Singapore Court of Appeal rules in landmark decision that emotional distress is actionable under the Personal Data Protection Act 2012

The Personal Data Protection Act 2012 (“PDPA”) provides a right for a person who has suffered “loss or damage” to seek relief in private civil proceedings. In Reed, Michael v Bellingham, Alex (Attorney-General, intervener) [2022] SGCA 60, it was held that emotional distress directly suffered as a result of a contravention of the PDPA may constitute “loss or damage” for which a private action could be commenced. The decision was made in relation to Section 32 of the version of the PDPA in force as of 2018 but remains relevant as the substance of the former Section 32 is now set out in Section 48O of the current version of the PDPA. The Singapore Court of Appeal’s decision is a reversal of the High Court’s decision in Bellingham, Alex v Reed, Michael [2021] SGHC 125.

This article is a follow-up to our previous update, which was published on 21 June 2021

Key Takeaways:

• An individual who brings a private action under the PDPA must show that “loss or damage” was directly suffered as a result of the offending organisation’s contravention of their obligations under the PDPA. The actionable heads of “loss or damage” under the PDPA may include emotional distress and are not limited to the recognised heads under common law (i.e., pecuniary loss, damage to property and personal injury, including psychiatric injury). But the loss of control of personal data does not constitute actionable “loss or damage” under the PDPA.
• It is a full defence for a defendant to prove that he was “acting the course of his employment with an organization” when the relevant breaches occurred. However, the legal burden lies with the defendant to prove this on the balance of probabilities.
• Lodging a complaint with the Personal Data Protection Commission (“PDPC”) and commencing a private action are not mutually exclusive avenues for recourse. An aggrieved individual who first makes a complaint to the PDPC may subsequently commence a private action for the same loss.

The Procedural History

Alex Bellingham (“Bellingham”) was a marketing consultant who used personal data he obtained from his former employers to market a new fund to Michael Reed (“Reed”). Bellingham had obtained Reed’s name and investment information from his former employers and, using Reed’s name, found Reed’s email address on LinkedIn. Reed subsequently joined Bellingham’s former employers in an application under the PDPA seeking, among other things:

(a) an injunction restraining Bellingham from using, disclosing or communicating to any person any of Reed’s personal data; and

(b) an order that Bellingham surrenders and delivers up to Reed all copies of Reed’s personal data obtained by Bellingham.

The District Court in IP Investment Management Pte Ltd and others v Alex Bellingham [2019] SGDC 207 granted the orders sought by Reed, finding that Bellingham had contravened the PDPA and caused loss and damage directly to Reed as a result of the said contravention.

On appeal, the High Court set aside the orders of the District Court on the basis that “loss or damage” under the PDPA’s right of private action referred only to the recognised heads of “loss or damage” in common law (i.e., pecuniary loss, damage to property and personal injury including psychiatric injury) and excluded emotional distress or loss of control of personal data.

On further appeal, the Court of Appeal allowed the appeal in full and restored the orders made by the District Court.

Key Findings of the Court of Appeal

Emotional distress is an actionable loss or damage under the PDPA

Disagreeing with the High Court’s analysis

In the earlier proceedings, the High Court opined that the right of private action under the PDPA created a statutory tort – and on this basis, interpreted the term “loss or damage” narrowly to refer to the heads of loss or damage applicable to torts under common law (e.g., pecuniary loss, damage to property, personal injury including psychiatric illness).

The Court of Appeal disagreed. While the PDPA created a statutory tort, this had to be distinguished from the tort of breach of statutory duty. A statutory tort had to be interpreted with reference to the rules of statutory construction, whereas the tort of breach of statutory duty had to be interpreted with reference to common law. The High Court was thus erroneous in holding that the scope of the right of private action under the PDPA ought to be confined to the recognised heads of loss or damage under common law.

A purposive interpretation of the right to private action under the PDPA

The Court of Appeal adopted a purposive interpretation of the relevant section and held that emotional distress ought to be an actionable loss or damage under the PDPA.

First, while there exists a common law principle that emotional distress, per se, is not actionable, the Court of Appeal considered the context and wording of the relevant section of the PDPA and found that Parliament had intended to displace the common law principle with the enactment of the PDPA.

Second, a wider interpretation which includes emotional distress as an actionable head of “loss or damage” would better promote the general purpose of the PDPA to “govern the collection, use and disclosure of personal data by organisations in a manner that recognises both the right of individuals to protect their personal data and the need of organisations to collect, use or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances” and the specific purpose of creating the right of private action to empower individuals to protect their personal data.

In this regard, the Court of Appeal noted that the PDPA was enacted by Parliament to address the increasing risk of misuse of personal data occasioned by the “vast and ever-increasing volume of personal data being collected and processed”. Therefore, Parliament must have intended the remedial options in the PDPA (including the right of private action) to be effective in guarding the right of individuals to protect their personal data. On the contrary, if emotional distress was not actionable under the PDPA, the right of private action would be of significantly less utility since it is not uncommon for emotional distress to be the only loss or damage suffered from the contravention of PDPA obligations.

To the suggestion that there would be a floodgate of litigation if emotional distress were actionable, the Court of Appeal observed that there were two control mechanisms to ameliorate this possibility: (a) there must be a direct causal connection between the loss or damage suffered and the contravention of the PDPA; and (b) the emotional distress must, in any event, be significant (i.e., trivial annoyance or the negative emotions that are part of the vicissitudes of life will not suffice).

The Court of Appeal, therefore, held that emotional distress was actionable through the right of private action under the PDPA, even though no pecuniary loss had been suffered. Singapore’s position is, therefore, now aligned with that in England and Wales insofar as it concerns a claim for damages for emotional distress suffered due to a breach of one’s data privacy (see Vidal-Hall v Google Inc [2015] EWCA Civ 311).

