Singapore High Court clarifies scope of deemed consent and actionable loss under the PDPA

Key takeaways

• The High Court emphasized that organizations must act reasonably and within scope of the purpose for which personal data is provided, even when relying on deemed consent.
• Organizations cannot disclose personal data unnecessarily, even in the context of investigations, unless such disclosure is strictly required for the stated purpose.
• Claimants seeking damages under Section 48O of the PDPA must establish a direct causal link between the breach and the alleged loss or damage, including in situations where the alleged loss or damage is emotional distress. Intervening acts by third parties may break the chain of causation.
• Emotional distress claims under the PDPA require clear evidence of actual harm, and courts will apply a multi-factorial approach to assess such claims.

Background

The case arose from a complaint lodged by Mr. Martin Piper (the "Appellant") with the Singapore Kindness Movement (SKM, the "Respondent") regarding alleged discriminatory conduct by a third party, Ms. Carol Loi. During its investigation into the complaint, SKM disclosed the Appellant's name and email address (i.e., personal data) to Ms. Loi without his express consent. SKM sought to rely on deemed consent as the grounds for this disclosure to Ms. Loi. The Appellant subsequently brought a statutory tort claim under Section 48O of the PDPA, alleging that SKM's disclosure was wrongful and caused him emotional distress.

The case considers deemed consent, which is provided for under Section 15 of the PDPA. Deemed consent is where an individual is deemed to consent to the collection, use or disclosure of their personal data by an organization, on condition that:

(i) The individual voluntarily provides the personal data to the organization for that purpose; and

(ii) it is reasonable that the individual would voluntarily provide the data.

The case further considers the right to private action which is provided for in Section 480 of the PDPA. The right to private action provides an individual who suffers loss or damage under the PDPA to a right of action for relief in civil proceedings in court.

Recap of district Court decision

In the District Court, the judge dismissed the Appellant's claim, finding that:

• He was deemed to have consented to the disclosure of his personal data, as he voluntarily provided his name and email address to SKM for the purpose of investigating his complaint.
• The District Judge determined that SKM's disclosure was reasonable as disclosing Piper's identity was necessary to facilitate the investigation. The District Court rejected the Appellant’s claim that they could have investigated his complaint without disclosing his personal data, explaining that it was for SKM to decide how to most effectively conduct its investigations. The District Court also noted that since the Appellant did not request anonymization it was reasonable for SKM to have disclosed his identity to Ms. Loi.
• The District Court further considered whether the Vital Interests and Investigation exceptions to consent (provided for under Part 3 of the First Schedule to the PDPA) were applicable. The court determined that neither exception applied because (1) the background surrounding the complaint lacked the necessary urgency required to avail of vital interests exception, and (2) the complaint lacked the requisite clear actionability in law required to avail of the investigation exception.
• As for the claim made under Section 48O of the PDPA, the District Court determined that there had to be a direct causal link between the contravention and the loss or damage suffered. The District Court ruled that the Appellant's emotional distress arose as a direct result of Ms. Loi’s harassment claim, rather than from SKM's alleged breaches of the PDPA per se. The requisite direct causal link between the breach and harm suffered was thus not established, as his emotional distress primarily stemmed from the retaliatory actions of Ms. Loi.

High Court Decision: Key issues and analysis

1. Deemed consent and the Scope of Disclosure

The High Court agreed that Mr. Piper voluntarily provided his personal data to SKM for the purpose of investigating his complaint. However, the Court found that SKM's disclosure of Mr. Piper's data to Ms. Loi exceeded the scope of deemed consent and breached Sections 13 and 18(a) of the PDPA.

