Right of private action
The then-section 32 of the PDPA (now section 48O of the amended PDPA) creates a right of private action, and allows for any person who suffers loss or damage as a result of contraventions of certain provisions in the PDPA to seek relief in civil proceedings.
In this case, the respondent, Michael Reed (Reed), was added as a plaintiff in civil proceedings commenced against the appellant, Alex Bellingham (Bellingham), by Bellingham’s former employer. After joining his new company, Bellingham had contacted Reed using Reed’s personal email address, to discuss certain investment opportunities with him. Reed argued that Bellingham had, by contacting him on his personal email address, used Reed’s personal data without his consent.
Significance of judgment in clarifying the scope of loss or damage
A plaintiff bringing an action under section 32 has to show (a) contravention of one or more provisions in part IV, V or VI of the PDPA and (b) that they suffered loss or damage directly as a result of such contravention.
Presently, the PDPA does not define ‘loss or damage’, and so the scope of loss or damage under section 32(1) was being decided for the first time.
Reed contended that a wide interpretation of ‘loss or damage’ should be used and include distress and loss of control over personal data. Bellingham contended that a narrow interpretation should be used and refer to the heads of loss or damage under common law (pecuniary loss, damage to property, and personal injury, including psychiatric illness).
The High Court adopted a purposive interpretation in its determination
The court accepted that Reed’s email address was publicly available as it could be seen on his LinkedIn account. Consent would not be required to use that data, pursuant to the then-section 17, when read in conjunction with paragraph 1(c) to the Third Schedule of the PDPA. However, Bellingham conceded that he would not have been able to find Reed’s email address without the use of Reed’s name. Such name, together with Bellingham’s knowledge of Reed’s investment when he was working with his former employer, had been “unlawfully” used without Reed’s consent.
The court applied a purposive interpretation of ‘loss or damage’ under section 32(1) of the PDPA, and referred to the heads of loss or damage applicable to torts under common law (e.g., pecuniary loss, damage to property, and personal injury, including psychiatric illness). The court considered that this was consistent with and would further the specific purpose of section 32(1) of the PDPA as a statutory tort.
In particular, the court ascertained that the intent of section 32(1) of the PDPA was not to confer a right of action in every case where there is a contravention. Doing so would render the term ‘loss or damage’ otiose. In every case, there would inevitably be loss of control over personal data. Hence, section 32(1) cannot have been intended to apply where the alleged loss or damage is simply a loss of control over personal data.
The court considered the various statements made in Parliament when the PDPA bill was debated upon, and noted that while there were express references to some form of emotional harm, Parliament decided to refer to ‘loss or damage’ without any reference to any form of emotional harm or loss of control over personal data. As such, the court was of the view that Parliament’s intention was to exclude emotional harm and loss of control from section 32(1) of the PDPA.
The court also noted that the position in Singapore differs from the positions in Canada, New Zealand, Hong Kong, the EU and the UK, where an individual’s right to privacy is primarily based on constitutional, civil or human rights. There is no general right to privacy under Singapore law. The PDPA takes a more holistic approach in recognising both the right of individuals to protect their personal data and the need of organisations to process it in accordance with the requirements in the PDPA.
Concluding remarks
The judgment in Alex v. Reed is a welcome clarification in establishing the threshold before an individual may commence a private action under section 32 of the PDPA. Where an individual has not suffered any loss or damage, remedies can still be sought through the Personal Data Protection Commission, whose powers include giving directions to the infringing organisation to: (a) stop collecting, using or disclosing personal data in contravention of the PDPA and/or (b) destroy all personal data collected in contravention of the PDPA.
The ‘publicly available data’ exception to consent should be read narrowly. If publicly available data is obtained through the unlawful use of some other personal data, then the exception in the PDPA does not apply, and consent will be required.
The High Court has granted Reed leave to appeal, and Reed has filed his appeal pursuant to the leave granted. We will provide an update on any further developments in due course.
Reed Smith LLP is licensed to operate as a foreign law practice in Singapore under the name and style, Reed Smith Pte Ltd (hereafter collectively, "Reed Smith"). Where advice on Singapore law is required, we will refer the matter to and work with Reed Smith's Formal Law Alliance partner in Singapore, Resource Law LLC, where necessary.
Client Alert 2021-155
