This judgment text has undergone conversion so that it is mobile and web-friendly. This may have created formatting or alignment issues. Please refer to the PDF copy for a print-friendly version.

In the GENERAL DIVISION OF

THE high court of the republic of singapore
[2021] SGHC 125
Registrar’s Appeal No 24 of 2019 (District Court Originating Summons No 170 of 2018)
In the matter of Section 32 of the Personal Data Protection Act 2012 (Act 26 of 2012)
Between
Alex Bellingham
Appellant
And
Michael Reed
Respondent
grounds of decision
[Data Protection] — [Personal Data Protection Act] — [Right of private action] — [Loss or damage]
[Statutory Interpretation] — [Construction of statute] — [Interpretation Act] — [Purposive approach]

This judgment is subject to final editorial corrections approved by the court and/or redaction pursuant to the publisher’s duty in compliance with the law, for publication in LawNet and/or the Singapore Law Reports.
Bellingham, Alex

v

Reed, Michael
[2021] SGHC 125
General Division of the High Court — Registrar’s Appeal No 24 of 2019 (District Court Originating Summons No 170 of 2018)

Chua Lee Ming J

11 September, 12 October 2020
25 May 2021 
Chua Lee Ming J:
Introduction
1 The Personal Data Protection Act 2012 (Act 26 of 2012) (“PDPA”) governs the collection, use and disclosure of personal data by organisations. The regulatory authority, the Personal Data Protection Commission (the “Commission”), is empowered to, among other things, administer and enforce the PDPA. In addition, s 32 PDPA creates a right of private action. It gives any person who suffers “loss or damage”, as a result of contraventions of certain provisions in the PDPA, a right of action for relief in civil proceedings in a court.
2 The references to the PDPA in these grounds of decision are to the PDPA as it stood in 2018 when the acts complained about took place. Amendments have been made to the PDPA since then.
3 This was an appeal against the District Judge’s decision granting an injunction against the appellant, Mr Alex Bellingham (“Bellingham”), in civil proceedings commenced by IP Investment Management Pte Ltd (“IPIM”) and IP Real Estate Investments Pte Ltd (“IP Real Estate”) under s 32(1) PDPA. The respondent, Mr Michael Reed (“Reed”), was subsequently added as a plaintiff in those proceedings. As the scope of s 32(1) PDPA was being decided for the first time, Mr Liu Zhao Xiang Daniel (“Mr Liu”) was appointed as young amicus curiae to assist the Court in this appeal.
4 I concluded that Reed did not have a right of private action under s 32(1) PDPA because he had not suffered any loss or damage within the meaning of that provision. Accordingly, I allowed the appeal and set aside the order made by the District Judge.
5 As the issue was decided for the first time, I subsequently granted Reed leave to appeal against my decision. Reed filed his appeal pursuant to the leave granted.
Facts
6 IPIM is a fund management business that creates real estate private equity funds. It is a part of the IP Investment Management group of companies (“IPIM Group”). IP Investment Management (HK) Ltd (“IPIM HK”) is another company in the IPIM Group.
7 IP Real Estate is a company within the IP Global group of companies (“IP Global Group”), an international group of companies which engages in property investment and advisory services and is headquartered in Hong Kong. The IPIM Group is related to the IP Global Group.
8 Bellingham was employed by IP Real Estate on 1 June 2010 as a marketing consultant. He subsequently rose to the position of Director. On 1 March 2016, IP Real Estate seconded Bellingham to IPIM HK. Among other things, Bellingham’s role involved taking charge of and managing an investment fund known as the “Edinburgh Fund”.
9 The Edinburgh Fund was an investment fund that was set up in 2015 by IPIM and IPIM HK to acquire, develop and manage a student property. The Edinburgh Fund was an Accredited Investors only, single asset, close-ended fund.
10 All the investors in the Edinburgh Fund were customers of IPIM and IP Real Estate (the “Customers”). The Customers disclosed their personal data in confidence to IPIM and/or IPIM HK, which managed their investments. The Edinburgh Fund was scheduled to be terminated in the second half of 2018, with the Customers exiting from the fund in that period.
11 On 31 January 2017, Bellingham left his employment with IP Real Estate; consequently, his secondment with IPIM HK also ended. Bellingham joined a competitor of IPIM known as Q Investment Partners Pte Ltd (“QIP”) as its “Head of Fund Raising”.
12 Bellingham contacted some of the Customers, including Reed. On 15 August 2018, Bellingham sent the following email to Reed at his personal email address:
I am unsure what background you know re QIP but it was business set up by Peter Young, formerly CEO of IP Investment Management.
I hope you don’t mind me touching base regarding your upcoming Edinburgh exit. We have put specific GBP opportunities in place to cater to this. This includes both debt and equity, short and medium term, income producing as well as equity with distributions so we can help you in whatever capacity required. In addition, we have put specific incentives in place.
I can run through this with you if that suits?
13 On 21 August 2018, Reed sent the following email to Mr Mark Ferguson (“Ferguson”), IPIM’s Director, Investor Relations & Business Development, querying the fact that QIP had information about his investment in the Edinburgh Fund:
I received this note from Q-Investment. They are aware of my exiting the Edinburgh investment. I don’t understand how they would be aware of my involvement and / or investment.
