The photograph was taken at a community garden in Bishan in 2024. By early this year, it had shown up on at least four separate commercial social media accounts, cropped, recoloured and used to advertise everything from tuition centres to protein supplements. The person in the photo found out by accident, when a friend sent a screenshot. She has never spoken to any of those businesses.
Her experience is not isolated. Across Singapore's online communities — in HDB estate WhatsApp groups from Woodlands to Bedok, on Reddit's r/singapore forum, and in feedback channels managed by the People's Association — residents are raising similar complaints: their images, taken in public or semi-public settings, are being duplicated and circulated without permission, often for commercial gain. The issue has sharpened in 2026 as AI-assisted image tools have made lifting, restyling and re-uploading a photograph a task measurable in seconds.
What Residents Say Is Happening
The complaints follow a recognisable pattern. A photo posted to a personal Instagram account, or taken by a volunteer photographer at a grassroots event, ends up repurposed on a business page. Sometimes the image is only lightly altered — a filter, a crop. Other times it has been run through a generative tool that changes clothing or background details, making a reverse-image search harder to execute. Residents describe the experience as disorienting: the legal wrong is clear in their minds, but the path to remedy is not.
Community spaces have become common flashpoints. Events held at venues like Safra clubs, the Geylang Serai Bazaar, and neighbourhood community clubs under the People's Association network are routinely photographed by multiple parties. Organisers sometimes post group shots to official pages without collecting individual releases. Those images then enter a secondary circulation chain that neither the organiser nor the subject controls.
The Personal Data Protection Commission, which administers Singapore's Personal Data Protection Act, classifies photographs of identifiable individuals as personal data. Organisations that collect or use such images for purposes beyond what was originally disclosed are, in principle, in breach of the PDPA. The Commission's 2024 advisory guidelines on photography at public and semi-public events ran to 18 pages, but awareness of those guidelines among residents and small event organisers appears limited.
The Gap Between Law and Practice
Singapore's PDPA was last substantively amended in 2020, and enforcement actions logged by the PDPC through 2025 have concentrated on data breaches at organisations holding large datasets — healthcare providers, financial firms — rather than image-specific misuse by small commercial accounts. The filing process for an individual complaint requires written submissions and can take several months to resolve, a timeline that frustrates residents who want a photograph taken down today.
Social media platforms add another layer of friction. Meta's reporting tools for Instagram and Facebook, and ByteDance's process for TikTok, require complainants to identify the specific post and verify a rights claim, a process many residents describe as opaque. A Tampines resident who found her image used in a weight-loss advertisement on TikTok in March said she filed a platform report and received an automated response. The post stayed up for another three weeks before disappearing without explanation.
Practical guidance does exist. The Consumers Association of Singapore maintains a helpline at 6100-0315 and has published a step-by-step guide for residents dealing with unauthorised commercial use of personal images. The guide recommends documenting the infringing post with timestamped screenshots before filing both a platform report and a PDPC complaint simultaneously, on the grounds that parallel tracks create faster resolution pressure. The National Library Board's digital literacy programme, which ran at 26 branch libraries in 2025, covers basic image rights awareness, though sessions focus primarily on copyright rather than personal data protection.
For residents in the short term, the most effective first move remains a direct, documented message to the account using the image, citing the PDPA and requesting removal within 48 hours. If that produces no response, a formal PDPC complaint filed at pdpc.gov.sg, supported by screenshots and a description of where the original image was taken, creates a paper trail that strengthens any subsequent escalation — whether through the Commission or through the Small Claims Tribunal, which can handle certain personal data disputes involving amounts under S$20,000.