
Investigation and Offences
Part