SINGAPORE: Right of private action under the Personal Data Protection Act 2012 – scope explained

Introduction

The Singapore Court of Appeal has recently clarified that ‘emotional distress’ is an actionable loss and damage under the existing right of private action of Personal Data Protection Act 2012 (“PDPA“).

Decision

Section 32 (now section 48O) of the Personal Data Protection Act 2012 (“PDPA”) provides individuals who have suffered “loss or damage” as a result of an organisation’s contravention of the PDPA with the right of private action for relief in civil proceedings against such organisations, including injunction, declaration, damages, or any other relief as the court finds appropriate.

In the Singapore Court of Appeal in Michael Reed v. Alex Bellingham (Attorney-General, Intervener) [2022] SGCA 60, the Court restored the district judge’s order for an injunction against the use, disclosure or communication by the defendant of the plaintiff’s personal data in breach of the PDPA, as the plaintiff had suffered emotional distress due to the defendant’s breach. The Court found that the following factors supported the finding of distress, including: (a) the relevant personal data involved information about the plaintiff’s personal investment; (b) the defendant had unreasonably refused to undertake not to use the personal data in the future; (c) the defendant was evasive when confronted by the plaintiff about the use of their personal data.

Crucially, in coming to this conclusion, the Court adopted a wide interpretation of what could be considered “loss or damage” under section 32 PDPA. The Court observed that: (a) Parliament had intended to provide robust protection for individuals’ personal data and parliamentary debates did not indicate that there was any reason to limit the scope of “loss or damage”; and (b) remedial options in the PDPA must be effective in guarding the right of individuals to protect their personal data – and including emotional distress as a form of loss or damage would serve this purpose.

Other takeaways

This decision confirms that the right of private action under the PDPA includes emotional distress and highlights the importance of organisations taking appropriate care with personal data so as to not open themselves up to such potential liability.

That being said, this does not mean that all forms of loss may be actionable. For example, the Court observed that loss of control of personal data would not constitute loss or damage under the PDPA. Further, Court also recognised that not every negative emotion can amount to emotional distress. Ultimately, whether emotional distress is proved will turn on the circumstances of the case.

You may read the full judgment here.

Please contact Carolyn Bigg (Partner) or Yue Lin Lee (Senior Associate) if you have any questions or to see what this means for your organisation.

DLA Piper Singapore Pte. Ltd. is licensed to operate as a foreign law practice in Singapore. Where advice on Singapore law is required, we will refer the matter to and work with licensed Singapore law practices where necessary.