Bellingham, Alex v Reed , Michael [2021] SGHC 125

Introduction

The Personal Data Protection Act 2012 (Act 26 of 2012) (“PDPA”) governs the collection, use and disclosure of personal data by organisations. The regulatory authority, the Personal Data Protection Commission (the “Commission”), is empowered to, among other things, administer and enforce the PDPA. In addition, s 32 PDPA creates a right of private action. It gives any person who suffers “loss or damage”, as a result of contraventions of certain provisions in the PDPA, a right of action for relief in civil proceedings in a court.

The references to the PDPA in these grounds of decision are to the PDPA as it stood in 2018 when the acts complained about took place. Amendments have been made to the PDPA since then.

Facts

On 28 August 2018, Reed replied to Bellingham, asking for clarifications as to Bellingham’s knowledge of his dealings with IP Global and, in particular, the Edinburgh Fund:

On 21 August 2018, IPIM’s solicitors, M/s Allen & Gledhill LLP (“A&G”) sent Bellingham a letter alleging that he had breached his obligations not to misuse confidential and/or personal data. The letter also demanded that Bellingham (a) return all copies of confidential and/or personal data of their Customers, and (b) confirm and undertake that he and/or QIP will not make any further unauthorised use of such information.

On 3 September 2018, Bellingham replied to A&G and among other things, sought details of his alleged breaches. On the same day, A&G wrote to Bellingham, repeating the demands made in its letter dated 21 August 2018.

Bellingham replied to A&G on 12 September 2018, stating as follows:

On the same day, Bellingham responded to Reed’s 28 August 2018 email, stating as follows:

Reed forwarded Bellingham’s email to Ferguson and Mr Jonathan Gordon, another employee of IPIM and IP Real Estate. In his email, Reed pointed out that Bellingham had failed to address the fact that he had misused “privileged information”, and sought their comments so that he could decide whether to reply to Bellingham or “take [his] concerns further”.

On 1 October 2018, IPIM and IP Real Estate filed District Court Originating Summons No 170 of 2018 (“OSS 170”) in the District Court against Bellingham pursuant to s 32(3) PDPA, seeking (a) an injunction restraining Bellingham from using, disclosing or communicating to any person or persons any “Personal Data” of Reed and two other of their Customers, (b) an order for delivery up of all copies of their Customers’ Personal Data obtained by Bellingham. For the purposes of OSS 170, “Personal Data” meant the names of the Customers who invested in the Edinburgh Fund, their personal contact details and details of their personal investments (including in the Edinburgh Fund).

During the hearing of OSS 170 in the District Court, the issue arose as to whether IPIM and IP Real Estate had the necessary standing to bring an action under s 32 PDPA. On 20 March 2019, IPIM and IP Real Estate applied to join Reed as a plaintiff. Pursuant to an order of court dated 23 May 2019, Reed was joined as a plaintiff in OSS 170.

On 3 October 2019, the District Judge (“DJ”) granted Reed’s application. The applications by IPIM and IP Real Estate were disallowed on the ground that s 32 PDPA does not give a right of action to parties other than the person to whom the personal data that has been misused, relates (the “data subject”); IPIM and IP Real Estate therefore have no standing to commence the proceedings in OSS 170 under s 32 PDPA: IP Investment Management Pte Ltd & others v Alex Bellingham [2019] SGDC 207 (the “GD”) at [110]–[111].

The present appeal before me was Bellingham’s appeal against the orders made against him in favour of Reed. Bellingham had obtained leave to appeal pursuant to s 21(1)(a) of the Supreme Court of Judicature Act (Cap 322, 2007 Rev Ed) read with O 55C r 2 of the Rules of Court (Cap 322, R 5, 2014 Rev Ed). IPIM and IP Real Estate did not seek leave to appeal against the DJ’s decision rejecting their applications.

I allowed Bellingham’s appeal on the ground that Reed had not suffered any loss or damage within the meaning of s 32(1) PDPA and therefore had no right of action pursuant thereto.

(a) whether Bellingham contravened ss 13 and 18 PDPA;

(b) what was the scope of “loss or damage” under s 32(1) PDPA; and

(c) whether Reed suffered “loss or damage” within the meaning of s 32(1) PDPA.