Has Peter Young taken the client list of IP when setting up Q?
I would value your insights.
14 On 28 August 2018, Reed replied to Bellingham, asking for clarifications as to Bellingham’s knowledge of his dealings with IP Global and, in particular, the Edinburgh Fund:
… I would welcome your clarification of two issues:-
•  … I am curious how you know of my dealings with IP Global, and equally relevantly, how you are aware of the timing of the maturity of one of my holdings with IP Global?
•  … I am equally curious how you have my personal email address and have been able to cross-reference this address to my specific involvement with IP Global, namely the Edinburgh project.
In view of my comments and concerns on the security of my personal information, I would welcome your guidance and insights as to how you have accessed my data and how you will protect it, now that you have it, …
15 On 21 August 2018, IPIM’s solicitors, M/s Allen & Gledhill LLP (“A&G”) sent Bellingham a letter alleging that he had breached his obligations not to misuse confidential and/or personal data. The letter also demanded that Bellingham (a) return all copies of confidential and/or personal data of their Customers, and (b) confirm and undertake that he and/or QIP will not make any further unauthorised use of such information.
16 On 3 September 2018, Bellingham replied to A&G and among other things, sought details of his alleged breaches. On the same day, A&G wrote to Bellingham, repeating the demands made in its letter dated 21 August 2018.
17 Bellingham replied to A&G on 12 September 2018, stating as follows:
… I carried out sales responsibilities as well as being the Responsible Officer (“RO”) of the IPIM (the investment management arm of IP Global) business. IPIM is the relevant entity that originated the Edinburgh Fund. As a RO, my responsibility include [sic] to supervise and oversee the IPIM business ensuring all investors have been subject to appropriate Know Your Customers Check and onboarded properly from a regulatory standpoint.
Any contact made with individuals was on the basis of publicly available information including social media platform. I am not aware of the breach of confidentiality or misuse of data that your client is referring to. Going forward, I have no interest in speaking to individuals clearly that have no interest in working with me. I trust this matter is resolved.
18 On the same day, Bellingham responded to Reed’s 28 August 2018 email, stating as follows:
Your personal details including your personal email and a full CV is available on LinkedIn.
Of course, I now understand that there is no interest on your part and you will not be contacted further for any specific matters.
Reed forwarded Bellingham’s email to Ferguson and Mr Jonathan Gordon, another employee of IPIM and IP Real Estate. In his email, Reed pointed out that Bellingham had failed to address the fact that he had misused “privileged information”, and sought their comments so that he could decide whether to reply to Bellingham or “take [his] concerns further”.
19 On 1 October 2018, IPIM and IP Real Estate filed District Court Originating Summons No 170 of 2018 (“OSS 170”) in the District Court against Bellingham pursuant to s 32(3) PDPA, seeking (a) an injunction restraining Bellingham from using, disclosing or communicating to any person or persons any “Personal Data” of Reed and two other of their Customers, (b) an order for delivery up of all copies of their Customers’ Personal Data obtained by Bellingham. For the purposes of OSS 170, “Personal Data” meant the names of the Customers who invested in the Edinburgh Fund, their personal contact details and details of their personal investments (including in the Edinburgh Fund).
20 During the hearing of OSS 170 in the District Court, the issue arose as to whether IPIM and IP Real Estate had the necessary standing to bring an action under s 32 PDPA. On 20 March 2019, IPIM and IP Real Estate applied to join Reed as a plaintiff. Pursuant to an order of court dated 23 May 2019, Reed was joined as a plaintiff in OSS 170.
21 On 3 October 2019, the District Judge (“DJ”) granted Reed’s application. The applications by IPIM and IP Real Estate were disallowed on the ground that s 32 PDPA does not give a right of action to parties other than the person to whom the personal data that has been misused, relates (the “data subject”); IPIM and IP Real Estate therefore have no standing to commence the proceedings in OSS 170 under s 32 PDPA: IP Investment Management Pte Ltd & others v Alex Bellingham [2019] SGDC 207 (the “GD”) at [110]–[111].
22 The present appeal before me was Bellingham’s appeal against the orders made against him in favour of Reed. Bellingham had obtained leave to appeal pursuant to s 21(1)(a) of the Supreme Court of Judicature Act (Cap 322, 2007 Rev Ed) read with O 55C r 2 of the Rules of Court (Cap 322, R 5, 2014 Rev Ed). IPIM and IP Real Estate did not seek leave to appeal against the DJ’s decision rejecting their applications.
23 I allowed Bellingham’s appeal on the ground that Reed had not suffered any loss or damage within the meaning of s 32(1) PDPA and therefore had no right of action pursuant thereto.
Reed’s case
24 Section 32 PDPA provides as follows:
Right of private action
32.––(1) Any person who suffers loss or damage directly as a result of a contravention of any provision in Part IV, V or VI by an organisation shall have a right of action for relief in civil proceedings in a court.
(2) If the Commission has made a decision under this Act in respect of a contravention specified in subsection (1), no action accruing under subsection (1) maybe brought in respect of that contravention until after the decision has become final as a result of there being no further right of appeal.
