Reed, Michael v Bellingham, Alex (Attorney-General, intervener)

• Jurisdiction: Singapore
• Judge: Sundaresh Menon CJ
• Judgment Date: 09 September 2022
• Neutral Citation: [2022] SGCA 60
• Court: Court of Appeal (Singapore)
• Docket Number: Civil Appeal No 174 of 2020
• Published date: 14 September 2022
• Year: 2022
• Hearing Date: 04 April 2022,03 March 2022
• Plaintiff Counsel: Tay Yong Seng, Yap Wei-Ming Alexander, Ang Ann Liang and Alyssa P'ng Hui-Jing (Allen & Gledhill LLP)
• Defendant Counsel: Ong Ziying Clement, Suresh s/o Damodara, Ning Jie and Lim Dao Yuan Keith (Damodara Ong LLC),Joel Chen Zhi'en, Bryan Fang, Wong Thai Chuan and Chow Zi En (Attorney-General's Chambers)
• Subject Matter: Statutory Interpretation,Construction of statute,Purposive approach,Personal Data Protection Act 2012 (Act 26 of 2012),Meaning of "loss or damage" in s 32(1) of the Personal Data Protection Act 2012,What amounts to emotional distress that is actionable under s 32(1) of the Personal Data Protection Act 2012,Meaning of "acting in the course of his employment with an organisation" in s 4(1)(b) of the Personal Data Protection Act 2012
• Citation: [2022] SGCA 60

Judith Prakash JCA (delivering the judgment of the court): Introduction

This appeal raises, among other issues, the interesting question of the scope of the phrase “loss or damage” in s 32(1) of the Personal Data Protection Act 2012 (Act 26 of 2012) (“PDPA”). Section 32(1) confers a right of private action on any person who suffers loss or damage directly as a result of the contravention of any provision in Part IV, V or VI of the PDPA. It is the appellant’s case that his emotional distress and the loss of control of his personal data fall within the meaning of “loss or damage”, and that he is therefore entitled to claim injunctive relief under s 32.

We take this opportunity to clarify the ambit of the right of private action in s 32(1) of the PDPA in relation to these two alleged heads of loss. Any reference to the PDPA in this judgment shall unless otherwise stated, be to the version of the Act in force in 2018. Further, unless otherwise expressly indicated references to s 32 or sub-sections thereof shall be to the following provisions:

Right of private action

32.—(1) Any person who suffers loss or damage directly as a result of a contravention of any provision in Part IV, V or VI by an organisation shall have a right of action for relief in civil proceedings in a court. (2) If the Commission has made a decision under this Act in respect of a contravention specified in subsection (1), no action accruing under subsection (1) may be brought in respect of that contravention until after the decision has become final as a result of there being no further right of appeal. (3) The court may grant to the plaintiff in an action under subsection (1) all or any of the following: (a) relief by way of injunction or declaration; (b) damages; (c) such other relief as the court thinks fit. Background

By DC/OSS 170/2018 (“OSS 170”), IP Investment Management Pte Ltd (“IPIM”) and IP Real Estate Investments Pte Ltd (“IPRE”) (together, the “Employers”) commenced a private action in the State Courts under s 32 against their former employee, Alex Bellingham (the “respondent”). The Employers sought an injunction restraining the respondent from using certain personal data belonging to the appellant, Michael Reed, and other customers, and an order for the respondent to deliver up said data. OSS 170 was filed on 1 October 2018. On 8 March 2019, the Employers applied to join the appellant as a plaintiff in the action. This application was granted on 23 May 2019.

The District Judge (“DJ”) subsequently denied relief to the Employers on the basis that they lacked legal standing to bring the action. He reasoned that s 32 only confers a right of private action upon the person whose personal data has been misused and not on any other entity. The DJ, however, granted the appellant: (a) an injunction restraining the respondent from using, disclosing or communicating the appellant’s personal data (“the Injunction”); and (b) an order that the respondent undertake to destroy the appellant’s personal data that was in his possession (“the Undertaking Order”). The DJ’s decision is found in IP Investment Management Pte Ltd and others v Alex Bellingham [2019] SGDC 207 (the “DGD”).

Dissatisfied with the DJ’s decision, the respondent filed an appeal in the High Court. The High Court judge (“the Judge”) allowed the appeal. He noted that a plaintiff bringing an action under s 32(1) must show (a) contravention of one or more of the provisions in Parts IV, V or VI; and (b) that he has suffered loss or damage directly as a result of such contravention. The Judge accepted that the respondent had contravened ss 13 and 18 of the PDPA (which fall within Part IV) in respect of the appellant’s data but held that the appellant had not suffered any “loss or damage” within the meaning of s 32(1). While the appellant’s case was that he suffered loss of control of his personal data and emotional distress, the Judge held that neither of these two types of losses was recognised under s 32(1). The Judge thus set aside the DJ’s orders. The Judge’s decision is found in Bellingham, Alex v Reed, Michael [2021] SGHC 125 (“GD”). The appellant asks this court to reverse the decision of the Judge.