Whether Bellingham contravened ss 13 and 18 PDPA

Section 13 PDPA provides as follows:

Section 18 PDPA provides as follows:

Under s 2 PDPA,

Sections 13 and 18 thus applied to Bellingham as an individual.

Reed’s case was that Bellingham had contravened ss 13 and 18 PDPA in connection with the following personal data – Reed’s name, email address and investment holding in the Edinburgh Fund.

Under s 2 PDPA,

It was clear that Reed’s name and email address constituted personal data under the PDPA. Before me, Bellingham conceded that he obtained Reed’s name in the course of his work with IPIM and/or IP Real Estate and that he was not entitled to use or disclose this data without Reed’s consent.

As for Reed’s email address, Bellingham explained that he obtained the same from Reed’s LinkedIn account, which was a public source. It was not disputed that at the relevant time, Reed’s LinkedIn account did show his email address. In the absence of evidence to the contrary, I accepted Bellingham’s explanation.

The collection, use or disclosure of personal data about an individual that is publicly available does not require the consent of the individual: s 17 read with the Second Schedule para 1(c), the Third Schedule para 1(c) and the Fourth Schedule para 1(d) of the PDPA.

However, Bellingham conceded that he would not have been able to find Reed’s email address without the use of Reed’s name. In my view, where personal data that is publicly available is obtained only through the unlawful use of other personal data, s 17(1) PDPA cannot apply and the personal data so obtained cannot be collected, used or disclosed without consent. In the present case, therefore, Bellingham was not entitled to collect, use or disclose Reed’s email address without his consent.

As for the fact that Reed had invested in the Edinburgh Fund, this information constituted personal data since it identified Reed. Bellingham claimed that the information was obtained through guesswork. I rejected Bellingham’s claim. I agreed with Reed that it was clear from Bellingham’s email dated 15 August 2018 (see [12] above) that Bellingham knew of Reed’s investment in the Edinburgh Fund; it was not just guesswork. Hence, Bellingham could not use or disclose the information without Reed’s consent.

In conclusion, Bellingham had contravened s 13 PDPA by:

(a) using Reed’s name to obtain his email address without his consent;

(b) obtaining Reed’s email address without his consent;

(c) using Reed’s name and email address to contact him without his consent; and

(d) using the fact that Reed was an investor in the Edinburgh Fund, without his consent, to market QIP’s services to Reed.

The use of Reed’s personal data for the above purposes exceeded what a reasonable person would have considered appropriate in the circumstances and thus also contravened s 18 PDPA.

What is the scope of “loss or damage” under s 32(1) PDPA

Possible interpretations of “loss or damage”

The court ascertains the possible interpretations of the provision by determining the ordinary meaning of the words; this can be aided by rules and canons of construction: Tan Cheng Bock at [38]. Section 32(1) PDPA is the only provision in the PDPA that refers to “loss or damage”. The question was whether the term “loss or damage” should be interpreted narrowly to refer to the heads of loss or damage under common law (pecuniary loss, damage to property, personal injury including psychiatric illness) or widely to include distress and loss of control over personal data.

The text of s 32(1) PDPA and the context of the provision within the PDPA did not assist in ascertaining whether the term “loss or damage” should include or exclude distress. However, in my view, read in context, the term “loss or damage” excludes loss of control over personal data.

Section 32 PDPA is found under Part VII of the PDPA which deals with the enforcement of Parts III to VI of the PDPA. Part VII of the PDPA also provides for enforcement by the Commission. Under s 29 PDPA, the Commission may give all or any of the following directions to ensure compliance with Parts III to VI of the PDPA:

(a) to stop collecting, using or disclosing personal data in contravention of the Act;

(b) to destroy all personal data collected in contravention of the Act;

(c) to comply with any direction of the Commissioner under s 28(2) (which deals with access to personal data); and

(d) to pay a financial penalty of such amount not exceeding $1m as the Commission thinks fit.

The Commission’s power to give the above directions arises in every case of a contravention of any provision in Parts III to VI of the PDPA; there is no requirement that the data subject must have suffered any loss or damage. In contrast, s 32(1) PDPA requires “loss of damage” in addition to a contravention of any provision in Parts IV to VI of the PDPA. Clearly, looked at in context, the intent of s 32(1) PDPA is not to give the right of action in every case whenever there is a contravention of any provision in Parts IV to VI of the PDPA without more. Doing so would render the term “loss or damage” otiose.

