A Tale of Two Cities: The Right of Private Action in Data Protection in Singapore and Hong Kong

Introduction

The right to bring a private action under section 32(1) of the Singapore’s Personal Data Protection Act 2012 (PDPA)¹ was recently considered by the Singapore High Court (the Singapore High Court) in Bellingham, Alex v. Reed, Michael [2021] SGHC 125 (Bellingham v Reed), where it was held that emotional harm and mere loss of control over personal data was insufficient to constitute “loss or damage” required to sustain the right of private action. 

On the other hand, the Hong Kong District Court arrived at an opposite conclusion on a similar issue in Tsang Po Mann v Tsang Ka Kit and Another [2021] HKCU 665 (Tsang Po Mann v Tsang Ka Kit) and awarded HK$70,000 to the plaintiff for injury to her feelings for the defendants’ misuse of the footages captured by their CCTV cameras under section 66 of the Personal Data (Privacy) Ordinance (Cap. 486) (the PDPO). 

This article will compare and contrast these two cases and provide some key observations and takeaways.

The Singapore perspective: Bellingham v Reed

Background 

Bellingham v Reed concerned an appeal by Mr. Alex Bellingham against an injunction obtained against him by his former employers (the Former Employers) and the data subject, Mr. Michael Reed. Mr. Reed was a customer of the Former Employers.

The relevant facts are as follows: 

• After leaving the Former Employers for a competitor, Mr. Bellingham contacted Mr. Reed and other customers of the Former Employers via email with an offer of investment opportunities with his new employers. In his email to Mr. Reed, which was sent to Mr. Reed’s personal email address, Mr. Bellingham referenced a specific investment Mr. Reed made with the Former Employers. 
• Mr. Reed raised his concerns about Mr. Bellingham’s approach with the Former Employers; he also raised similar concerns with Mr. Bellingham in his response to Mr. Bellingham’s email. 
• The situation escalated and resulted in the Former Employers filling a civil suit against Mr. Bellingham, seeking: (a) an injunction restraining Mr. Bellingham from using, disclosing or communicating to any person or persons personal data of Mr. Reed and two other customers, and (b) an order for the delivery up of all copies of their customers’ personal data obtained by Mr. Bellingham. 
• Mr. Reed was subsequently added as a plaintiff to the proceedings when the issue of the Former Employers’ standing to bring the action under section 32 of the PDPA was raised.

While the orders were granted to Mr Reed at first instance, they were refused in respect of the Former Employers’ applications on the ground that section 32 of the PDPA does not give a right to action to parties other than the data subject whose personal data was impacted. Mr. Bellingham appealed against the orders made against him in favour of Mr. Reed.

Right of private action under the PDPA

Section 32(1) of the PDPA provides that “any person who suffers loss or damage directly as a result of contravention of any provision in Part IV, V or VI by an organisation shall have a right for relief in civil proceedings”.²

Section 32(3) of the PDPA further provides that the court may grant relief to the plaintiff under section 32(1) of the PDPA in the form of: (a) relief by way of injunction or declaration; (b) damages; and/or (c) any other relief as the court thinks fit.

Publicly available personal data

Under the PDPA, the collection, use or disclosure of personal data that is publicly available does not require consent of the individual: section 17(1) of the PDPA read with the paragraph 1(c) of the Second Schedule, paragraph 1(c) of the Third Schedule and paragraph 1(c) of the Fourth Schedule to the PDPA, which provides (the Publicly Available Personal Data Exception). 

Mr. Bellingham sought to rely on the Publicly Available Personal Data Exception and claimed that Mr. Reed’s email address was obtained from Mr. Reed’s LinkedIn account, which was a public source. 

While the Singapore High Court accepted Mr. Bellingham’s explanation that he obtained Mr. Reed’s personal email address from a public source, it noted that Mr. Bellingham had conceded that he would not have been able to find Mr. Reed’s personal email address without the use of Mr. Reed’s name, which was personal data that he obtained in the course of his work with the Former Employers. As such, Mr. Bellingham was not entitled to use or disclose such personal data without Mr. Reed’s consent. 

In this regard, the Singapore High Court observed that where personal data that is publicly available is obtained only through unlawful use of other personal data, section 17(1) of the PDPA cannot apply and personal data so obtained cannot be collected, used or disclosed without consent. Accordingly, the Singapore High Court held that Mr. Bellingham was not entitled to collect, use or disclose Mr. Reed’s email address without consent.

Interpretation of “loss or damage”

In deciding whether to allow Mr. Reed’s appeal, the Singapore High Court considered whether the term “loss or damage” should be interpreted narrowly to refer to the heads of loss under common law (i.e., pecuniary loss, damage to property, personal injury including psychiatric illness) or more widely to include distress and loss of control over personal data.