The respondent’s employment

The Employers are connected companies in the business of managing funds. They and IP Investment Management (HK) Ltd (“IPIM HK”) are part of a group referred to as “IP Global”. Originally employed by IPRE as a marketing consultant in 2010, the respondent was seconded to IPIM HK in 2016. Among other things, the respondent’s role involved management of an investment fund known as the “Edinburgh Fund”. This was an investment fund set up in 2015 by IPIM and IPIM HK to acquire, develop and manage a student property. The Edinburgh Fund was an Accredited Investors only, single asset, close-ended fund. It was scheduled to be terminated in the second half of 2018.

In January 2017, the respondent left the employ of IPRE and joined a competitor of IPIM known as Q Investment Partners Pte Ltd (“QIP”) as its “Head of Fund Raising”. QIP was set up by one Peter Young, who had previously been Chief Executive Officer of IPIM.

In August 2018, the respondent contacted some investors in the Edinburgh Fund, including the appellant. The respondent claimed in OSS 170 that he came to know of the appellant through his employment with IPIM. His evidence was that the appellant’s name “must have been brought up during some conversations”.The respondent also stated that he obtained the appellant’s e-mail address from the latter’s LinkedIn account, which was a public source. In the absence of evidence to the contrary, the Judge accepted the respondent’s explanations and the appellant does not contest this portion of the GD on appeal.

On 15 August 2018, the respondent sent the following e-mail to the appellant at the latter’s personal e-mail address:

…

I am unsure what background you know re QIP but it was business set up by Peter Young, formerly CEO of IP Investment Management.

I hope you don’t mind me touching base regarding your upcoming Edinburgh exit. We have put specific GBP opportunities in place to cater to this. This includes both debt and equity, short and medium term, income producing as well as equity with distributions so we can help you in whatever capacity required. In addition, we have put specific incentives in place.

I can run through this over a coffee if that suits?

The appellant was “very surprised” that the respondent knew his name, personal e-mail address and investment activity in the Edinburgh Fund (collectively, “the Personal Data”). He found it “unacceptable” that the respondent had used the Personal Data to market “opportunities regarding [the appellant’s] impending exit from [the] Edinburgh Fund.” On 21 August 2018, the appellant sent the following e-mail to Mr Mark Ferguson (“Mr Ferguson”), IPIM’s Director of Investor Relations & Business Development, querying the fact that QIP had information about his investment in the Edinburgh Fund:

I received this note from Q-Investment. They are aware of my exiting the Edinburgh investment. I don’t understand how they would be aware of my involvement and / or investment.

Has Peter Young taken the client list of IP when setting up Q?

I would value your insights.

On the same day, IPIM’s solicitors, M/s Allen & Gledhill LLP (“A&G”), sent the respondent a letter alleging that he had breached his “obligations not to misuse confidential and/or personal data.” The letter demanded that the respondent (a) return all copies of confidential and/or personal data of IPIM’s customers; (b) confirm that he and QIP no longer retained any copies of such information; and (c) undertake that he and QIP would not make any further unauthorised use of such information.

On 28 August 2018, the appellant replied to the respondent’s e-mail of 15 August 2018. The appellant wanted to know how the respondent had come to access the Personal Data, and what steps the respondent would take to protect the Personal Data:

…

… I would welcome your clarification of two issues:- · … I am curious how you know of my dealings with IP Global and, equally relevantly, how you are aware of the timing of the maturity of one of my holdings with IP Global? · … I am equally curious how you have my personal email address and have been able to cross-reference this address to my specific involvement with IP Global, namely, the Edinburgh project.

…

In view of my comments and concerns on the security of my personal information, I would welcome your guidance and insights as to how you have accessed my data and how you will protect it, now that you have it, …

…

On 31 August 2018, the respondent sought further details of the alleged breaches from A&G. On 3 September 2018, A&G wrote to the respondent, repeating its earlier demands. The respondent replied to A&G on 10 September 2018 in these terms:

…

… I carried out sales responsibilities as well as being the Responsible Officer (‘RO’) of the IPIM (the investment management arm of IP Global) business. IPIM is the relevant entity that originated the Edinburgh Fund. As a RO, my responsibility include [sic] to supervise and oversee the IPIM business ensuring all investors have been subject to appropriate Know Your Customers Check and onboarded properly from a regulatory standpoint.

Any contact made with individuals was on the basis of publicly available information including social media platform. I am not aware of the breach of confidentiality or misuse of data that your client is referring to. Going forward, I have no interest in speaking to individuals clearly that have [sic] no interest in working with me. I trust this matter is resolved.

On 12 September 2018, the respondent replied to the appellant’s 28 August 2018 e-mail, stating as follows:

…

Your personal details including your...