In every case where there has been a contravention of any provision in Parts IV to VI, there would inevitably be loss of control over personal data. In my view, therefore, s 32(1) PDPA cannot have been intended to apply where the alleged loss or damage is simply a loss of control over personal data.

Ascertaining the legislative purpose

As “loss or damage” could be interpreted to either include or exclude distress, the next step was to ascertain the legislative purpose of s 32(1) PDPA. The purpose should ordinarily be gleaned from the text itself, before evaluating whether consideration of extraneous material is necessary: Tan Cheng Bock at [54(c)(ii)].

Section 32(1) PDPA is described as a right of private action but I agreed with Mr Liu that it creates a statutory tort. This, too, is the view expressed in Data Protection Law in Singapore (Simon Chesterman ed) (Academy Publishing, 2nd Ed, 2018) at para 4.78. As explained in Gary Chan Kok Yew & Lee Pey Woan, The Law of Torts in Singapore (Academy Publishing, 2nd Ed, 2016), an action for breach of statutory duty is also viewed as a tortious action (at paras 09.001–09.004). It can therefore be said that the specific purpose of s 32(1) is to create a statutory tort and to allow a right of action on that basis.

Moving on to considerations of extraneous material, the Court of Appeal in held in Tan Cheng Bock that such considerations may only be had in three situations (at [54(c)(iii)]):

(a) If the ordinary meaning of the provision is clear, extraneous material can only be used to confirm the ordinary meaning but not to alter it.

(b) If the provision is ambiguous or obscure on its face, extraneous material can be used to ascertain the meaning of the provision.

(c) If the ordinary meaning of the provision leads to a result that is manifestly absurd or unreasonable, extraneous material can be used to ascertain the meaning of the provision.

The parties and Mr Liu referred me to statements made in Parliament. On 13 August 2012, the Minister for Information, Communication and the Arts (“MICA”) explained in Parliament that the “development of a data protection law for Singapore was motivated by two key considerations – enhanced protection of consumers’ personal data against misuse, and the potential economic benefits for Singapore”.

On 10 September 2012, the Personal Data Protection Bill (“PDPB”) was introduced in Parliament. At the Second Reading of the PDPB on 15 October 2012, the Minister explained the rationale for the PDPB as follows:

The Minister also explained that MICA “studied the data protection frameworks in key jurisdictions, including Canada, New Zealand, Hong Kong and the European Union, to develop the most suitable [data protection] model for Singapore” and to ensure that “Singapore’s data protection regime is relevant and in line with international standards for data protection”. The PDPB was passed on 15 October 2012.

In so far as s 32(1) PDPA was concerned, nothing was said in Parliament as to the scope of the loss or damage that was envisaged for purposes of s 32(1). A specific question as to the kind of loss or damage envisaged under s 32(1) was raised during the Second Reading of the PDPB but no specific response was provided.

Clearly, the Minister’s statements in Parliament did not evince an intention that the PDPA should follow the positions adopted in the jurisdictions that were studied in every respect. Whilst the PDPA was intended to be in line with international standards for data protection, it was nevertheless developed to suit Singapore.

In fact, as will be discussed in detail below, there were express references to some form of emotional harm (humiliation, loss of dignity, injury to feelings and distress) in the relevant legislative provisions in Canada, New Zealand, Hong Kong and the United Kingdom (“UK”). Cases in the UK had also interpreted the relevant provision in the European Union (“EU”) to include compensation for distress, and the relevant provision in UK to include compensation for distress and loss of control over personal data. Yet, Parliament decided to refer only to “loss or damage” in s 32(1) PDPA without any reference to any form of emotional harm or loss of control over personal data. In my view, Parliament’s intention was to exclude emotional harm and loss of control over personal data from s 32(1) PDPA.

There is good reason for not adopting the positions in Canada, New Zealand, Hong Kong, the EU and the UK, As Mr Liu pointed out, the positions in Canada, New Zealand, Hong Kong, the EU and the UK have been driven primarily by the need to recognise the right to privacy. The position in Singapore is different.

