Personal Data Protection Act (PDPA)

The PDPA provides protection for personal data in Singapore by recognising the rights of individuals to protect their personal data and the need for organisations to only reasonably and appropriately collect, use and disclose such data.

Breaching PDPA obligations

Organisations are often concerned about their exposure to regulatory actions when a breach of personal data protection laws occurs. Financial penalties have been imposed by the Personal Data Protection Commission (PDPC) on errant organisations. These penalties may well go up since the law now permits the PDPC to levy penalties of up to 10% of the organisation’s annual turnover in Singapore of the organisation.

Reed, Michael v Bellingham, Alex (Attorney-General, intervener) [2022] SGCA 60 (Reed v Bellingham)

Besides regulatory actions, organisations may also find themselves exposed to civil suits brought by an affected individual. In the case of Reed v Bellingham, Singapore’s Court of Appeal clarified that an individual who has suffered emotional distress directly as a result of a contravention of the PDPA by an organisation may seek relief as against that organisation.

The case of Reed v Bellingham

Reed v Bellingham concerns the unauthorised use of personal data by Mr Bellingham who had been involved in the management of an investment fund set up by his former employers. After leaving his employer, he used personal data obtained in the course of his previous employment and contacted some of his former employers’ customers, including Mr Reed, who was one of the plaintiffs.

The case was heard in the District Court and Mr Reed was successful in obtaining (a) an injunction to restrain Mr Bellingham from using or disclosing his personal data; and (b) an order that Mr Bellingham undertake to destroy his personal data.

On appeal to the High Court, the District Court’s orders were set aside as it was found that Mr Reed did not suffer any “loss or damage”, and therefore, did not have a right of action. The High Court reached this conclusion on the basis that neither the emotional distress, nor the loss of control of personal data suffered by Mr Reed were the types of “loss of damage” recognised under the PDPA and in particular, section 32 of the PDPA (the predecessor statutory provision of the current section 48O of the PDPA).

Mr Reed appealed to the Court of Appeal.

Emotional distress is now recognised as a form of Loss or Damage

Emotional distress to be included

In contrast to the High Court, the Court of Appeal held that a wider interpretation of the phrase “loss or damage”, such that it includes emotional distress, should be adopted. The apex court held that this interpretation would better promote the PDPA’s purpose of providing robust protection for individuals’ personal data.

The Court of Appeal reiterated that the right of private action must be an effective means by which affected individuals may enforce their right to protect their personal data. The practical application of such a right would be considerably curtailed if emotional distress was excluded. This is because it is often difficult for affected individuals to establish that they had suffered personal or psychiatric injury, or pecuniary loss, directly arising out of an organisation’s PDPA breach. In a nod to the typical consequences of an organisation’s breach of the PDPA, the court acknowledged that it is not uncommon for emotional distress to be the only loss or damage suffered by affected individuals.

What constitutes emotional distress?

While the Court of Appeal did not strictly define what constitutes emotional distress, noting that this was a fact-sensitive inquiry and has to be determined on the circumstances of a particular case, it did provide some guidance; a court ought to consider:

1. nature of personal data involved in the breach (e.g. financial data would likely be more sensitive);
2. nature of the breach (e.g. whether the breach is a systemic issue, or an isolated incident);
3. nature of the respondent’s or defendant’s conduct (e.g. whether the respondent or defendant had a fraudulent or malicious intent);
4. risk of future breaches of the PDPA causing emotional distress to the claimant; and
5. actual impact of the breach on the claimant.

Emotional distress suffered in the case of Reed v Bellingham

On the facts, the Court of Appeal found that the complainant had suffered emotional distress. The Court of Appeal considered, among other things, Mr Bellingham’s refusal to provide Mr Reed with an undertaking not to misuse his personal data in the future, and that the personal data in question was of a sensitive nature. The complainant’s appeal was therefore allowed, with the District Court’s orders restored in full.

Loss of control over one’s personal data not included under “loss or damage”

While the Court of Appeal was prepared to adopt a wide definition of “loss or damage” to include emotional distress, it was not prepared to recognise that a loss of control of one’s personal data would fall within the scope of “loss or damage”. This is because contravention of the PDPA would inevitably involve some form of loss of control of personal data. Therefore, such loss would not be sufficient to establish an individual’s right of private action.

Key Takeaways

Individuals can now claim for emotional distress against organisations

The Court of Appeal has certainly provided clarity as to when an individual may commence a suit against an organisation which has contravened the PDPA. Organisations in Singapore ought to take notice that they may be exposed to potential claimants who may seek relief due to emotional distress in relation to a breach of the PDPA.

Importance of reviewing and enhancing data security measures for organisations

From a risk perspective, it is especially vital for organisations during peacetime to take stock as to (a) the types of personal data that they are holding; and (b) whether the organisation has implemented the necessary policies and procedures to ensure their compliance with the PDPA. If an organisation is holding onto highly sensitive personal data, it may wish to review the need to hold on to such data and also enhance their security and administrative measures to protect the data.

Significant increase in civil litigation involving non-compliance with the PDPA unlikely

Organisations need not fear that Reed v Bellingham has opened the floodgates for affected individuals to file suits. First, the affected individuals must still show a direct causation between the organisation’s non-compliance of the PDPA, and the “loss or damage” that they have suffered. Second, the Court of Appeal has established a framework to guide the courts in their inquiry as to whether or not emotional distress was suffered. Third, applying the principle that “there is no legal recourse for minimal loss”, putative claimants would need to be careful in deciding whether or not to bring an action since costs may even be ordered against a winning claimant under such circumstances.