Singapore Court of Appeal finds that individuals may claim for emotional distress caused by a breach of the Personal Data Protection Act (“PDPA”)

14 November 2022|In Legal Updates

Background of the case

In Reed, Michael v Bellingham, Alex (Attorney-General, intervener) [2022] SGCA 60 (“Reed v Bellingham”), the appellant, Reed, claimed for injunctive relief under Section 32 of the PDPA (as it stood in 2018) for emotional distress and the loss of control of his personal data. Section 32 of the PDPA has since been repealed and replaced with Section 48O, which remains very similar to the previous Section 32 of the PDPA.

The case involved Bellingham’s unauthorised collection and use of Reed’s personal data. Bellingham obtained Reed’s personal data in the course of his employment with his former employers. After joining a competitor of his former employers, Bellingham used personal data obtained from his previous employment to contact a number of investors.

“Loss or damage” includes emotional distress

The Court found that a wide interpretation of Section 32(1) of the PDPA, which allows individuals to claim for emotional distress, better promotes the general purpose of the PDPA as:

  1. the relevant parliamentary debates indicate that there was no intention to fetter the meaning of “loss or damage”; and
  2. Parliament intended for the PDPA to provide robust protection for personal data belonging to individuals.

Further, the risk of frivolous lawsuits for emotional distress is controlled, given that:

  1. to succeed, a plaintiff must show that the emotional distress was suffered “directly as a result of a contravention” of an identified provision of the PDPA and such distress was “more than trivial”; and
  2. individuals will be discouraged from making frivolous claims given the imposition of cost orders in the normal course of litigation.

Framework for ascertaining emotional distress

The Court found that whether a claimant suffered emotional distress should be an inquiry that is fact-sensitive in nature, and that a multi-factorial approach is to be adopted. Accordingly, the Court set out a few non-exhaustive considerations to guide courts in this inquiry:

  1. the nature of personal data involved in the breach: for instance, financial data is likely to be sensitive;
  2. the nature of the breach (e.g. whether the breach of the PDPA was one-off, repeated and/or continuing);
  3. the nature of the defendant’s conduct: the defendant’s intent (i.e. whether the breach was malicious, fraudulent, or accidental) and the defendant’s willingness to furnish an undertaking to the claimant not to misuse said personal data;
  4. the risk of future breaches of the PDPA causing emotional distress to the claimant; and
  5. actual impact of the breach on the claimant.

On the facts, the Court found that the appellant suffered emotional distress as a result of the respondent’s breaches of the PDPA. In coming to this conclusion, the Court considered:

  1. that the nature of the personal data involved was sensitive;
  2. the respondent’s unreasonable refusal to give an undertaking not to use the appellant’s personal data in the future and the conduct of the appellant (i.e. evasive and dismissive of the appellant’s concerns);
  3. the real prospect of future misuse of the appellant’s personal data; and
  4. the sensitivity of the appellant’s personal data and the efforts he had taken to ensure that his personal data would not be misused in the future.

IMPORTANT NOTICE: This memorandum is only intended as a guide and does not purport to be an exhaustive or conclusive discussion of the matters set out herein and should not be relied on as a substitute for definitive legal advice. Reference should always be made to the applicable statutes, the relevant subsidiary legislations and other applicable guidelines. This memorandum is not to be transmitted to any other person nor is it to be relied upon by any other person or for any other purpose or quoted or referred to in any public document or filed with any governmental or other authorities without our consent in writing. This memorandum is limited to the laws of Singapore. In issuing this memorandum, we do not assume any obligation to notify or inform you of any developments subsequent to its date that might render its contents untrue or inaccurate in whole or in part at such later time. If you would like to discuss the implications of these legal developments on your business or obtain advice, please do not hesitate to approach your usual contact at Insights Law LLC or you may direct the inquiry to our key contacts stated above.