The Singapore High Court recently considered in Bellingham, Alex v. Reed, Michael  SGHC 125 (Alex v. Reed) the loss or damage needed for a private action to be brought against an organisation for a breach of the PDPA.
The court held that a mere loss of control over personal data, or distress over such loss of control, was insufficient.
Right of private action
The then-section 32 of the PDPA (now section 48O of the amended PDPA) creates a right of private action, and allows for any person who suffers loss or damage as a result of contraventions of certain provisions in the PDPA to seek relief in civil proceedings.
In this case, the respondent, Michael Reed (Reed), was added as a plaintiff in civil proceedings commenced against the appellant, Alex Bellingham (Bellingham), by Bellingham’s former employer. After joining his new company, Bellingham had contacted Reed using Reed’s personal email address, to discuss certain investment opportunities with him. Reed argued that Bellingham had, by contacting him on his personal email address, used Reed’s personal data without his consent.
Significance of judgment in clarifying the scope of loss or damage
A plaintiff bringing an action under section 32 has to show (a) contravention of one or more provisions in part IV, V or VI of the PDPA and (b) that they suffered loss or damage directly as a result of such contravention.
Presently, the PDPA does not define ‘loss or damage’, and so the scope of loss or damage under section 32(1) was being decided for the first time.
Reed contended that a wide interpretation of ‘loss or damage’ should be used and include distress and loss of control over personal data. Bellingham contended that a narrow interpretation should be used and refer to the heads of loss or damage under common law (pecuniary loss, damage to property, and personal injury, including psychiatric illness).