Canada is a party to the International Covenant on Civil and Political Rights (189 UNTS 137) (“ICCPR”). Article 17(1) ICCPR provides that “[n]o one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, not to unlawful attacks on his honour and reputation”. Article 2(1) ICCPR requires each State Party to “ensure to all individuals … subject to its jurisdiction the rights recognized” in the ICCPR. Article 2(3)(a) requires each State Party to the ICCR to ensure “an effective remedy” for persons whose rights under the ICCPR have been violated.

In Canada, the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (Can) (“PIPEDA (Can)”) lays down standards for how organisations collect, use and disclose personal information in the course of commercial activity. The PIPEPDA (Can) also provides a civil claims framework (ss 14–16) in respect of contraventions of relevant provisions under it. The Canadian court may, pursuant to s 16(c) PIPEDA (Can), “award damages to the complainant, including damages for any humiliation that the complainant has suffered”. One of the factors considered in awarding such damages is the vindication of privacy rights: Rabi Chitrakar v Bell TV, 2013 FC 1103 at [26]; Nammo v TransUnion of Canada Inc [2012] 3 FCR 600 at [72].

New Zealand is also party to the ICCPR. The Human Rights Review Tribunal (the “HRR Tribunal”) was established under the Human Rights Act 1993 (NZ) to promote the protection of human rights in New Zealand in accordance with, among other things, the ICCPR.

In New Zealand, under s 66(1) of the Privacy Act 1993 (NZ) (“PA (NZ)”), an action is an interference with the privacy of an individual only if, among other things, the action:

(a) has caused, or may cause, loss, detriment, damage, or injury to that individual;

(b) has adversely affected, or may adversely affect the rights, benefits, privileges, obligations, or interests of that individual; or

(c) has resulted in, or may result in, significant humiliation, significant loss of dignity, or significant injury to the feelings of that individual.

Under s 83 of the PA (NZ), an aggrieved individual may bring proceedings before the HRR Tribunal for an interference with his privacy. Under s 88(1), the HRR Tribunal may award damages in respect of pecuniary loss and expenses reasonably incurred, loss of any benefit, and “humiliation, loss of dignity, and injury to the feelings of the aggrieved individual”. It can be seen that the remedies available under s 88(1) reflect the elements of an interference with privacy under s 66(1).

In Karen May Hammond v Credit Union Baywide [2015] NZHRRT 6, the HRR Tribunal noted (at [170.8]) that the “award of damages must be an appropriate response to adequately compensate the aggrieved individual for the humiliation, loss of dignity or injury to feelings he or she has suffered” and referred to Art 2(3) of the ICCPR, “which makes specific reference to a duty to provide ‘an effective remedy’ to persons whose rights (under the Covenant) have been violated”.

Hong Kong enacted the Personal Data (Privacy) Ordinance (Cap 486) (HK) (“PDPO (HK)”) to implement the protection of the right to privacy guaranteed under Art 17(1) ICCPR: Report of the Hong Kong Special Administrative Region of the People’s Republic of China in the light of the International Covenant on Civil and Political Rights, at paras 305–309.

In Hong Kong, the PDPO (HK) provides for statutory control of the collection, holding and use of personal data in both the public and private sectors. Section 66 of the PDPO (HK) provides for compensation to an individual who suffers damage by reason of a contravention of a requirement under the PDPO (HK) and expressly provides that such damage “may be or include injury to feelings”.

As for the EU, at the time when the PDPA was passed in 2012, the applicable data protection law in the EU was Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“Directive 95”). Article 1 of Directive 95 sets out the object of the directive and provided that “Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data”.

Article 23 of Directive 95 further required Member States to provide that “any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered”.

As the UK was a member of the EU then, it passed the Data Protection Act 1998 (c 29) (UK) (“DPA (UK)”) in compliance with its obligations under Directive 95. Section 13 DPA (UK) provides as follows:

Section 3 DPA (UK) defines “special purposes” in s 13(2)(b) to refer to purposes of journalism, the arts or literature.

