The Singapore Court of Appeal held in a recent decision that while emotional distress constitutes “loss or damage” for which the right of private action can be brought under Section 48O(1) of the Personal Data Protection Act 2012 of Singapore, a loss of control of personal data would not constitute “loss or damage.”
IP Investment Management Pte. Ltd. (IPIM) and IP Real Estate Investments Pte. Ltd. (IPRE) (collectively, the “Employers”) are connected companies in the business of managing funds. The Employers and IP Investment Management (HK) Ltd (IPIM HK) are part of a group referred to as IP Global.
Alex Bellingham was originally employed by IPRE as a marketing consultant and was later seconded to IPIM HK. Among other things, Bellingham’s role involved management of an investment fund known as the Edinburgh Fund. The investors in the Edinburgh Fund had disclosed personal data to IPIM and IPRE for the purposes of managing their investment. The Edinburgh Fund was scheduled to be terminated in the second half of 2018 with the investors to exit their investment in the Edinburgh Fund during that period.
In 2017, Bellingham left the employment of IPRE and joined a competitor of IPIM, Q Investment Partners Pte Ltd (QIP). In August 2018, Bellingham contacted some investors in the Edinburgh Fund, including Michael Reed. In an email to Reed, Bellingham made reference to his impending exit from the Edinburgh Fund and introduced possible investments with QIP. Reed raised concerns about the fact that Bellingham knew of his name, personal email address and investment activity in the Edinburgh Fund.
The above culminated in the Employers commencing a private action in the State Courts under Section 32 of the Personal Data Protection Act (PDPA) (the statutory predecessor of Section 48O of the PDPA) against their former employee, Bellingham. The Employers sought an injunction restraining Bellingham from using certain personal data belonging to Reed, and other customers, and an order for the respondent to deliver up said data. Reed was subsequently added as a plaintiff in the action.
The district judge denied relief to the Employers on the basis that they lacked legal standing to bring the action, holding that Section 32 of the PDPA only confers a right of private action upon the person whose personal data has been misused and not on any other entity. However, the district judge granted Reed (1) an injunction restraining Bellingham from using, disclosing, or communicating Reed’s personal data, and (2) an order that Bellingham undertake to destroy Reed’s personal data that was in his possession.
Bellingham filed an appeal in the Singapore High Court, which held that while Bellingham had contravened the relevant sections of the PDPA in respect of Reed’s personal data, Reed had not suffered any “loss or damage” within the meaning of Section 32(1) of the PDPA. While Reed’s case was that he suffered loss of control of his personal data and emotional distress, the Singapore High Court held that neither of these two types of losses was recognised under the Section and set aside the two orders made by the district judge.
Reed subsequently filed an appeal in the Singapore Court of Appeal to reverse the decision of the Singapore High Court.
The Singapore Court of Appeal held in Michael Reed v. Alex Bellingham [2022] SGCA 60 that a wider interpretation of “loss or damage” under Section 32 of the PDPA is preferred and would include emotional distress. The Singapore Court of Appeal considered that a wider interpretation is more consistent with both the general and specific purposes of the PDPA for several reasons:
The Singapore Court of Appeal set out certain limiting principles. The emotional distress must have been suffered directly as a result of a contravention of the relevant provisions of the PDPA. Moreover, even if emotional distress is an actionable head of loss, there is no legal recourse for minimal loss. Trivial annoyance or negative emotions that form part of the vicissitudes of life will not be actionable.
The Singapore Court of Appeal also clarified that the mere loss of control over personal data is not an actionable head of loss or damage under Section 32, as every contravention of the relevant provisions of the PDPA would result in such loss of control.
On the facts of the appeal, the Court of Appeal found that Reed had in fact suffered emotional distress as a result of Bellingham’s breach of the relevant PDPA provisions and that such emotional distress was a form of “loss or damage” within the meaning of Section 32 of the PDPA.
Among other factors, the Court of Appeal considered that Bellingham had refused to provide Reed with an undertaking not to use his personal data in future, the personal data included information about Reed’s personal investments that falls into the category of sensitive data, Reed reasonably perceived a real prospect that his personal data may be misused in future given Bellingham’s refusal to provide an undertaking, and Bellingham was evasive when confronted about the use of Reed’s personal data and dismissive of Reed’s concerns about the safety of the personal data.
The Court of Appeal therefore upheld the district judge’s grant of the injunction and undertaking order given that monetary damages would have been inadequate in light of the risk of further misuse of the personal data and the need to prevent additional emotional distress.
The decision by the Singapore Court of Appeal provides useful guidance and clarification in establishing what types of loss and damage would permit an individual to commence a private action under Section 32 of the PDPA. It is now clear that emotional distress is an actionable head of loss, while a mere loss of control is not.
Organisations that collect and/or process personal data should be aware that they may be liable for private actions under Section 32 of the PDPA even if the affected individual has not suffered any financial/pecuniary loss. Emotional distress would be an actionable head of loss, provided the emotional distress is suffered directly as a result of a contravention of the relevant provisions of the PDPA and is not minimal in nature.
Organisations should also be aware that as of 1 October 2022 and following amendments to the PDPA, the maximum financial penalty that may be imposed on an organisation by the Personal Data Protection of Commission in Singapore (PDPC) has been raised to 10% of the organisation’s annual turnover in Singapore—if its annual turnover in Singapore exceeds 10 million Singapore dollars ($7 million USD)—and 1 million Singapore dollars ($700,000 USD) in any other case. The previous maximum penalty was 1 million Singapore dollars ($700,000 USD).
In view of the wider interpretation of the right of private action following the recent Court of Appeal decision and the increase in the financial penalty cap for PDPC enforcements, organisations that collect and/or process personal data should take steps to ensure that they have in place the necessary policies, procedures, and training to ensure continued compliance with the provisions of the PDPA.
If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following: