The scope of a person’s right of private action under the Personal Data Protection Act
In a recent decision rendered in May 2021, the Singapore High Court determined for the first time the scope of a person’s right of private action under section 32 of the Personal Data Protection Act 2012 (“PDPA”). The Court considered the threshold of “loss or damage” that must be met in order for a person to bring a civil action against an organisation for a breach of the PDPA.
The High Court held that loss of control over personal data or emotional distress from such loss of control, without more, is insufficient to establish a right of private action. Instead, a person must have suffered one of the heads of loss and damage under common law (such as financial loss, damage to property, and personal injury, including psychiatric illness).
The case, Bellingham, Alex v Reed, Michael  SGHC 125 (“Bellingham v Reed”), is presently on appeal to the Singapore Court of Appeal.
The PDPA is the primary legislation in Singapore that governs the collection, use, and disclosure of personal data by organisations. The Personal Data Production Commission (“Commission”) is a specialised body empowered to, among others, administer and enforce the PDPA.
PDPA Section 32
Section 32 of the PDPA (now section 48O of the amended PDPA) creates a right of private action. Section 32(1) gives any person who suffers “loss or damage” directly as a result of a contravention of certain provisions in the PDPA, a right to bring a civil action in court. At present, the PDPA is silent on the definition of “loss or damage”.
The remedies available to a plaintiff in such a civil action are set out in section 32(3) of the PDPA. These include injunctive or declaratory relief, damages, and any other relief the court considers appropriate.