The National Youth Council (NYC) inadvertently leaked personal data belonging to approximately 600 participants of the SG Youth Forum, sending their names and National Registration Identity Card (NRIC) numbers to a private e-mail address. The incident occurred on August 25 and was attributed to human error, according to Minister for Culture, Community and Youth David Neo.
The SG Youth Forum is an annual event organized by the NYC that brings together the Government, youth, and various stakeholders to discuss issues relevant to young Singaporeans. The latest forum was held in July at the Suntec Convention Centre, where the SG Youth Plan was unveiled.
Minister Neo addressed the data breach in response to a parliamentary question on October 7 by Abdul Mubin Abdul Mubin, a Member of Parliament for Sengkang GRC. Upon discovering the leak on the same day the file was sent, NYC promptly requested that the recipient delete the data. However, repeated attempts to contact the individual were unsuccessful. Following this, on September 3, NYC informed the affected participants via e-mail, offering an apology and outlining support channels for those concerned.
In addition to the e-mail notification, NYC staff engaged directly with participants who sought further clarification or assistance. Neo emphasized that as a public service entity, NYC operates outside the scope of the Personal Data Protection Act (PDPA) and the oversight of the Personal Data Protection Commission (PDPC). Instead, it adheres to the Public Sector (Governance) Act, which imposes penalties including up to two years’ imprisonment and fines of $5,000 for unauthorized disclosure or misuse of information.
In response to the breach, NYC is conducting a thorough review of its data transfer procedures to address existing vulnerabilities and institute stronger safeguards. The council is also examining other data handling practices within the organization to prevent future incidents.
This data leak occurred amid heightened attention to information security in Singapore, following two major breaches reported in September. Telecommunications company Simba disclosed that the personal data of more than 23,500 customers—including names, identity card numbers, dates of birth, mobile numbers, and e-mail addresses—was compromised. Separately, over 95,000 customers of Bee Cheng Hiang were exposed when a flawed AI-generated marketing e-mail displayed recipients’ addresses publicly, marking the country’s first reported AI-related data breach.
The PDPC has been notified of both cases and is investigating the Simba breach, while accepting a voluntary compliance undertaking from Bee Cheng Hiang to enhance its adherence to PDPA requirements. Minister Neo reiterated that both NYC and the Ministry of Culture, Community and Youth remain committed to safeguarding personal data in their operations.