Belaws Home ›› Sinagpore ›› Blog ›› Singapore Court of Appeal issues new guidance on private actions for PDPA violations
Singapore Court of Appeal issues new guidance on private actions for PDPA violations
The Personal Data Protection Act 2012 (“PDPA”) sets out the obligations of businesses and organisations in relation to the collection, use and disclosure of personal data, with the Personal Data Protection Commission (“PDPC”) being the competent authority.
The PDPC is able to issue, among other things, compliance directives and impose financial penalties known as public enforcement actions. In addition, companies or individuals may bring private actions against the offending organisation if they have suffered loss or damage in connection with a breach of the PDPA.
However, not all forms of loss give rise to a private right of action under the PDPA. In a recent decision, the Singapore Court of Appeal has clarified what can constitute loss or damage under the PDPA, thereby clarifying the right to a private action under the PDPA.
Legislative history sum-up
This court case concerns an investor who was the victim of a PDPA breach by a fund manager who disclosed his personal data when he changed jobs to join competitors.
The fund manager’s former employer and the investor in question brought a civil action against the manager under what was then Section 32 of the PDPA. Ultimately, the Singapore High Court held that the investor had not suffered “loss or damage” giving rise to the right of private action under Section 32 and that emotional distress and loss of control of personal data did not fall within the scope of such “loss or damage”.
The case then went to the Singapore Court of Appeal, which provided much-needed clarification on what constitutes “loss or damage”, and thus when a person is entitled to bring a civil action under the PDPA.
Singapore Court of Appeal’s new guidance on the right to private action under the PDPA
Through a broad interpretation of the PDPA’s private enforcement provisions, taking into account its overall purpose, the Singapore’s Court of Appeal held that emotional distress falls within the category of “loss or damage” under the PDPA, but not mere loss of control of personal data.
This new guidance from the Court of Appeal is of the utmost importance for individuals and organisations that process or manage personal data, as it clarifies the circumstances that can lead to a private civil action in the context of a breach of the PDPA, thereby completing the range of defences available to victims, which until now has consisted mainly of public enforcement actions.
In addition, this decision will have an impact on the field of PDPA at the jurisdictional level but also at the level of companies, organisations and individuals who have to manage personal data in one way or another:
- Indeed, by recognising that emotional distress related to a breach of the PDPA gives rise to a private civil action, the Singapore Court of Appeal sets the tone for future decisions, showing an inclination to seriously defend personal data.
- On the other hand, this decision also means that all entities that have to process personal data must ensure that they have appropriate safeguards in place to prevent their misuse, as the availability of enforcement measures is now clarified at the private level, which means that the scope of protection is now generally broader and more effective.
Additional important amendments to the PDPA to note
Following amendments to the PDPA, with effect from 1 October 2022, the maximum financial penalty that can be imposed on an organisation by the Personal Data Protection Commission of Singapore (PDPC) has been increased to 10% of the organisation’s annual turnover in Singapore, if its annual turnover exceeds S$10 million, and to S$1 million in all other cases. Previously, the maximum penalty was S$1 million.
Question about the PDPA in Singapore?
If you need more information about the PDPA in Singapore, why not talk directly to one of our experts.
Please note that this article is for information purposes only and does not constitute legal advice.
Our consultations last for a period of 1 hour and are conducted by our expert lawyers who are fluent in English, French and Thai.
Consultations can be hosted via WhatsApp or Video Conferencing software for your convenience. A consultation with one of our Blockchain experts is undoubtedly the best way to get all the information you need and answer any questions you may have about your new business or project.
Up to 1 hour
Web conferencing details provided upon confirmation
$150 USD
Related Articles
+66 (0) 92 990 1046We are open: Monday – Friday
9 am – 6 pm (UTC+7)
Belaws 2017 - 2023 | Belaws provides information and software only. Belaws is not a "lawyer referral service" and does not provide legal service or participate in any legal representation. Belaws is not a law firm or a substitute for an attorney or a law firm. The use of Belaws is subject to our Terms of Use.