(3) The court may grant to the plaintiff in an action under subsection (1) all or any of the following:
(a) relief by way of injunction or declaration;
(b) damages;
(c) such other relief as the court thinks fit.
25 Part IV of the PDPA deals with the general requirement for consent to the collection, use and disclosure of personal data. Part V deals with the individual’s right to access and correct his personal data that is in the possession or under the control of an organisation. Part VI deals with organisations’ obligations as to the accuracy of personal data, the protection of personal data, the retention of personal data and the transfer of personal data outside of Singapore.
26 Therefore, a plaintiff bringing an action pursuant to s 32(1) PDPA has to show (a) contravention of one or more provisions in Parts IV, V or VI, and (b) that he suffered loss or damage directly as a result of such contravention.
27 Reed’s case was that Bellingham had contravened ss 13 and 18 PDPA (which fall under Part IV PDPA) and that he had suffered loss and damage directly as a result thereof. Bellingham disputed Reed’s case.
28 The issues before me were:
(a) whether Bellingham contravened ss 13 and 18 PDPA;
(b) what was the scope of “loss or damage” under s 32(1) PDPA; and
(c) whether Reed suffered “loss or damage” within the meaning of s 32(1) PDPA.
Whether Bellingham contravened ss 13 and 18 PDPA
29 Section 13 PDPA provides as follows:
Consent required
13. An organisation shall not, on or after the appointed day, collect, use or disclose personal data about an individual unless ––
(a) the individual gives, or is deemed to have given, his consent under this Act to the collection, use or disclosure, as the case may be; or
(b) the collection, use or disclosure, as the case may be, without the consent of the individual is required or authorised under this Act or any other written law.
30 Section 18 PDPA provides as follows:
Limitation of purpose and extent
18. An organisation may collect, use or disclose personal data about an individual only for purposes ––
(a) that a reasonable person would consider appropriate in the circumstances; and
(b) that the individual has been informed of under section 20, if applicable.
Section 20 PDPA was not applicable in the present case.
31 Under s 2 PDPA,
“organisation” includes any individual, company, association or body of persons, corporate or unincorporated, whether or not –
(a) formed or recognised under the law of Singapore; or
(b) resident, or having an office or a place of business, in Singapore …
Sections 13 and 18 thus applied to Bellingham as an individual.
32 Reed’s case was that Bellingham had contravened ss 13 and 18 PDPA in connection with the following personal data – Reed’s name, email address and investment holding in the Edinburgh Fund.
33 Under s 2 PDPA,
“personal data” means data, whether true or not, about an individual who can be identified ––
(a)  from that data; or
(b)  from that data and other information to which the organisation has or is likely to have access …
34 It was clear that Reed’s name and email address constituted personal data under the PDPA. Before me, Bellingham conceded that he obtained Reed’s name in the course of his work with IPIM and/or IP Real Estate and that he was not entitled to use or disclose this data without Reed’s consent.
35 As for Reed’s email address, Bellingham explained that he obtained the same from Reed’s LinkedIn account, which was a public source. It was not disputed that at the relevant time, Reed’s LinkedIn account did show his email address. In the absence of evidence to the contrary, I accepted Bellingham’s explanation.
36 The collection, use or disclosure of personal data about an individual that is publicly available does not require the consent of the individual: s 17 read with the Second Schedule para 1(c), the Third Schedule para 1(c) and the Fourth Schedule para 1(d) of the PDPA.
37 However, Bellingham conceded that he would not have been able to find Reed’s email address without the use of Reed’s name. In my view, where personal data that is publicly available is obtained only through the unlawful use of other personal data, s 17(1) PDPA cannot apply and the personal data so obtained cannot be collected, used or disclosed without consent. In the present case, therefore, Bellingham was not entitled to collect, use or disclose Reed’s email address without his consent.
38 As for the fact that Reed had invested in the Edinburgh Fund, this information constituted personal data since it identified Reed. Bellingham claimed that the information was obtained through guesswork. I rejected Bellingham’s claim. I agreed with Reed that it was clear from Bellingham’s email dated 15 August 2018 (see [12] above) that Bellingham knew of Reed’s investment in the Edinburgh Fund; it was not just guesswork. Hence, Bellingham could not use or disclose the information without Reed’s consent.
39 In conclusion, Bellingham had contravened s 13 PDPA by:
(a) using Reed’s name to obtain his email address without his consent;
(b) obtaining Reed’s email address without his consent;
(c) using Reed’s name and email address to contact him without his consent; and
(d) using the fact that Reed was an investor in the Edinburgh Fund, without his consent, to market QIP’s services to Reed.
The use of Reed’s personal data for the above purposes exceeded what a reasonable person would have considered appropriate in the circumstances and thus also contravened s 18 PDPA.
What is the scope of “loss or damage” under s 32(1) PDPA
40 The PDPA does not define “loss or damage”. It is not clear from the GD what the DJ’s interpretation of the term “loss or damage” was. Reed submitted that “loss or damage” under s 32(1) PDPA includes distress and loss of control over personal data. Bellingham contended that it does not. The scope of “loss or damage” is unclear.
