Emotional distress recognised as an actionable head of damage under Singapore’s PDPA  

​

Reflections on the Singapore Court of Appeal decision of Bellingham, Alex v. Reed, Michael [2022] SGCA 60

​

If your personal data has been misused by a third party in breach of the Personal Data Protection Act 2012 (“PDPA”), can you file civil proceedings against the third party for causing you emotional distress? Must you have suffered a tangible loss, such as financial loss or damage to property? What about suing for the loss of control over your personal data?

 

In our previous article on Bellingham, Alex v. Reed, Michael [2021] SGHC 125 (the “SGHC Decision”), we reported that the Singapore High Court held that emotional distress and loss of control of personal data were insufficient for a right of private action under the then-s 32 of the PDPA (currently s 48O). 

 

The SGHC Decision has now been partially overturned by the Singapore Court of Appeal (“SGCA”). While the SGCA agreed that loss of control of personal data alone does not grant a right of private action, it held that emotional distress is indeed an actionable and recognisable head of damage, and individuals can file civil proceedings against a third party who has breached the PDPA for emotional distress. The SGCA also discussed the liability of individuals who have breached the PDPA, and a potential exemption of liability under s 4(1)(b) of the PDPA for employees acting in the course of employment. 

 

Liability of Individuals under the PDPA

 

The respondent initially argued that s 13 and 18 of the PDPA (the Consent & Purpose Limitation Obligations) impose obligations only on organisations, and not on individuals. Since the PDPA distinguishes between organisations and individuals, he, as an individual, is not subject to s 13 and 18, and cannot be held liable for breaches of these provisions. 

 

This was quickly dismissed by the SGCA – while s 13 and 18 do impose obligations on an “organisation”, s 2(1) of the PDPA expressly includes an individual within the meaning of an “organisation”. The proper recourse for individuals who seek to avoid an obligation under the PDPA is to rely on s 4 of the PDPA.

 

Employees Acting in Course of Employment

 

The respondent then argued that s 4(1)(b) of the PDPA exempted him from liability for breaching s 13 and 18 of the PDPA. Namely, s 4(1)(b) of the PDPA states that Parts III to VI of the PDPA shall not impose any obligation on any employee acting in the course of his employment with an organisation. 

 

In its decision, the SGCA clarified that a party who is accused of breaching the PDPA may invoke s 4(1) as a defence to avoid liability for his breach. Hence, where a party wishes to invoke s 4(1)(b), the burden of proof lies on him to establish, on the balance of probabilities, that when he breached the PDPA, he was: (a) an employee; and (b) acting in the course of his employment in committing the breach.

 

In overruling the SGHC Decision, the SGCA held that the doctrine of vicarious liability (a form of strict liability which does not require fault on the employer’s part), is incompatible with the true meaning of s 4(1)(b) of the PDPA, which is fault-based (i.e. the employee only breaches the PDPA where it fails to do “what a reasonable person would consider appropriate in the circumstances” under s 11(1) of the PDPA).

 

Loss or Damage  

 

Significantly, the SGCA recognised emotional distress as an actionable head of damage under s 32(1) of the PDPA, where the emotional distress is suffered “directly as a result of a contravention” of the PDPA. The SGCA held that s 32 would be significantly denuded of practical use if such recognition was not given, as it is not uncommon for emotional distress to be the only loss or damage suffered as a result of breach of Parts IV to VI of the PDPA.  

 

The SGCA further observed that the inquiry as to whether the aggrieved individual had suffered emotional distress was a subjective test.  A multi-factorial approach was suitable for determining whether an individual had suffered emotional distress. Relevant factors included: (1) the nature of the personal data involved in the breach; (2) the nature of the breach (was it one-off, repeated and/or continuing); (3) the nature of the defendant’s conduct (proof of fraudulent or malicious intent may support an inference that the claimant was more severely affected); (4) risk of future breaches of the PDPA causing further emotional distress; and (5) actual impact of the breach on the claimant. Additionally, trivial annoyance or negative emotions which form part of the vicissitudes of life will not amount to emotional distress and will not be actionable.

 

Upon applying the process of statutory interpretation, the SGCA concluded that there is nothing in the text and context of s 32 that justifies narrowing the meaning of “loss or damage” so as to exclude emotional distress. Overall, the SGCA observed that it was the intention of Parliament to provide robust protection for personal data belonging to individuals, and the general purpose of the PDPA is better advanced by adopting a wider interpretation of “loss or damage” in s 32.

 

Finally, the SGCA upheld the High Court’s view that loss of control over personal data per se is not an actionable head of damage, as every contravention of Part IV to VI of the PDPA inevitably involves some form of loss of control over personal data.

 

Other Observations

 

In our earlier article, we discussed two main avenues of recourse for victims of personal data misuse:

1. filing civil proceedings in the Singapore courts (under Section 48O of the current PDPA); and/or 

2. enforcement by the Personal Data Protection Commission (“Commission”). 

 

In its recent decision, the SGCA highlighted that the above two avenues serve different purposes, and are intended to complement each other. The main advantage of pursuing civil proceedings is that an aggrieved individual may make a claim for damages from the Singapore courts, which the Commission is not empowered to award. It is however noted that the appellant in the subject case did not seek damages – he only sought an injunction restraining the respondent from using personal data of the appellant and other customers, and an order that the respondent undertake to destroy the appellant’s personal data that was in his possession. As such, it remains to be seen how the courts would assess damages for emotional distress.

 

Finally, where the Commission has issued a decision and had chosen not to grant certain relief sought by an aggrieved individual (e.g. an injunction), the aggrieved individual may file civil proceedings to persuade the court to grant such relief (barring double recovery). Nevertheless, it is not necessary to file a complaint to the Commission before filing civil proceedings.  

 

For queries or more information, please contact: