What Constitutes Loss or Damage under the Singapore PDPA

In this landmark judgment, the Court of Appeal (“SGCA”) clarified the scope of the right of private action under the Personal Data Protection Act 2012 (“PDPA”). A private action is available to a victim who suffers emotional damage due to his or her personal data being misused.

The SGCA overturned the decision below and held that emotional distress is enough to amount to “loss or damage” for a right of private action under the PDPA. Conversely, a mere loss of control of personal data cannot amount to such “loss or damage”.

Procedural history

Mr. Bellingham had accessed personal information that belonged to Mr. Reed, who was a client of Mr. Bellingham’s previous employers. Having joined a rival company, Mr. Bellingham informed Mr. Reed of his awareness of Mr. Reed’s investments in consultation with his previous employers and proposed other options. Mr. Bellingham did not reassure Mr. Reed about how he would safeguard the personal information that he had accessed.

When a private action was brought against Mr. Bellingham, the District Court granted Mr. Reed an injunction and decreed that Mr. Bellingham commit to destroy such personal information.

Mr. Bellingham successfully appealed to the High Court, on the basis that emotional distress and the loss of control of Mr. Reed’s personal data were not enough to constitute “loss or damage” for the purpose of a right of private action under the PDPA.

The SGCA’s decision

On appeal, the SGCA held that Mr. Bellingham’s unauthorised access and usage of Mr. Reed’s personal information amounted to contraventions of the PDPA. Contrary to Mr. Bellingham’s argument, the SGCA held that those provisions on the collection, use and disclosure of personal information explicitly applied to individuals.

In considering whether Mr. Reed could bring an action against Mr. Bellingham, the SGCA considered the legislative intent behind the PDPA to include emotional distress, and took a broader interpretation of the “loss or damage” Mr. Reed suffered under the PDPA. Given the sensitivity of the personal information, how egregious the breach was, and Mr. Bellingham’s conduct (whether intentional or accidental), Mr. Reed had reason to be concerned about the exploitation of his personal information that included data concerning his investments, especially given Mr. Bellingham’s failure to reassure him that such information would be protected.

Accordingly, the SGCA allowed the appeal and reinstated the District Court’s orders.