Bellingham, Alex v Reed, Michael [2021] SGHC 125

In the first private action brought under the Personal Data Protection Act (PDPA), the Singapore High Court interpreted “loss or damage” and the scope of an individual’s right to an action for relief in a civil court under the Act.

Summary

In Bellingham, Alex v Reed, Michael [2021] SGHC 125 the court denied the respondent’s right to a private action because his “loss or damage” was not pecuniary, damage to property, or personal injury. The court held that the PDPA did not include actions for emotional distress and loss of control of personal data.

The Background

The appellant, Mr. Bellingham, previously worked as a marketing consultant for a company called, IP Real Estate. He was later seconded to IPIM HK, where his role involved managing an investment fund. All the investors in the fund were customers of IPIM and IP Real Estate. IPIM and IP Real Estate had access to their personal data that was provided to them in confidence by the customers.

The appellant subsequently left the employment of IP Real Estate and joined a competitor of IPIM. He then used personal data he obtained from his former employer to contact some of IPIM’s customers to discuss and market a new fund. Mr. Reed, the respondent, was one such customer. The appellant obtained Mr. Reed’s name and investment information from IPIM, and then found his email address on Linkedin.

Mr. Reed and the former employer then applied for an injunction to prevent Mr. Bellingham to use, disclose, or communicate the personal data to anyone else. Mr. Reed argued that the appellant used his personal data without his consent and in contravention of the PDPA.

The District Court granted Mr. Reed the injunction, stating that Mr. Bellingham breached his statutory obligations under the PDPA.

Mr. Bellingham then appealed to the High Court. Although the High Court agreed that Mr. Bellingham breached the provisions of the PDPA, the question was whether Mr. Reed succeeded in proving that he suffered “loss or damages” as meant in the PDPA.

The Personal Data Protection Act (PDPA)

Section 32(1) of the PDPA, states that any person who suffers loss or damage directly as a result of a contravention of any provision in Part IV, V or VI by an organisation shall have a right of action for relief in civil proceedings in a court.

Part IV deals with consent to the collection, use, and disclosure of personal data.

Part V deals with the individual’s right to access and correct his personal data that is in the possession and control of an organisation.

Part VI deals with the organisations’ obligations as to the accuracy of personal data, the protection of personal data, the retention of personal data, and transfer of personal data outside of Singapore.

Right of Private Action

Section 32(1) thus creates a right of private action if certain conditions are met. To succeed with an action under section 32(1) the plaintiff must show:

(a) a contravention of one or more of the provisions of Part IV, V or VI; and
(b) that he suffered loss or damage directly as a result of such a contravention.

Mr. Reed alleged that Mr. Bellingham contravened sections 13 and 18 of the PDPA, which are covered under Part IV. Section 13 deals with the collection, or use, or disclosure of personal data without the individual’s consent. Section 18 deals with the purpose for which an organisation may collect, use, or disclose personal data. A reasonable person must consider such use or disclosure as appropriate in the circumstances, and the individual must be informed of the purpose.

It should be noted that the definition of “organisation” includes any individual.

Public Information

Mr. Reed’s name and email address constitute personal data under the PDPA. Although, Mr. Reed’s email address was obtained on LinkedIn, a public forum, the court held that where personal data is publicly available and obtained by the unlawful use of other personal data, such public data cannot be collected, used or disclosed without consent. Mr. Bellingham, therefore, was not allowed to use Mr. Reed’s email address without his consent.

The court, therefore, concluded that Mr. Bellingham did contravene section 13 of the PDPA by using Mr. Reed’s name to obtain and use his email address without his consent. He also used the information that Mr. Reed was an investor without his consent.

The use also exceeded what a reasonable person would consider appropriate in the circumstances (s.18).

The next issue to consider was whether Mr. Reed suffered loss or damage as a result of these contraventions.

What is the scope of loss or damage under section 32(1)?

The PDPA does not define “loss or damage.” Mr. Reed argued that that it should include distress and loss of control over personal data. Mr. Bellingham argued that it should not, a narrow common law interpretation should be followed. In common law, only pecuniary loss, damage to property, and personal injury will be included.

This was the first time the court had to decide the scope of loss or damages under the Act.