Key Findings:

• Purpose Limitation: Deemed consent is limited to the specific purpose for which the data was provided, and that purpose must be one that a reasonable person would consider appropriate in the circumstances. The Court emphasized that SKM could have conducted its investigation without disclosing Mr. Piper's identity. As the Court noted, "SKM could simply have approached Ms. Loi, stated the allegations that it was investigating her for, and sought the necessary clarifications from her".
• Reasonableness Standard: Section 18(a) requires organizations to only collect, use or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances. This applies even when relying on deemed consent. The Court rejected SKM's argument that it was necessary to disclose Mr. Piper's identity to authenticate the complaint or facilitate conciliation between the parties.
• Investigation Exception: SKM argued that it could rely on the investigation exception provided for under Part 3 of the First Schedule to the PDPA, which allows disclosure of personal data without consent if necessary for an investigation. The Court rejected this argument, finding that the disclosure of Mr. Piper's data was not necessary for SKM's investigation. 

2. Actionable loss or damage under Section 48O

Section 48O of the PDPA provides individuals with a right of private action if they suffer loss or damage directly caused by a contravention of the PDPA. The High Court reaffirmed that a strict causal link between the alleged breach and the damage is required to establish actionable loss or damage, including where the loss or damage suffered is emotional distress.

Key findings:

• Causation: The Court found that Mr. Piper's emotional distress primarily stemmed from the retaliatory actions of Ms. Loi (e.g., her filing a harassment claim and publicizing the process on Facebook), rather than SKM's disclosure of his personal data. The Court noted these actions constituted a new intervening act that broke the chain of causation between SKM’s breach under the PDPA and Mr. Piper’s alleged emotional distress.
• Emotional Distress: The Court applied a multi-factorial approach to assess whether Mr. Piper suffered actionable emotional distress due to SKM's breach, looking at:
• Nature of Personal Data: While Mr. Piper's name and email address were sensitive in the context of a complaint, they were not inherently highly sensitive. The Court observed that the damage would already have been caused to Mr. Piper on SKM's first disclosure of his identity.
• Nature of SKM's Conduct: SKM's breach was not malicious but stemmed from a lapse in judgment. While SKM’s response to Mr. Piper’s concerns was somewhat evasive, there was no evidence of a risk of future misuse of his data.
• Actual Impact: Mr. Piper failed to provide sufficient evidence (e.g, medical reports) to substantiate his claim of emotional distress caused by SKM's breach. The Court stated, “the evidence suggests that SKM’s breaches of the PDPA per se and its subsequent response caused Mr. Piper some offense. However, they do not demonstrate that he suffered emotional distress”.

Practical implications:

• Organizations must carefully assess whether the disclosure of personal data is necessary and reasonable for the stated purpose. Even in the context of investigations, disclosure should be limited to what is strictly required.
• The investigation exception under the PDPA cannot be used as a blanket justification for disclosing personal data. Organizations must demonstrate that the disclosure is necessary for the investigation.

• Claimants must provide clear evidence of actionable loss or damage directly caused by a PDPA breach. Emotional distress claims require substantiation through objective evidence, such as medical reports or contemporaneous records.
• Courts will not award damages for emotional distress arising from unrelated or intervening events, even if they are indirectly linked to the PDPA breach in question.

Key takeaways for organizations

This decision underscores the importance of adhering to the principles of purpose limitation and reasonableness under the PDPA. Organizations should:

1. Limit Disclosure: Ensure that personal data is disclosed only to the extent necessary for the stated purpose. In the context of investigations, consider anonymizing complainants’ and respondents’ personal information where possible.
2. Document Decision-Making: Maintain clear records of the rationale for disclosing personal data, particularly in sensitive cases involving complaints or investigations.
3. Train Staff: Provide regular training to staff on the limits of deemed consent and the requirements for handling personal data under the PDPA.

Conclusion

The High Court’s decision in Piper v. Singapore Kindness Movement provides valuable guidance on the scope of deemed consent and the requirements for proving actionable loss under the PDPA. Organizations should take a cautious and measured approach when relying on deemed consent.

It is noted that this judgment remains subject to appeal. Organizations are advised to monitor any developments arising from potential appellate proceedings, which may further clarify the issues addressed in this case.

Should you need assistance or have enquiries about whether and how this new Advisory affects your organization, please reach out to your usual contact at Hogan Lovells or the authors.

Authored by Charmian Aw and Ciara O'Leary.