41 Section 9A of the Interpretation Act (Cap 1, 2002 Rev Ed) mandates the purposive approach in the interpretation of a provision of a written law – an interpretation that would promote the purpose or object underlying the written law shall be preferred to an interpretation that would not promote that purpose or object.
42 The purposive interpretation of a legislative provision involves three steps. The court must start by ascertaining the possible interpretations of the provision, having regard to the text of the provision as well as the context of the provision within the written law as a whole. The court must then ascertain the legislative purpose or object of the specific provision and the part of the statute in which the provision is situated. The court then compares the possible interpretations of the provision against the purpose of the relevant part of the statute. The interpretation which furthers the purpose of the written text is to be preferred to one which does not. See Tan Cheng Bock v Attorney-General [2017] 2 SLR 850 (“Tan Cheng Bock”) at [54(b) and (c)].
Possible interpretations of “loss or damage”
43 The court ascertains the possible interpretations of the provision by determining the ordinary meaning of the words; this can be aided by rules and canons of construction: Tan Cheng Bock at [38]. Section 32(1) PDPA is the only provision in the PDPA that refers to “loss or damage”. The question was whether the term “loss or damage” should be interpreted narrowly to refer to the heads of loss or damage under common law (pecuniary loss, damage to property, personal injury including psychiatric illness) or widely to include distress and loss of control over personal data.
44 The text of s 32(1) PDPA and the context of the provision within the PDPA did not assist in ascertaining whether the term “loss or damage” should include or exclude distress. However, in my view, read in context, the term “loss or damage” excludes loss of control over personal data.
45 Section 32 PDPA is found under Part VII of the PDPA which deals with the enforcement of Parts III to VI of the PDPA. Part VII of the PDPA also provides for enforcement by the Commission. Under s 29 PDPA, the Commission may give all or any of the following directions to ensure compliance with Parts III to VI of the PDPA:
(a) to stop collecting, using or disclosing personal data in contravention of the Act;
(b) to destroy all personal data collected in contravention of the Act;
(c) to comply with any direction of the Commissioner under s 28(2) (which deals with access to personal data); and
(d) to pay a financial penalty of such amount not exceeding $1m as the Commission thinks fit.
46 The Commission’s power to give the above directions arises in every case of a contravention of any provision in Parts III to VI of the PDPA; there is no requirement that the data subject must have suffered any loss or damage. In contrast, s 32(1) PDPA requires “loss of damage” in addition to a contravention of any provision in Parts IV to VI of the PDPA. Clearly, looked at in context, the intent of s 32(1) PDPA is not to give the right of action in every case whenever there is a contravention of any provision in Parts IV to VI of the PDPA without more. Doing so would render the term “loss or damage” otiose.
47 In every case where there has been a contravention of any provision in Parts IV to VI, there would inevitably be loss of control over personal data. In my view, therefore, s 32(1) PDPA cannot have been intended to apply where the alleged loss or damage is simply a loss of control over personal data.
Ascertaining the legislative purpose
48 As “loss or damage” could be interpreted to either include or exclude distress, the next step was to ascertain the legislative purpose of s 32(1) PDPA. The purpose should ordinarily be gleaned from the text itself, before evaluating whether consideration of extraneous material is necessary: Tan Cheng Bock at [54(c)(ii)].
49 Section 32(1) PDPA is described as a right of private action but I agreed with Mr Liu that it creates a statutory tort. This, too, is the view expressed in Data Protection Law in Singapore (Simon Chesterman ed) (Academy Publishing, 2nd Ed, 2018) at para 4.78. As explained in Gary Chan Kok Yew & Lee Pey Woan, The Law of Torts in Singapore (Academy Publishing, 2nd Ed, 2016), an action for breach of statutory duty is also viewed as a tortious action (at paras 09.001–09.004). It can therefore be said that the specific purpose of s 32(1) is to create a statutory tort and to allow a right of action on that basis.
50 Moving on to considerations of extraneous material, the Court of Appeal in held in Tan Cheng Bock that such considerations may only be had in three situations (at [54(c)(iii)]):
(a) If the ordinary meaning of the provision is clear, extraneous material can only be used to confirm the ordinary meaning but not to alter it.
(b) If the provision is ambiguous or obscure on its face, extraneous material can be used to ascertain the meaning of the provision.
(c) If the ordinary meaning of the provision leads to a result that is manifestly absurd or unreasonable, extraneous material can be used to ascertain the meaning of the provision.
51 The parties and Mr Liu referred me to statements made in Parliament. On 13 August 2012, the Minister for Information, Communication and the Arts (“MICA”) explained in Parliament that the “development of a data protection law for Singapore was motivated by two key considerations – enhanced protection of consumers’ personal data against misuse, and the potential economic benefits for Singapore”.
52 On 10 September 2012, the Personal Data Protection Bill (“PDPB”) was introduced in Parliament. At the Second Reading of the PDPB on 15 October 2012, the Minister explained the rationale for the PDPB as follows:
The personal data protection law will safeguard individuals’ personal data against misuse by regulating the proper management of personal data. Individuals will be informed of the purposes for which organisations are collecting, using or disclosing their personal data, giving individuals more control over how their personal data is used. A data protection law will also enhance Singapore’s competitiveness and strengthen our position as a trusted business hub. It will put Singapore on par with the growing list of countries that have enacted data protection laws and facilitate cross-border transfers of data.