In Vidal-Hall and others v Google Inc (Information Commissioner intervening) [2016] QB 1003 (“Vidal-Hall”), the English Court of Appeal held that damages could be awarded under s 13 DPA (UK) for distress even though the claimants had not suffered any pecuniary loss and the contravention of the DPA (UK) was not related to special purposes. In coming to this conclusion, the Court of Appeal reasoned that:

(a) since what Directive 95 purported to protect was privacy rather than economic rights, it would be strange if Directive 95 could not compensate those individuals whose data privacy had been invaded so as to cause them emotional distress (but not pecuniary damage) (at [77]);

(b) Article 23 of Directive 95 did not distinguish between pecuniary and non-pecuniary damage; a restrictive interpretation would substantially undermine the objective of Directive 95, which was to protect the right to privacy of individuals with respect to the processing of their personal data (at [79]);

(c) section 13(2) (which required damage in addition to distress) had not effectively transposed Article 23 into the PDA (UK) (at [84]) and could not be interpreted compatibly with Article 23 of Directive 95 (at [94]); and

(d) what was required in order to make s 13(2) compatible with EU law was the disapplication of s 13(2), leaving compensation to be recoverable under s 13(1) for any damage suffered (at [105]).

In Lloyd v Google llc [2020] 2 WLR 484 (“Lloyd”), the English Court of Appeal went further than Vidal-Hall and held that damages could be awarded for loss of control over data under s 13 DPA (UK) without proof of pecuniary loss or distress. The Court of Appeal emphasised (at [44]) that the question as to the kind of damage that could be compensated under Art 23 of Directive 95 and s 13 DPA (UK) was an EU law question. An appeal against the Court of Appeal’s decision is currently awaiting the judgment of the Supreme Court of UK.

It can be seen from the above that, as Mr Liu submitted, the positions taken in Canada, New Zealand, Hong Kong, the EU and the UK are primarily due to the recognition of the right to privacy under the ICCPR or Directive 95 and the need to comply with the ICCPR or Directive 95.

I agreed with Mr Liu that the PDPA was not driven by a recognition of the need to protect an absolute or fundamental right to privacy. Although specific statutes deal with certain aspects of privacy, there is no discrete right to privacy that is protected under the Constitution of the Republic of Singapore (1985 Rev Ed, 1999 Reprint) (the “Constitution”). The protection against deprivation of “life or personal liberty” save in accordance with law under Art 9(1) of the Constitution does not extend to the right to privacy: Lim Meng Suang and another v Attorney-General and another appeal and another matter [2015] 1 SLR 26 at [44]–[49]. Singapore is not bound by the ICCPR or Directive 95.

The purpose of the PDPA was as much to enhance Singapore’s competitiveness and to strengthen Singapore’s position as a trusted business hub as it was to safeguard individuals’ personal data against misuse (see [52] above).

Further, s 3 PDPA describes the purpose of the PDPA as follows:

Section 3 PDPA shows that the PDPA takes a balanced approach and that it was not driven by any recognition of the right to privacy as a fundamental right.

Comparing the possible interpretations against the legislative purpose

Reed also relied specifically on Lloyd for his submission that loss of control over personal data is sufficient to constitute damage for purposes of s 32(1) PDPA. As discussed earlier, Lloyd involved s 13 DPA (UK). The English Court of Appeal gave a more liberal interpretation to “damage” under the DPA (UK) because of the explicit recognition of the right to privacy in Directive 95, having noted (at [44]) that it was “answering an EU law question”. Lloyd has to be understood in this context. The position in Singapore is different; there is no general right to privacy under Singapore law as explained above.

In addition, I was of the view that Lloyd should not be followed in Singapore in any event. The High Court in Lloyd found that the pleaded case (ie, that loss of control over personal data constituted compensatable damage) was circular because it asserted that the commission of the tort had caused compensatable damage, consisting of the commission of the tort (Lloyd at [29]). The Court of Appeal disagreed that it was circular (at [45]) but, in my respectful view, did not explain why it was not circular. I found the High Court’s decision in this respect to be more persuasive. The High Court had also noted that there was no European authority that the pleaded types of loss constituted damage within Art 23 of Directive 95 (Lloyd at [30]).