The Singapore High Court held that the narrower interpretation of “loss or damage” prevailed because: 

• Section 32 of the PDPA does not give rise to a right of action simply because there is a loss of control over personal data: Viewed in context, the intent of section 32(1) of the PDPA was not to give the right of action in every case whenever there is contravention of the Parts IV to VI of the PDPA without more. Doing so would render the term “loss or damage” otiose. As there would inevitably be a loss of control over personal data whenever Parts IV to VI of the PDPA is contravened, section 32(1) of the PDPA cannot have been intended to apply where the alleged “loss or damage” is simply a loss of control over personal data.³
• Parliament intended to exclude emotional harm and loss of control from the scope of section 32(1) of the PDPA: The Singapore High Court noted that while the Minister for Information, Communications and the Arts indicated that his Ministry studied the data protection frameworks in key jurisdictions, such as Canada, New Zealand, Hong Kong and the European Union while introducing the Personal Data Protection Bill in Parliament in 2012, the Minister’s statements did not evince an intention that the PDPA should follow the positions adopted in the jurisdictions studied in every respect.⁴ While the PDPA was developed in line with international standards, it was developed to suit Singapore.⁵ In this regard, the Singapore High Court pointed out that there was, in fact, express references to emotional harm in the relevant data protection legislative frameworks studied (e.g., Canada, New Zealand, Hong Kong and the UK). However, Parliament decided to only refer to “loss or damage” in section 32(1) of the PDPA without any reference to emotional harm or loss of control over personal data. Accordingly, the Singapore High Court concluded that Parliament had intended to exclude emotional harm and loss of control over personal data from the scope of section 32(1) of the PDPA.⁶
• The narrower interpretation of “loss or damage” would further the specific purpose of section 32(1) of the PDPA as a statutory tort: The Singapore High Court held that even though section 32(1) of the PDPA is described as a right of private action, the provision actually created a statutory tort and that a right of private action was created on this basis.⁷ In this regard, the Court considered the narrower interpretation of “loss or damage”, which referred to the heads of loss or damage applicable to torts under common law, to further the specific purpose of section 32(1) of the PDPA as a statutory tort.⁸ The Singapore High Court also observed that Parliament’s intention for common law principles to apply in determining the scope of “loss or damage” is supported by its expressed intention of a similar right to bring civil proceedings by a victim of harassment under section 11 of the Protection from Harassment Act (Cap. 256A), where the Minister for Law stated that whether damages for emotional distress would be available under this provision would be left to the courts to decide by applying common law principles. In this regard, the Singapore High Court stated that “it would be strange” for Parliament to have a different intention with respect to the section 32(1) of the PDPA when it decided not to make any express reference to emotional distress or loss of control over personal data in the provision.⁹

Accordingly, the Singapore High Court held that as emotional distress and loss of control over personal data did not constitute “loss or damage” within the meaning of section 32(1) of the PDPA, Mr. Reed failed to show that he had suffered “loss or damage” so as to give rise to the right to private action under the provision.¹⁰

Mr. Reed appealed against the decision of the Singapore High Court. His application for leave to appeal was granted and the appeal will be heard in by the Singapore Court of Appeal in due course.

The Hong Kong perspective: Tsang Po Mann v Tsang Ka Kit

Background

In Tsang Po Mann v Tsang Ka Kit, the plaintiff, Madam Tsang, brought an action against the defendants, being her uncle Mr. Tsang and her aunt Madam So. The background of the claim is as follows:

• Madam Tsang’s parents emigrated to England from Hong Kong in 1960s. Madam Tsang was born and bred in England and settled in Hong Kong in 1999 and worked as an English teacher in a primary school. The late father of Madam Tsang and Mr. Tsang were brothers and neighbours in the same village in Shatin, Hong Kong. Madam Tsang and the defendants often had disputes.
• On 13 November 2015, an anonymous letter was sent to the primary school where Madam Tsang worked, addressed to the Principal and the English Panel Chairperson. The letter contained a collage of four CCTV still images with the following captions in Chinese: “Madam Tsang, pretend herself to be an English person, frequently uses English to quarrel with neighbours. Opening the doors to the house of others without authority or consent. Walking dogs and let the dog defecate and urinate anywhere.”

Madam Tsang brought an action against the defendant for defamation and breach of section 66 of the PDPO. The Hong Kong District Court rejected Madam Tsang’s defamation claim. However, she succeeded in her claim under the PDPO for compensation for injury to her feelings for the defendants’ misuse of the CCTV footages. 