Considerations to ascertain the scope of “loss or damage”

Statements in Parliament

To decide on the scope of loss or damage the court reviewed the ministers statements in Parliament when the Personal Data Protection Bill was introduced. The court held that the express omission to include distress and loss of control (although emotional harm was mentioned in discussions) indicated that the intention was to exclude such “damage or loss.”

Ordinary Meaning

The court further considered the ordinary meaning of the words in section 32(1) and decided that it does not include loss of control over personal data. In this regard, the court remarked on the commission’s power to give directions in every case of a contravention regardless of whether there was loss or damage. The court deducted that the intent cannot, therefore, be that section 32(1) would give a right to action in every case where there is a contravention of any provisions of Parts IV, V, and VI.

Legislative Purpose – Right to Privacy

The court noted that the PDPA was developed to suit Singapore.

The purpose of the PDPA was to enhance the consumer’s protection against the misuse of personal data, and the potential economic benefits for Singapore. It would also enhance Singapore’s competitiveness as a trusted business hub.

The position in Singapore is different from other jurisdictions such as Canada, New Zealand, Hong Kong, the UK, and the EU. In those jurisdictions, data protection is based on the right to privacy.

The court referred to cases in other jurisdictions, such as Vidal-Hall and others v Google Inc (Information Commissioner intervening) [2016] QB 1003, where the English Court of Appeal held that damages for distress could be awarded even if there was no pecuniary loss. The English Court of Appeal followed a similar approach in Lloyd v Google IIc [2020] 2 WLR 484.

Nammo v TransUnion of Canada Inc [2012] 3 FCR 600 at [72], a Canadian case, awarded damages based on the vindication of the right to privacy. In a New Zealand case, Karen May Hammond v Credit Union Baywide [2015] NZHRRT 6, damages were awarded for humiliation, loss of dignity, or injury to feelings.

Singapore, however, does not have an absolute right to privacy. In this regard, the court referred to Lim Meng Suang and another v Attorney-General and another appeal and another matter [2015] 1 SLR 26 and stated that the PDPA aims to strike a balance between an individual’s right to protection of their personal data, plus enhancing Singapore’s competitiveness and reputation as a trusted business hub. The PDPA was not driven by any recognition of the right to privacy as a fundamental right.

Statutory Tort

After considering all the different arguments and approaches to define “loss or damage” for the purposes of section 32(1), the court concluded that the meaning does not have to be interpreted wider than the commonly understood meaning under general tort law. Tort law includes damages such as pecuniary loss, property damage, and personal injury. The court felt such an approach is consistent with the view that section 32(1) creates a statutory tort.

Did the respondent suffer any loss or damages?

It was not disputed that Mr. Reed did not suffer any financial loss, or psychiatric injury, or nervous shock as a result of the appellant’s contraventions. Mr. Reed submitted he suffered emotional distress and loss of control over his personal data. However, the court held that there was no evidence of emotional distress before the court.

The Court’s Decision in this Case

The court held, in any event, that distress or loss of control over personal data is not included under the common law definition of loss or damage.

The court did point out, however, that Mr. Reed was not without remedy. The Commissioner has powers under the PDPA to give directions to stop the collecting, using, or disclosing of personal data in contravention of the Act. The exercise of these powers will achieve the same objective as the injunction sought by Mr. Reed.

Leave to Appeal

The court referred to Lee Kuan Yew v Tang Liang Hong and another [1997] 2 SLR(R) 862 and granted the respondent leave to appeal since the case involves a question of general principle decided for the first time, and it is a question of importance upon which a decision of the Court of Appeal would be to the public advantage.

Comment

The case clarifies that an individual could bring a private action under the PDPA, but will only succeed if the individual can show they suffered common law tortious loss or damage, e.g. pecuniary loss, damage to property, or personal injury. It will be interesting to see if the Court of Appeal follows the same approach.

It should be noted that the PDPA was amended in 2021 after this decision. This case was decided on the PDPA as it stood in 2018. Although the same terminology for “loss or damages” was used in the new section 480 of the PDPA, it remains to be seen whether “loss or damages” will be treated the same way after the 2021 amendments.