The Personal Data Protection Act ("PDPA") sets out the duties of businesses and organisations regarding the collection, use and disclosure of personal data. To enforce these obligations, the Personal Data Protection Commission is empowered to issue directions for compliance and impose financial penalties. In addition, affected individuals are entitled to bring private actions against the offending organisation if they have suffered loss or damage from the breach of such duties.
However, not all forms of loss give rise to the right of private action under the PDPA. In Reed, Michael v Bellingham, Alex [2022] SGCA 60, the Singapore Court of Appeal provided some much-anticipated clarification on what constitutes "loss or damage" that would entitle an individual to initiate civil proceedings under the PDPA.
The Court of Appeal held that emotional distress falls within the scope of "loss or damage" under the PDPA, but the mere loss of control over personal data does not. In reaching its decision, the Court of Appeal considered the general purpose of the PDPA and adopted a wide interpretation of its private enforcement provisions.
The Court of Appeal also considered when an employee should be held responsible for a PDPA breach, and when the employee's actions should be attributed to the employer instead. As the relevant PDPA obligations do not apply to an employee who is only acting in the course of his employment, the Court of Appeal set out the applicable principles for determining when an employee can rely on this defence.
The Court of Appeal's decision provides important guidance for organisations and individuals that manage or deal with personal data in the course of operations, shedding light on when they may be exposed to private action for PDPA breaches.
For more information, click here to read our Legal Update.
