Search for:

In brief

On 25 May 2021, the Singapore High Court provided long-awaited clarifications on the scope of private actions under the Personal Data Protection Act 2012 (PDPA). It was held that in order to succeed in a private action under the PDPA, the claimant must suffer loss or damage that falls within the common law heads of loss or damage (such as pecuniary loss, damage to property, and personal injury including psychiatric illness) directly as a result of contravention of certain PDPA provisions. Notably, the Singapore High Court held that distress and loss of control over personal data do not fall within such heads of loss. Claimants ought to take into account the above requirements in considering whether to bring a private action under the PDPA. Where no such loss or damage is suffered, claimants would still have recourse to alternative remedies under the PDPA to end such non-compliance, by requesting the Personal Data Protection Commission (PDPC) to impose directions for non-compliance or financial penalties, albeit such remedies do not seek to compensate the claimant.
 


Key takeaways

  • Private action claimants must suffer direct loss or damage that falls within the common law heads of loss or damage (such as pecuniary loss, damage to property, and personal injury including psychiatric illness), which excludes distress and loss of control over personal data.
  • Alternatively, claimants may seek to compel the defaulting organization to comply with the PDPA, by requesting the PDPC to impose directions for non-compliance or financial penalties.
  • Organizations are not required to obtain consent for the collection, use or disclosure of publicly available personal data, save where such publicly available personal data is obtained through unlawful use of other personal data.

In depth

On 25 May 2021, the Singapore High Court clarified the scope of private actions under the then Section 32(1) of the PDPA (“Section 32(1)“) in its judgment of Bellingham, Alex v. Reed, Michael [2021] SGHC 125 (“Judgment“). While Section 32(1) has been repealed and replaced by the current Section 48O of the PDPA, it is likely that the Singapore courts will follow the principles laid out in the Judgment in applying Section 48O of the PDPA.

Background

Bellingham was a former employee of a fund management business under the IP Investment Management group of companies (“IPIM Group“). After Bellingham left IPIM Group to join a rival company (i.e., Q Investment Partners Pte Ltd (QIP)), he used personal data previously obtained from IPIM Group to contact a number of IPIM Group’s clients to explore new business opportunities, including Reed. Concerned that QIP had access to information about his investments with IPIM Group, Reed sought clarifications with IPIM Group and Bellingham.

Subsequently, among others, Reed pursued a claim against Bellingham in respect of his own personal data and the District Court granted a modified prohibitive injunction against Bellingham, which prohibited Bellingham from further using, disclosing or communicating Reed’s personal data. Bellingham was also required to destroy any personal data of Reed relating to the prohibitive injunction.

Judgment

In the Judgment, the Singapore High Court allowed the appeal of Bellingham against the District Court’s decision, and held that Reed does not have a right of private action under Section 32(1), given that he had not suffered any “loss or damage.” In arriving at this conclusion, the Singapore High Court examined whether the term “loss or damage” should be interpreted narrowly to refer to the heads of loss or damage under common law (such as pecuniary loss, damage to property, and personal injury including psychiatric illness), or widely to include distress and loss of control over personal data as well.

The court ruled that “loss or damage” in Section 32(1) should be interpreted narrowly in Singapore to only include common law heads of loss or damage such as pecuniary loss, damage to property, and personal injury including psychiatric illness. As such, loss of control of personal data and distress did not fall under this interpretation. 

In determining whether “loss or damage” in Section 32(1) should be interpreted narrowly or broadly, the Singapore High Court considered, among others, the following:

  • No right of private action for all non-compliances. Section 32(1) does not provide a right of action for every situation where there is non-compliance of the specific PDPA provisions under the scope of Section 32(1). Given so, the meaning of “loss or damage” under Section 32(1) will not cover pure loss of control over personal data, given that this would inevitably cover all non-compliance of the specific PDPA provisions under the scope of Section 32(1).
  • Statutory tort. Given that Section 32(1) created a statutory tort, the meaning of “loss or damage” should be construed in this context.
  • Parliamentary intent. Notably, the court decided against adopting positions in foreign jurisdictions such as Canada, New Zealand, Hong Kong, and the United Kingdom, which legislations made express references to some form of emotional harm (unlike Singapore’s PDPA). This is because the foreign positions were driven by the need to recognize the right to privacy, while there is no constitutional right to privacy in Singapore. Instead, the position in Singapore, as expounded during the Second Reading of the Personal Data Protection Bill, is to enhance Singapore’s competitiveness and strengthen Singapore’s position as a trusted business hub, alongside safeguarding an individual’s personal data against misuse. As such, a narrow interpretation of “loss or damage” would further this intention.

Separately, the Singapore High Court held that while organizations are not required to obtain consent for the collection, use or disclosure of publicly available personal data, such personal data may not be obtained through unlawful use of other personal data.

An appeal against the decision has been made by Reed to the Singapore Court of Appeal. As such, it remains to be seen if the narrow approach will be the final position of Singapore Courts towards private actions made under the PDPA. Claimants should continue to keep watch over developments in this space and, in the meantime, consider the above principles when deciding on whether to commence a private action under the PDPA.

For more information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.

We thank Victoria Wong, Jordan Tong and Hung Ping Lee for their helpful input.

Author

Ken Chia is a member of the Firm’s IP Tech, International Commercial & Trade and Competition Practice Groups. He is regularly ranked as a leading TMT and competition lawyer by top legal directories, including Chambers Asia Pacific and Legal 500 Asia Pacific. Ken is an IAPP Certified International Privacy Professional (FIP, CIPP(A), CIPT, CIPM) and a fellow of the Chartered Institute of Arbitrators and the Singapore Institute of Arbitrators.

Author

Daryl Seetoh is an associate in Baker McKenzie's Singapore office.

Author

Alex Toh is a senior associate in Baker McKenzie's Singapore office.

Write A Comment