53 The Minister also explained that MICA “studied the data protection frameworks in key jurisdictions, including Canada, New Zealand, Hong Kong and the European Union, to develop the most suitable [data protection] model for Singapore” and to ensure that “Singapore’s data protection regime is relevant and in line with international standards for data protection”. The PDPB was passed on 15 October 2012.
54 In so far as s 32(1) PDPA was concerned, nothing was said in Parliament as to the scope of the loss or damage that was envisaged for purposes of s 32(1). A specific question as to the kind of loss or damage envisaged under s 32(1) was raised during the Second Reading of the PDPB but no specific response was provided.
55 Clearly, the Minister’s statements in Parliament did not evince an intention that the PDPA should follow the positions adopted in the jurisdictions that were studied in every respect. Whilst the PDPA was intended to be in line with international standards for data protection, it was nevertheless developed to suit Singapore.
56 In fact, as will be discussed in detail below, there were express references to some form of emotional harm (humiliation, loss of dignity, injury to feelings and distress) in the relevant legislative provisions in Canada, New Zealand, Hong Kong and the United Kingdom (“UK”). Cases in the UK had also interpreted the relevant provision in the European Union (“EU”) to include compensation for distress, and the relevant provision in UK to include compensation for distress and loss of control over personal data. Yet, Parliament decided to refer only to “loss or damage” in s 32(1) PDPA without any reference to any form of emotional harm or loss of control over personal data. In my view, Parliament’s intention was to exclude emotional harm and loss of control over personal data from s 32(1) PDPA.
57 There is good reason for not adopting the positions in Canada, New Zealand, Hong Kong, the EU and the UK, As Mr Liu pointed out, the positions in Canada, New Zealand, Hong Kong, the EU and the UK have been driven primarily by the need to recognise the right to privacy. The position in Singapore is different.
58 Canada is a party to the International Covenant on Civil and Political Rights (189 UNTS 137) (“ICCPR”). Article 17(1) ICCPR provides that “[n]o one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, not to unlawful attacks on his honour and reputation”. Article 2(1) ICCPR requires each State Party to “ensure to all individuals … subject to its jurisdiction the rights recognized” in the ICCPR. Article 2(3)(a) requires each State Party to the ICCR to ensure “an effective remedy” for persons whose rights under the ICCPR have been violated.
59 In Canada, the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (Can) (“PIPEDA (Can)”) lays down standards for how organisations collect, use and disclose personal information in the course of commercial activity. The PIPEPDA (Can) also provides a civil claims framework (ss 14–16) in respect of contraventions of relevant provisions under it. The Canadian court may, pursuant to s 16(c) PIPEDA (Can), “award damages to the complainant, including damages for any humiliation that the complainant has suffered”. One of the factors considered in awarding such damages is the vindication of privacy rights: Rabi Chitrakar v Bell TV, 2013 FC 1103 at [26]; Nammo v TransUnion of Canada Inc [2012] 3 FCR 600 at [72].
60 New Zealand is also party to the ICCPR. The Human Rights Review Tribunal (the “HRR Tribunal”) was established under the Human Rights Act 1993 (NZ) to promote the protection of human rights in New Zealand in accordance with, among other things, the ICCPR.
61 In New Zealand, under s 66(1) of the Privacy Act 1993 (NZ) (“PA (NZ)”), an action is an interference with the privacy of an individual only if, among other things, the action:
(a) has caused, or may cause, loss, detriment, damage, or injury to that individual;
(b) has adversely affected, or may adversely affect the rights, benefits, privileges, obligations, or interests of that individual; or
(c) has resulted in, or may result in, significant humiliation, significant loss of dignity, or significant injury to the feelings of that individual.
62 Under s 83 of the PA (NZ), an aggrieved individual may bring proceedings before the HRR Tribunal for an interference with his privacy. Under s 88(1), the HRR Tribunal may award damages in respect of pecuniary loss and expenses reasonably incurred, loss of any benefit, and “humiliation, loss of dignity, and injury to the feelings of the aggrieved individual”. It can be seen that the remedies available under s 88(1) reflect the elements of an interference with privacy under s 66(1).
63 In Karen May Hammond v Credit Union Baywide [2015] NZHRRT 6, the HRR Tribunal noted (at [170.8]) that the “award of damages must be an appropriate response to adequately compensate the aggrieved individual for the humiliation, loss of dignity or injury to feelings he or she has suffered” and referred to Art 2(3) of the ICCPR, “which makes specific reference to a duty to provide ‘an effective remedy’ to persons whose rights (under the Covenant) have been violated”.
64 Hong Kong enacted the Personal Data (Privacy) Ordinance (Cap 486) (HK) (“PDPO (HK)”) to implement the protection of the right to privacy guaranteed under Art 17(1) ICCPR: Report of the Hong Kong Special Administrative Region of the People’s Republic of China in the light of the International Covenant on Civil and Political Rights, at paras 305–309.
