Problem
Jimmy works for an association. One of his responsibilities is coordinating events/programmes for a specific group of the organisation's members; around 30 of them. He needs to keep these 30 members informed of certain events and is the point of contact for them. These members have specific needs different from the other members of the association.
Members of the association provide their personal particulars, including contact numbers, upon joining as members. The contact numbers of these 30 members were provided to Jimmy to enable him to engage them. Jimmy set up a Whatsapp chat group and included all 30 members in the group without consulting them first. Jimmy did not have a "work mobile phone" and was using his personal mobile number to set up the chat group.
Jimmy resigned from the association and exited the chat group but many of the members' contact numbers were still saved on his phone. A few months after resigning, Jimmy decided to run for elections of the association governing body. He put himself forward for the post of president (Jimmy is also a member and is eligible to contest the election). As part of canvassing for votes, Jimmy messaged the members whose numbers he still had saved on his phone. One of the members complained to the association as to why Jimmy still had her number when he is no longer an employee of the association and suggested it could be a breach of her privacy and of the Private Data Protection Act (PDPA).
The association approached you (as a consultant) for your views and advice on the matter. They specifically wanted your views on:
a) Whether there was a breach of PDPA
b) Whether there are any potential risks of breach of PDPA
c) Advice on Mitigating those risks.
Examine the events and appraise if there have been any breaches or potential breach of PDPA. You should also propose on possible action(s) the association can take to avoid breaches, and provide concluding remarks.