Decision in My Digital Lock Pte Ltd

In support of his position, Reed also relied on certain views expressed by the Deputy Commissioner for Personal Data Protection in My Digital Lock Pte Ltd [2018] SGPDPC 3 (“My Digital Lock”), concerning Jones v Tsige (2012) ONCA 32 (“Tsige”) and Kaye v Robertson [1991] IPR 147 (“Kaye”).

Tsige was a decision of the Ontario Court of Appeal. There, the defendant was in a relationship with the claimant’s former husband. The defendant worked in the same bank as the claimant and used her workplace computer to gain access to the claimant’s private banking records, at least 174 times over a period of four years, for the alleged purpose of confirming whether the claimant’s former husband was paying child support. The defendant did not publish, distribute or record the information in any way.

The Ontario Court of Appeal held that a right of action for intrusion upon seclusion should be recognised in Ontario. The court was of the view that jurisprudence under the Canadian Charter of Rights and Freedoms recognised (a) privacy as being worthy of constitutional protection (at [39]), and (b) three distinct privacy interests – personal privacy, territorial privacy and informational privacy (at [41]).

Kaye was an English case that was decided before the DPA (UK) was enacted. There, journalists and a photographer intruded into the hospital room of a well-known actor, interviewing him and taking photographs of him. The English Court of Appeal acknowledged (at p150) that there was no right to privacy in English law and accordingly there was no right of action for breach of a person’s privacy. However, the court granted injunctive relief on the basis of the tort of malicious falsehood.

In My Digital Lock, the Deputy Commissioner expressed the view (at [33]) that the facts in Tsige and Kaye could give rise to breaches under the PDPA, and that these breaches could be enforced as private actions under s 32 PDPA.

With respect, I did not find My Digital Lock helpful in determining the scope of “loss or damage” in s 32(1) PDPA. The Deputy Commissioner gave his view in passing and, apart from emphasising that the right of private action under the PDPA protects informational privacy, did not analyse the scope of “loss or damage” or give any explanation as to what the “loss or damage” in Tsige or Kaye was that would have satisfied s 32 PDPA.

Whether Reed suffered loss or damage directly as a result of Bellingham’s contraventions of ss 13 and 18 PDPA

It was indisputable that Reed had to prove that he suffered loss or damage within the meaning of s 32(1) PDPA. It was not clear from the GD what was the loss or damage that the DJ found Reed to have suffered. The DJ noted that Bellingham’s counsel did not contend that Reed should be denied relief because he had suffered no loss (GD at [140]). However, as Bellingham pointed out, the DJ’s observation was at odds with another statement in the GD (at [115]), which acknowledged that Bellingham had submitted that the plaintiffs in OSS 170 (which would have included Reed) had not established that they had suffered loss or damage. That said, this was not an issue before me and the hearing of the appeal proceeded on the basis that there was nothing to stop Bellingham from arguing before me that Reed had suffered no loss or damage.

I agreed with Bellingham that there was no evidence that Reed suffered distress. Reed’s affidavits did not show evidence of any distress. As for loss of control over personal data, Reed’s emails showed that he was concerned over the security of his personal data and Bellingham’s misuse of that data (see [13], [14] and [18] above).

In any event, for reasons set out earlier, Reed’s distress and loss of control over personal data did not constitute “loss or damage” within the meaning of s 32(1) PDPA. Reed therefore had not shown that he had suffered “loss or damage” such as to give rise to a right of action under s 32(1) PDPA.

Conclusion

Although Reed had no right of private action under s 32 PDPA, he was not without remedy. As mentioned earlier, Bellingham’s obligations under the PDPA in respect of Reed’s personal data can be enforced by the Commission. The Commission’s powers under s 29 PDPA include, among others, giving directions to (a) stop collecting, using or disclosing personal data in contravention of the Act, and/or (b) destroy all personal data collected in contravention of the Act. The exercise of these powers would have achieved the same objective as the injunction order sought by Reed in this case. The Commission is not empowered to award damages but Reed was not seeking damages in any event.

I would also like to place on record my appreciation for the assistance given to this court by Mr Liu and the counsel for Reed and Bellingham.

Most of the time, the applicant who relies on the ground of prima facie error shows nothing more than that he disagrees with the court’s decision. In my view, this cannot be sufficient to show a prima facie case of error to warrant the grant of leave.