65 In Hong Kong, the PDPO (HK) provides for statutory control of the collection, holding and use of personal data in both the public and private sectors. Section 66 of the PDPO (HK) provides for compensation to an individual who suffers damage by reason of a contravention of a requirement under the PDPO (HK) and expressly provides that such damage “may be or include injury to feelings”.
66 As for the EU, at the time when the PDPA was passed in 2012, the applicable data protection law in the EU was Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“Directive 95”). Article 1 of Directive 95 sets out the object of the directive and provided that “Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data”.
67 Article 23 of Directive 95 further required Member States to provide that “any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered”.
68 As the UK was a member of the EU then, it passed the Data Protection Act 1998 (c 29) (UK) (“DPA (UK)”) in compliance with its obligations under Directive 95. Section 13 DPA (UK) provides as follows:
13 Compensation for failure to comply with certain requirements
(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if ––
(a) the individual also suffers damage by reason of the contravention, or
(b) the contravention relates to the processing of personal data for the special purposes.
Section 3 DPA (UK) defines “special purposes” in s 13(2)(b) to refer to purposes of journalism, the arts or literature.
69 In Vidal-Hall and others v Google Inc (Information Commissioner intervening) [2016] QB 1003 (“Vidal-Hall”), the English Court of Appeal held that damages could be awarded under s 13 DPA (UK) for distress even though the claimants had not suffered any pecuniary loss and the contravention of the DPA (UK) was not related to special purposes. In coming to this conclusion, the Court of Appeal reasoned that:
(a) since what Directive 95 purported to protect was privacy rather than economic rights, it would be strange if Directive 95 could not compensate those individuals whose data privacy had been invaded so as to cause them emotional distress (but not pecuniary damage) (at [77]);
(b) Article 23 of Directive 95 did not distinguish between pecuniary and non-pecuniary damage; a restrictive interpretation would substantially undermine the objective of Directive 95, which was to protect the right to privacy of individuals with respect to the processing of their personal data (at [79]);
(c) section 13(2) (which required damage in addition to distress) had not effectively transposed Article 23 into the PDA (UK) (at [84]) and could not be interpreted compatibly with Article 23 of Directive 95 (at [94]); and
(d) what was required in order to make s 13(2) compatible with EU law was the disapplication of s 13(2), leaving compensation to be recoverable under s 13(1) for any damage suffered (at [105]).
70 In Lloyd v Google llc [2020] 2 WLR 484 (“Lloyd”), the English Court of Appeal went further than Vidal-Hall and held that damages could be awarded for loss of control over data under s 13 DPA (UK) without proof of pecuniary loss or distress. The Court of Appeal emphasised (at [44]) that the question as to the kind of damage that could be compensated under Art 23 of Directive 95 and s 13 DPA (UK) was an EU law question. An appeal against the Court of Appeal’s decision is currently awaiting the judgment of the Supreme Court of UK.
71 It can be seen from the above that, as Mr Liu submitted, the positions taken in Canada, New Zealand, Hong Kong, the EU and the UK are primarily due to the recognition of the right to privacy under the ICCPR or Directive 95 and the need to comply with the ICCPR or Directive 95.
72 I agreed with Mr Liu that the PDPA was not driven by a recognition of the need to protect an absolute or fundamental right to privacy. Although specific statutes deal with certain aspects of privacy, there is no discrete right to privacy that is protected under the Constitution of the Republic of Singapore (1985 Rev Ed, 1999 Reprint) (the “Constitution”). The protection against deprivation of “life or personal liberty” save in accordance with law under Art 9(1) of the Constitution does not extend to the right to privacy: Lim Meng Suang and another v Attorney-General and another appeal and another matter [2015] 1 SLR 26 at [44]–[49]. Singapore is not bound by the ICCPR or Directive 95.
73 The purpose of the PDPA was as much to enhance Singapore’s competitiveness and to strengthen Singapore’s position as a trusted business hub as it was to safeguard individuals’ personal data against misuse (see [52] above).
74 Further, s 3 PDPA describes the purpose of the PDPA as follows:
Purpose
3. The purpose of this Act is to govern the collection, use and disclosure of personal data by organisations in a manner that recognises both the right of individuals to protect their personal data and the need of organisations to collect, use or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances.
75 Section 3 PDPA shows that the PDPA takes a balanced approach and that it was not driven by any recognition of the right to privacy as a fundamental right.
Comparing the possible interpretations against the legislative purpose
76 The interpretation which furthers the purpose of the written text should be preferred to the interpretation which does not. As stated in [49] above, s 32(1) created a statutory tort. It seemed to me that interpreting the term “loss or damage” in s 32(1) PDPA narrowly to refer to the heads of loss or damage applicable to torts under common law (eg, pecuniary loss, damage to property, personal injury including psychiatric illness) would further the specific purpose of s 32(1) PDPA as a statutory tort. There was nothing in the PDPA that indicated otherwise.
