By Eleanor Wong and Stephen Yeo

The Personal Data Protection Act 2012 (Rev Ed 2020) (‘’PDPA’) establishes a right of private action for breaches. But who can use this right? And what sorts of harm can they claim redress for?

Section 48O of the PDPA (‘s 48O’) states:

A person who suffers loss or damage directly as a result of a convention –

• By an organisation of any provision of Part 4, 5, 6, 6A or 6B; or
• By a person of any provision of Division 3 of Part 9 or section 48B(1),

has a right of action for relief in civil proceedings in a court.

The phrasing of s 48O gives rise to two broad sets of questions engaged in our paper ‘Getting There ‘Directly’: Closing the Bellingham Loop on S48O PDPA’ published in the Singapore Journal of Legal Studies. First, the ‘standing issue’ revolves around the interpretation of ‘person’, engaging questions such as whether a non-human entity would be considered a ‘person’ under s 48O and, even on the assumption that it would, whether such an entity would be an appropriate beneficiary of s 48O. The ‘loss’ issue inquires what types of ‘loss or damage’ s 48O envisages. Is ‘loss or damage’ limited to heads of damages generally recognised in common law (e.g., financial loss and physical damage), or does it potentially extend to other types of harms such as emotional loss or reputational damage?

That these issues were open to substantial question was highlighted by the Bellingham chain of cases, a line of cases that started in the District Court (IP Investment Management v Alex Bellingham [2019] SGDC 207) before going on appeal to the High Court and finally concluding in the Court of Appeal. Relying on the statutory right of private action under the PDPA, there were three plaintiffs that sought to claim damages on the basis that alleged breaches of PDPA provisions by the defendant, Alex Bellingham led to their suffering ‘loss or damage’.

In relation to the standing issue, it was decided at the District Court level (‘Bellingham DC’) that a non-human entity is not a ‘person’ for the purposes of the statutory provision establishing the right of private action under the PDPA. This disqualified the first and second Plaintiffs, who were both non-human entities, from having the requisite standing to rely on the right of private action under the PDPA. On the loss issue, it was initially posited at the High Court level (‘Bellingham HC’) that ‘loss or damage’ is indeed limited to the common law heads of damages. The latest decision in the Court of Appeal (‘Bellingham CA’), reversed the position on the loss issue, holding that the Defendant’s emotional distress was encompassed by ‘loss or damage’.

Our paper addresses both these issues. With regards to the standing issue, we argue that the Bellingham DC holding was not fully satisfying and propose how it may, in future, be clarified. We argue that even if the Bellingham DC analysis on this point could be accepted at the time the decision was made, it is hard to sustain given recent amendments to the PDPA. Along the way, we explain that the related words ‘person’, ‘organisation’ and ‘individual’ used in the PDPA should be construed and differentiated in the following manner:

• ‘person’ is an umbrella term that refers to natural persons as well as legal entities;
• ‘organisation’ usually refers to the subset of persons who collect, use or safeguard data; and
• ‘individual’ is the subset of natural persons and usually, but not exclusively, refers to data subjects.

We also show how while the scope of s 48O should not be limited to natural persons, it can nonetheless be sensibly constrained by a directness requirement that coheres with the text and the stated purpose of the PDPA. Such a directness requirement, we believe not coincidentally, also featured in the Court of Appeal’s reasoning on the loss issue. Under this approach, non-human entities to whom obligations are directly owed under the PDPA or who are alter egos of individuals to whom obligations are directly owed under the PDPA would be able to avail themselves of s48O.

With regards to the loss issue, we briefly revisit the Court of Appeal’s recent decision and propose that the Court’s reasoning leads to the logical conclusion that other harms, most notably reputational harm, that flow directly from a breach of a stated PDPA obligation can also be legitimately encompassed within s 48O. Concerns about the potential breadth of this position can be allayed as long as we interpret s 48O in a principled and disciplined way, taking into account the types of actors typically engaged in PDPA breaches, the types of actions commonly constituting PDPA breaches and the most obvious and likely categories of consequences flowing from PDPA breaches.

Finally, we sum up our observations on how the winding journey of the Bellingham cases could have been circumvented by careful attention to the humble word ‘directly’ in the chapeau of s 48O. Sometimes, the answer is indeed right in front of us.

Keywords:  PDPA; s 48O; Right of Private Action; legal entities as claimants; reputational and emotional damage

AUTHOR INFORMATION

Eleanor Wong is Associate Professor at NUS Law, Co-Director of the Centre for Pro Bono and Clinical Legal Education, Director for Legal Skills Programme and Co-ordinator of the International Moot Programme. She is also NUS Associate Provost (Special Projects), Dean of the Singapore Institute of Legal Education and Vice Dean (Residential Programmes & Enrichment) at NUS College.

Email: lawwonge@nus.edu.sg

Stephen Yeo is a LLB Candidate at National University of Singapore.