Singapore High Court Considers Right To Private Action Under The Personal Data Protection Act 2012

Personal Data Protection Act

The scope of a person’s right of private action under the Personal Data Protection Act

In a recent decision rendered in May 2021, the Singapore High Court determined for the first time the scope of a person’s right of private action under section 32 of the Personal Data Protection Act 2012 (“PDPA”). The Court considered the threshold of “loss or damage” that must be met in order for a person to bring a civil action against an organisation for a breach of the PDPA.

Decision

The High Court held that loss of control over personal data or emotional distress from such loss of control, without more, is insufficient to establish a right of private action. Instead, a person must have suffered one of the heads of loss and damage under common law (such as financial loss, damage to property, and personal injury, including psychiatric illness).

The case, Bellingham, Alex v Reed, Michael [2021] SGHC 125 (“Bellingham v Reed”), is presently on appeal to the Singapore Court of Appeal.

Background

The PDPA is the primary legislation in Singapore that governs the collection, use, and disclosure of personal data by organisations. The Personal Data Production Commission (“Commission”) is a specialised body empowered to, among others, administer and enforce the PDPA.

PDPA Section 32

Section 32 of the PDPA (now section 48O of the amended PDPA) creates a right of private action. Section 32(1) gives any person who suffers “loss or damage” directly as a result of a contravention of certain provisions in the PDPA, a right to bring a civil action in court. At present, the PDPA is silent on the definition of “loss or damage”.

The remedies available to a plaintiff in such a civil action are set out in section 32(3) of the PDPA. These include injunctive or declaratory relief, damages, and any other relief the court considers appropriate.

Source: Claire Chong | Nagashima Ohno & Tsunematsu