Protecting Personal Data: What Businesses Should Know About PDPA and FaceApp

If you’re a millennial, you might know the latest social media hype that people from Hollywood celebrities to even your 10-year-old niece is following – FaceApp. If you’re not a millennial, no worries, we’re here to explain what the odd trend is all about.

What is FaceApp?

Source: The Jonas Brothers, Twitter.

No, your eyes are not playing tricks on you. Also no, the Jonas Brothers have in fact not done any time traveling. They’ve just used FaceApp.

FaceApp is an Artificial Intelligence (AI) program that allows users to apply different filters to selfies, has reportedly updated a feature that adds wrinkles, jowls, and silver hair to your face for a glimpse of what you’ll look like a few decades down the road.

So why is everyone so excited to upload their FaceApp photos online? The answer seems to be pretty simple: The one thing that has made the app catch fire so quickly is how realistic it looks.

Apart from its ability to create hyperrealistic views of your future grandma/ grandpa self, it has fallen into some criticisms about the use of data.

What happens to your data when you upload it to FaceApp?

FaceApp’s terms and conditions are extremely broad. Its permissions explicitly claim a right to a “perpetual, irrevocable, nonexclusive, royalty-free, worldwide, fully-paid” license once users upload their photos to the app.

That means that if you allow FaceApp access to your photos, you are also granting the app permission to use the photos for commercial purposes. Simply put, they can do whatever they want with your photos. Now, that’s major.

Let’s not put all of the blame on FaceApp, shall we? All of your other social media platforms are not angels either. Over the years we’ve been voluntarily giving out our data to them. But we can expect stricter laws on data protection in the years to come.

Source: Personal Data Protection Commission.

How can I prevent my company from falling into the data violation trap?

Let’s be real – who even reads the terms and conditions? Apparently, for FaceApp’s case, someone did. That person then caused this internet wildfire about the importance of data protection.

In Singapore, business-to-consumer (B2C) companies have to comply with the Personal Data Protection Act (PDPA). That means if your company does not have a Data Protection Officer (DPO), or are doing telemarketing to contacts that have listed themselves in the Do Not Call (DNC) Registry, your company is not complying with the PDPA. But the above are only a few things that explain how you may not be compliant with the PDPA.

What about business-to-business (B2B) companies then?

You’re in luck today because here at iSmart Communications, we are all experts in growing businesses by generating qualified B2B leads. That also means that we’re also experts in complying with the PDPA for B2B purposes.

The Personal Data Protection Commission (PDPC) mentioned that organizations sending business-to-business (B2B) marketing messages through phone calls, SMS or fax are not required to comply with the DNC provisions. The PDPC recognizes that B2B marketing messages may be essential for the day-to-day operations between businesses and note that consumers will not be affected by the exclusion.

If you think B2B companies are exempted from complying with the PDPA, you may be wrong. Think about the personal data of your employees. What about your business database for marketing purposes? Is it stored in a safe environment that only authorized personnel in the company is allowed access? These are all areas that need to be considered when dealing with any form of data.

The coverage of the PDPA in Singapore is wide-ranging and no single organization or company can declare with certainty that they can be exempted from the PDPA. So it is important for everyone to be prepared for PDPA compliance instead of thinking that the Act does not apply to them.