Loss of control of personal data is not an actionable loss or damage

In addition to emotional distress, Reed also claimed that he had suffered “loss or damage” owing to the loss of control of his personal data. The Court of Appeal, however, rejected this argument and held that such loss of control, per se, was not actionable. In particular, the court observed that there would inevitably be a loss of control over one’s personal data in the event of a breach of PDPA obligations. Thus, to allow such loss of control, per se, to constitute actionable “loss or damage” under the PDPA would render the phrase “loss or damage” in the relevant section tautologous. It is a canon of interpretation that Parliament does not legislate in vain.

Reed had suffered emotional distress and was entitled to the injunctions sought

Having decided that emotional distress was an actionable head of “loss or damage” under the PDPA, the Court of Appeal considered whether Reed had, on the facts, suffered emotional distress that was actionable. The court adopted an approach which involved the consideration of the following non-exhaustive list of factors:

(a) the nature of the personal data involved in the breach (for instance, financial data is likely to be deemed sensitive data);

(b) the nature of the breach (for example, whether the breach was one-off, repeated, or continuing);

(c) the nature of the offender’s conduct (for instance, proof of fraudulent or malicious intent may support an inference that the claimant was more severely affected);

(d) the risk of future breaches of obligations under the PDPA that would cause emotional distress to the claimant; and

(e) the actual impact of the breach on the claimant.

The above inquiry is fact sensitive, and the court will adopt a part-objective, part-subjective approach in conducting the inquiry (although greater weight will be attached to objective indicia of emotional distress).

On the facts, the Court of Appeal found that Reed was “undoubtedly perturbed” and had indeed suffered emotional distress notable enough for it to be actionable. An appeal in full was thus allowed, and the District Judge’s orders were restored.

Other Notable Themes Raised

Section 4(1)(b) defence

Section 4(1)(b) of the PDPA provides that the data protection obligations under the PDPA do not impose any obligation on an “employee acting in the course of his or her employment with an organisation.” The Court of Appeal’s obiter remarks on this section are notable. While Section 4(1)(b) was held to be inapplicable to the facts, the remarks by the court are useful in understanding how the section may be applied as a defence.

The gist of the court’s remarks are as follows:

(a) A defendant may rely on Section 4(1)(b) as a full defence to avoid liability for any breach of the PDPA. However, the legal burden lies with the defendant to prove on the balance of probabilities that he was acting in the course of his employment when the relevant breaches occurred.

(b) The principle of vicarious liability, which renders both employer and employee liable, is fundamentally incompatible with Section 4(1)(b), which excludes an employee from liability under the PDPA if adequately proven. Further, the imposition of vicarious liability is strict, whereas the employer’s liability under the PDPA is fault-based (see Section 11 of the PDPA).

(c) If Section 4(1)(b) is sought to be relied on as a defence, it should be pleaded as early as possible so that adequate evidence may be adduced to prove that the defendant was “acting in the course of his employment with an organization” when the relevant breaches occurred.

The individuals’ choice of remedy under the PDPA

The Court of Appeal also made remarks concerning an individual’s choice of remedy under the PDPA – specifically, to refer a complaint to the PDPC or to commence a private action.

While Section 29 (now, section 48I) allows an aggrieved individual to bring a complaint to the PDPC for it to investigate whether the allegedly delinquent organisation had complied with the PDPA (and therefore take action as it sees fit to punish and/or deter the contravention of the statute), Section 32 (now, section 48O) allows the aggrieved individual to bring a private action for compensation of the “loss or damage” suffered by reason of the breaches. Both provisions were therefore complementary as they fulfilled different roles. In other words, even if an aggrieved individual elects to refer a complaint to the PDPC first, he may nevertheless still commence a private action for the same loss.

Food for Thought

While the Court of Appeal’s decision is certainly welcomed for its clear guidance on various important aspects of the PDPA, we make the following observations.

First, the right of private action under the PDPA allows, among other things, damages to be obtained. As emotional distress is a fundamentally qualitative experience, it remains to be seen how the Singapore courts will handle such a quantification exercise.

Second, the Court observed that one of the “control mechanisms” in Section 32(1) of the PDPA (now, Section 48O(1)) was that the “loss or damage” must be directly suffered as a result of a contravention of the obligations under the PDPA. There was, however, no elaboration on the principles underlying this direct causal requirement. It, therefore, remains to be seen as to what extent the concepts of factual causation, legal causation and remoteness will be part of the Court’s inquiry.

Third, contractual terms on limitation of liability and indemnities in the context of agreements for data processing or data sharing are commonly drafted to address concerns relating to financial penalties which may be imposed by data protection authorities such as the PDPC in the event of a data breach. Given the Court’s more permissive views on the availability of the right to private action, organisations may wish to consider whether such contractual terms in their agreements adequately address risks of civil liability under the PDPA, in addition to the possibility of financial penalties imposed by the PDPC.

Finally, organisations should have adequate policies and practices in place to ensure that personal data which they collect is adequately protected. These should include steps to prevent departing employees from taking with them personal data relating to customers. Further, this case illustrates the need to promptly address concerns raised by individuals in relation to the collection and use of their personal data. Had Bellingham and his then-employers acted promptly to address Reed’s concerns, the parties may well have avoided protracted litigation on this matter.

This article is produced by our Singapore office, Bird & Bird ATMD LLP. It does not constitute as legal advice and is intended to provide general information only. Information in this article is accurate as of 5 October 2022. The authors would like to thank Chloe Wong for her contributions to this article.