The Singapore Court of Appeal has recently decided that “emotional distress” should constitute a form of loss or damage under Section 32(1) of the Personal Data Protection Act
In Michael Reed v Alex Bellingham and Attorney-General, intervener [2022] SGCA 60, the Singapore Court of Appeal overturned the earlier High Court judgment which held, inter alia, that the Appellant, Michael Reed, had not suffered any “loss or damage” within the meaning of s.32(1) of the Personal Data Protection Act 2012 (“PDPA”) (now section 48O of the amended PDPA) with regard to his publicly-available personal data, and that neither emotional distress nor loss of control of personal data fell within the ambit of “loss or damage” under s.32(1).
By way of background, in August 2018, the Respondent, Alex Bellingham, in his capacity as the Head of Fund Raising at a competitor firm of his former employers (IP Real Estate Investments Pte Ltd and IP Investment Management Pte Ltd), contacted clients of his former employers including Mr. Reed, via an unsolicited marketing email, to offer certain investment opportunities.
Alarmed at the level of his personal information which Bellingham referenced in his email (including Reed’s full name, personal email address and present investment activity), Reed complained to Bellingham’s previous employers on the basis that Bellingham must have wrongfully taken the information when he left to join the competitor firm.
Bellingham’s ex-employers duly commenced civil proceedings against Bellingham in the Singapore District Court, to which Reed subsequently joined as a plaintiff.
The Court decided that the investment companies had no legal standing to bring legal action. However, Reed succeeded in obtaining an injunction against Bellingham, restraining him from using, disclosing or communicating his personal data, together with an order requiring Bellingham to destroy the data that was in his possession.
An unsuccessful appeal was filed by Bellingham in the Singapore High Court. In Bellingham, Alex v Reed, Michael [2021] SGHC 125, Bellingham was found to be liable for breaching s.13 and s.18 of the PDPA in that he obtained and used Reed’s personal data without his consent to market investment products and this had exceeded what a reasonable person would have considered appropriate.
In the same judgment, the High Court dismissed Reed’s claim for damages to reflect his emotional distress and loss of control of his information. Instead, the High Court preferred the narrower interpretation of the available heads of loss under common law – under which only claims for pecuniary loss, property damage, personal injury and the like would be considered.
Dissatisfied with the decision, Reed appealed to the Singapore Court of Appeal, contending that a wider interpretation of “loss or damage” should be applied to include emotional distress and loss of control. Reed argued that such an approach would further the statutory purpose of the PDPA by enabling victims to obtain effective remedies for improper use of their personal data.
In upholding the appeal, the Court of Appeal decided that excluding emotional distress would cut across Parliament’s general overarching intent to promote the right of individuals to protect their personal data. Such Parliamentary intent should supersede the presumptive position at common law that emotional distress per se is not actionable.
A wider interpretation should be therefore preferred, rather than the narrow interpretation, as it better promoted and would be more consistent with: (1) the general purposes of the PDPA (at Section 3) i.e. to govern the collection, use and disclosure of personal data by organisations in a manner that recognises both the right of individuals to protect their personal data and the need of organisations to collect, use or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances); and (2) the specific purpose of s 32(1), namely to create a statutory tort and to allow a right of private action on that basis.
The Court of Appeal also clarified that loss of control does not, however, constitute “loss or damage” as every contravention of relevant provisions in Part IV to VI of the PDPA inevitably involves some form of loss of control over personal data.
The Court of Appeal’s position provides useful clarification - in that emotional distress is an actionable head, whereas a simple loss of control is not – and serves as a cautionary warning to all organisations engaged in collecting or processing of personal data that there is a potential exposure to a private action even if the individual claimant has not suffered any financial or pecuniary loss.