77 That Parliament’s intention was for common law principles to apply in determining the scope of “loss or damage” under s 32(1) PDPA, is supported by Parliament’s expressed intention in respect of the Protection from Harassment Act (Cap 256A, 2015 Rev Ed) (“POHA”). Section 11 POHA provides that the victim of harassment may bring civil proceedings in a court against the respondent and the court may award “such damages … as the court may, having regard to all the circumstances of the case, think just and equitable”. In answer to questions raised in Parliament as to whether damages for emotional distress will be available under the civil remedies provision, the Minister for Law said that the issue of damages would be left to the courts to decide by applying common law principles. It seemed to me that it would be strange that Parliament would have had a different intention with respect to the PDPA when it had decided not to make any express reference to distress or loss of control over personal data in s 32(1) PDPA.
78 In addition, the narrow interpretation of “loss or damage” would also further the intention ascertained from a consideration of the extraneous material, ie, that Parliament’s intention was to exclude emotional harm and loss of control over personal data from s 32(1) PDPA (see [56] above).
79 Finally, the intention ascertained from a consideration of the extraneous material also confirmed the interpretation that “loss or damage” in s 32(1) PDPA excludes loss of control over personal data.
80 Reed submitted that since MICA had studied the data protection frameworks in Canada, New Zealand, Hong Kong and the EU (of which the UK was then a member), to develop the most suitable model for Singapore, the authorities from these jurisdictions were relevant in the interpretation of “loss or damage” in s 32(1) PDPA. I disagreed with Reed for the reasons set out earlier in [56]–[75].
81 Reed also relied specifically on Lloyd for his submission that loss of control over personal data is sufficient to constitute damage for purposes of s 32(1) PDPA. As discussed earlier, Lloyd involved s 13 DPA (UK). The English Court of Appeal gave a more liberal interpretation to “damage” under the DPA (UK) because of the explicit recognition of the right to privacy in Directive 95, having noted (at [44]) that it was “answering an EU law question”. Lloyd has to be understood in this context. The position in Singapore is different; there is no general right to privacy under Singapore law as explained above.
82 In addition, I was of the view that Lloyd should not be followed in Singapore in any event. The High Court in Lloyd found that the pleaded case (ie, that loss of control over personal data constituted compensatable damage) was circular because it asserted that the commission of the tort had caused compensatable damage, consisting of the commission of the tort (Lloyd at [29]). The Court of Appeal disagreed that it was circular (at [45]) but, in my respectful view, did not explain why it was not circular. I found the High Court’s decision in this respect to be more persuasive. The High Court had also noted that there was no European authority that the pleaded types of loss constituted damage within Art 23 of Directive 95 (Lloyd at [30]).
Decision in My Digital Lock Pte Ltd
83 In support of his position, Reed also relied on certain views expressed by the Deputy Commissioner for Personal Data Protection in My Digital Lock Pte Ltd [2018] SGPDPC 3 (“My Digital Lock”), concerning Jones v Tsige (2012) ONCA 32 (“Tsige”) and Kaye v Robertson [1991] IPR 147 (“Kaye”).
84 Tsige was a decision of the Ontario Court of Appeal. There, the defendant was in a relationship with the claimant’s former husband. The defendant worked in the same bank as the claimant and used her workplace computer to gain access to the claimant’s private banking records, at least 174 times over a period of four years, for the alleged purpose of confirming whether the claimant’s former husband was paying child support. The defendant did not publish, distribute or record the information in any way.
85 The Ontario Court of Appeal held that a right of action for intrusion upon seclusion should be recognised in Ontario. The court was of the view that jurisprudence under the Canadian Charter of Rights and Freedoms recognised (a) privacy as being worthy of constitutional protection (at [39]), and (b) three distinct privacy interests – personal privacy, territorial privacy and informational privacy (at [41]).
86 Kaye was an English case that was decided before the DPA (UK) was enacted. There, journalists and a photographer intruded into the hospital room of a well-known actor, interviewing him and taking photographs of him. The English Court of Appeal acknowledged (at p150) that there was no right to privacy in English law and accordingly there was no right of action for breach of a person’s privacy. However, the court granted injunctive relief on the basis of the tort of malicious falsehood.
87 In My Digital Lock, the Deputy Commissioner expressed the view (at [33]) that the facts in Tsige and Kaye could give rise to breaches under the PDPA, and that these breaches could be enforced as private actions under s 32 PDPA.
88 With respect, I did not find My Digital Lock helpful in determining the scope of “loss or damage” in s 32(1) PDPA. The Deputy Commissioner gave his view in passing and, apart from emphasising that the right of private action under the PDPA protects informational privacy, did not analyse the scope of “loss or damage” or give any explanation as to what the “loss or damage” in Tsige or Kaye was that would have satisfied s 32 PDPA.
Whether Reed suffered loss or damage directly as a result of Bellingham’s contraventions of ss 13 and 18 PDPA
89 It was indisputable that Reed had to prove that he suffered loss or damage within the meaning of s 32(1) PDPA. It was not clear from the GD what was the loss or damage that the DJ found Reed to have suffered. The DJ noted that Bellingham’s counsel did not contend that Reed should be denied relief because he had suffered no loss (GD at [140]). However, as Bellingham pointed out, the DJ’s observation was at odds with another statement in the GD (at [115]), which acknowledged that Bellingham had submitted that the plaintiffs in OSS 170 (which would have included Reed) had not established that they had suffered loss or damage. That said, this was not an issue before me and the hearing of the appeal proceeded on the basis that there was nothing to stop Bellingham from arguing before me that Reed had suffered no loss or damage.