Compensation under the PDPO

Section 66(1) of the PDPO provides that “an individual who suffers damage by reason of a contravention:

(a) of a requirement under [the PDPO];

(b) by a data user; and

(c) which relates, whether in whole or in part, to personal data of which that individual is the data subject,

shall be entitled to compensation from that data user for that damage.”

Section 66(2) of PDPO makes it clear that for the avoidance of doubt, the damage referred to in subsection (1) may be or may include injury to feelings. 

Data user

Section 2 of the PDPO defines a data user as “a person who, either alone or jointly or in common with other persons, controls the collection, holding, processing or use of the data”.

The Hong Kong District Court held that since the CCTV cameras were installed for the security of the defendants’ matrimonial home and hence for the use of their family, and both Mr. Tsang and Madam So had equal access to the CCTV footages and they could process and use any personal data contained in them, both of them are data users within the meaning of the PDPO11.

Contravention of the PDPO

In reaching the conclusion that there was a contravention of the PDPO by the data users, the Hong Kong District Court considered the following provisions:

• Section 4 of the PDPO, which provides that “a data user shall not do an act, or engage in a practice, that contravenes a data principle unless the act or practice, as the case may be, is required or permitted under the PDPO”.
• Principle 3(1) of the Data Protection Principles in Schedule 1 of the PDPO (PDPO Schedule), which provides that “personal data shall not, without the prescribed consent of the data subject, be used for a new purpose”.
• Principle 4(1) of the PDPO Schedule, which provides that “a data user shall take all practicable steps to ensure that personal data is held against unauthorized or accidental access, etc.”

The Hong Kong District Court held that the publication of the CCTV footages of Madam Tsang in the letter constituted a use of the personal data collected for a new purpose¹². Without the consent of Madam Tsang, the defendants contravened Principle 3(1)¹³. 

Injury to feelings

In Madam Tsang’s witness statement, she stated that upon discovery of the letter, she had been unable to sleep well and felt paranoid and feared that she would be watched and filmed all the time¹⁴. She had to seek medical assistance and was prescribed sleeping pills¹⁵. 

The Hong Kong District Court held that Madam Tsang could not have expected that the defendants would make pictures out of the CCTV footages and use them to her detriment and recognised that her feelings must have been hurt as a result of the misuse of the personal data collected by the defendants in the CCTV footages¹⁶. Having considered the gravity of the injury to her feelings and the manner in which the CCTV footages were misused, the Hong Kong District Court assessed that the appropriate amount of compensation was HK$70,000¹⁷.

Observations / Takeaways

The Singapore High Court’s clarification of the right to private action under section 32(1) of the PDPA in Bellingham v Reed is welcome. At the same time, it is a useful reminder to organisations to be careful about how they use personal data of individuals for marketing and business development, and the need for organisations to comply with the PDPA.

Tsang Po Mann v Tsang Ka Kit makes it clear that the use of personal data collected by CCTV cameras must be in compliance with the PDPO.

The reasons why the two courts have reached opposite decisions can be explained by the different approach taken by the legislative bodies in the two cities.

• For now, in order to support a private action against an organisation in Singapore for a breach of the data protection provisions under the PDPA, an aggrieved data subject will need to not only show that the organisation had contravened the relevant data protection provisions of the PDPA, but that it had suffered “loss or damage” under the heads of loss under common law (i.e., pecuniary loss, damage to property, personal injury including psychiatric illness). 
• The Singapore High Court’s clarification of the Publicly Available Data Exception states that this exception does not apply if the publicly available personal data was obtained through unlawful use of some other personal data. Accordingly, organisations seeking to rely on the Publicly Available Data Exception will need to ensure that such publicly available personal data was not obtained through unlawful means at the outset (e.g., in excess of consent provided by, or purpose notified to, the individual).
• In contrast to the position in Singapore, Hong Kong’s PDPO makes it explicit that the damages referred to in section 66 may include injury to feelings and therefore the plaintiff’s right to damage for injury to feelings was readily recognized by the Hong Kong District Court. Such recognition of the right to privacy is further enshrined in the amendment to the PDPO in 2012¹⁸, which demonstrates the Hong Kong Legislative Council’s attitude towards privacy protection by allowing claims for injury to feelings and other damages for breach of the PDPO.

As Reed v Bellingham is currently being appealed, the position on the right to private action in Singapore under the PDPA may further develop.

Update of 20 September 2022: The decision of the Singapore High Court in Bellingham v Reed discussed in this article has been reversed by the Singapore Court of Appeal in its judgment of 9 September 2022. Access our commentary on the Singapore Court of Appeal’s judgment here.