The Right of Private Action under Singapore’s PDPA –When does this Right Arise?

 

Reflections on the Singapore High Court decision of Bellingham, Alex v. Reed, Michael [2021] SGHC 125​

​

Your personal data has been collected, used and disclosed without your consent, and without legitimate basis under the Personal Data Protection Act 2012 (Act 26 of 2012) (“PDPA”).  Apart from filing a complaint with the Personal Data Protection Commission (the “Commission”), can you also bring a private action for breach of the PDPA?

 

The Singapore High Court answers this question in its recent decision Bellingham, Alex v. Reed, Michael [2021] SGHC 125 (“Bellingham v Reed”).  In short, under Section 48O(1) of the PDPA, you do have a right to start civil proceedings in a court for breach of the PDPA, if you can prove that you have suffered loss or damage recognised under common law. This includes pecuniary loss, damage to property, or personal injury including psychiatric illness.

 

Otherwise, if you have only sustained a mere loss of control over personal data, or distress over such loss of control, you would only be able to file a complaint directly with the Commission.

​

Background Facts

​

The case of Bellingham v Reed involved a former employee (“Bellingham”) sending emails to clients of his former employer, informing them of investment opportunities with his new employer. The former employee used the clients’ names, personal email addresses, and investment information without their consent.

 

The former employer together with one of the affected clients (“Reed”) brought an action under Section 32(1) (the predecessor to Section 48O(1) of the current PDPA). The High Court had to consider whether Reed had suffered “loss or damage” that was directly as a result of former employee Bellingham’s breach of the PDPA.

 

Contravention of the PDPA

 

Bellingham was found to have breached the consent and purpose limitation obligations under the PDPA. The High Court held that where a third party manages to obtain publicly available personal data by unlawfully using other personal data, the publicly available personal data cannot be collected, used or disclosed without consent.

 

In the present case, the client’s personal email address used by the former employee was publicly available on LinkedIn. However, the former employee would not have been able to find the client’s email address on LinkedIn without the use of the client’s name, which was unlawfully obtained in the course of his work with his former employer. Therefore, the former employee was not entitled to collect, use or disclose client’s publicly available email address without the client’s consent.

 

Loss or Damage 

 

The court had to determine the scope of “loss or damage” that would give a person the right to bring civil proceedings in a court for breach of the PDPA. It concluded that this right is available only if you can prove that you have suffered loss or damage recognised under common law (i.e. pecuniary loss, damage to property, or personal injury including psychiatric illness). It is insufficient to merely suffer a loss of control over personal data, or distress over such loss of control – in such a situation, you will not have a right of private action.

 

Observations

 

An aggrieved individual who is suffering from a breach of the PDPA by a third party has two avenues of recourse:

1. civil proceedings in the courts (under Section 48O of the current PDPA); and/or

2. enforcement by the Commission.

 

The main advantage of pursuing civil proceedings is the availability of an award of damages from the courts, which the Commission is not empowered to award.

 

However, where the aggrieved individual is unable to prove any common law loss or damage, the right of private action would not be available.  In such a case, the individual would only be able to file a complaint with the Commission and seek enforcement of the PDPA through the Commission. The Commission’s powers include, among others, giving directions to (a) stop collecting, using or disclosing personal data in contravention of the PDPA, (b) destroy all personal data collected in contravention of the PDPA, and/or (c) pay a financial penalty.

 

Reed has filed an appeal against the High Court decision. It remains to be seen whether the apex court will uphold the decision by the High Court in Bellingham v Reed.

 

For queries or more information, please contact:

​