90 It was not disputed that Reed had not suffered any financial loss, psychiatric injury or nervous shock as a result of Bellingham’s contraventions of ss 13 and 18 PDPA. Before me, Reed submitted that he suffered emotional distress and loss of control over his personal data directly as a result of Bellingham’s contraventions of ss 13 and 18 PDPA.
91 I agreed with Bellingham that there was no evidence that Reed suffered distress. Reed’s affidavits did not show evidence of any distress. As for loss of control over personal data, Reed’s emails showed that he was concerned over the security of his personal data and Bellingham’s misuse of that data (see [13], [14] and [18] above).
92 In any event, for reasons set out earlier, Reed’s distress and loss of control over personal data did not constitute “loss or damage” within the meaning of s 32(1) PDPA. Reed therefore had not shown that he had suffered “loss or damage” such as to give rise to a right of action under s 32(1) PDPA.
Conclusion
93 For the above reasons, I concluded that the term “loss or damage” in s 32(1) PDPA is limited to the heads of loss or damage under common law, and does not include distress or loss of control over personal data. I therefore allowed the appeal and set aside the orders made by the DJ. I ordered Reed to pay Bellingham costs of the appeal fixed at $10,000 and costs of the hearing below fixed at $4,000, plus disbursements to be fixed by me if not agreed.
94 Although Reed had no right of private action under s 32 PDPA, he was not without remedy. As mentioned earlier, Bellingham’s obligations under the PDPA in respect of Reed’s personal data can be enforced by the Commission. The Commission’s powers under s 29 PDPA include, among others, giving directions to (a) stop collecting, using or disclosing personal data in contravention of the Act, and/or (b) destroy all personal data collected in contravention of the Act. The exercise of these powers would have achieved the same objective as the injunction order sought by Reed in this case. The Commission is not empowered to award damages but Reed was not seeking damages in any event.
95 I would also like to place on record my appreciation for the assistance given to this court by Mr Liu and the counsel for Reed and Bellingham.
Application for leave to appeal
96 Reed subsequently sought leave to appeal against my decision allowing Bellingham’s appeal. It is well established that leave to appeal may be granted if there is (a) a prima facie case of error, (b) a question of general principle decided for the first time, and (c) a question of importance upon which further argument and a decision of a higher tribunal would be to the public advantage: Lee Kuan Yew v Tang Liang Hong and another [1997] 2 SLR(R) 862 at [16]. Whilst these three grounds are not exhaustive, they are usually the grounds relied upon by an applicant seeking leave to appeal.
97 In the present case, Reed’s application for leave to appeal was based on all three grounds. Bellingham agreed that the present case involves a question of general principle decided for the first time, and that the question is one of importance upon which a decision of the Court of Appeal would be to the public advantage. I agreed that these two grounds were satisfied and I granted leave on these two grounds.
98 As for the ground of prima facie case of error, Reed relied on Essar Steel Ltd v Bayerische Landesbank and others [2004] 3 SLR(R) 25 (“Essar Steel”) for the proposition that the error may be one of fact or of law. In Abdul Rahman bin Shariff v Abdul Salim bin Syed [1999] 3 SLR(R) 138 (“Abdul Rahman”), the High Court held (at [30]–[32]) that the error must be one of law because if facts have to be examined in detail to demonstrate the error, the court hearing the leave application might as well hear the appeal proper.
99 The High Court in Essar Steel acknowledged the concern expressed in Abdul Rahman and decided that an error of fact can be relied on to seek leave to appeal if it has been demonstrated that the error of fact is clear beyond reasonable argument and has contributed or led to a judgment.
100 I respectfully agree with Essar Steel. Leave to appeal ought to be granted if it is shown that a decision has been made in error, be it an error of fact or of law. However, bearing in mind the concern expressed in Abdul Rahman, an error of fact must be one that is clear beyond reasonable argument (Essar Steel at [26]); the court should not have to delve into the facts in detail. An applicant for leave to appeal who alleges a prima facie error must demonstrate something more than just his disagreement with the decision. Otherwise, this ground would be satisfied in every case in which leave to appeal is sought. As for error of law, an applicant seeking leave to appeal on the ground of prima facie error of law must show something more than just disagreement with the court’s decision on the law.
101 Most of the time, the applicant who relies on the ground of prima facie error shows nothing more than that he disagrees with the court’s decision. In my view, this cannot be sufficient to show a prima facie case of error to warrant the grant of leave.
Chua Lee Ming

Ju
dge of the High Court
Ong Ziying Clement and Khoo Shufen Joni (Damodara Ong LLC) for the appellant;
Tay Yong Seng, Yap Wei-Ming Alexander, Ang Ann Liang (Hong Anliang) and Alyssa Png (Allen & Gledhill LLP) for the respondent;
Liu Zhao Xiang Daniel (WongPartnership LLP) as young amicus curiae.
Back to Top

This judgment text has undergone conversion so that it is mobile and web-friendly. This may have created formatting or alignment issues. Please refer to the PDF copy for a print-friendly version.

Version No 1: 27 May 2021 (15:37 hrs)