I. Executive Summary

In the landmark decision of Reed, Michael v Bellingham, Alex (Attorney-General Intervener) [2022] SGCA 60, the Court of Appeal (“CA”) provided significant guidance on two provisions of the Personal Data Protection Act (Act 26 of 2012)[1] (“PDPA”). For the first provision, for a defendant to avail himself or herself of the defence under s 4(1)(b) of the PDPA, the defendant must prove on a balance of probabilities that he or she was an “employee acting in the course of his or her employment with an organisation”. For the second provision, the CA clarified the scope of “loss or damage” under s 32(1) of the PDPA (now set out in s 48O(1) of the Personal Data Protection Act 2012), affirming that while the loss of control of personal data does not constitute actionable “loss or damage”, the plaintiff could instead claim for emotional distress caused by the breach of his or her personal data. Notably, the scope of “loss or damage” defined by the CA differs from that defined by the High Court (“HC”) in Bellingham, Alex v Reed, Michael [2021] SGHC 125. This will be analysed in greater detail in the paragraphs below.

II. Material facts

IP Investment Management Pte Ltd (“IPIM”) and IP Real Estate Investments Pte Ltd (“IPRE”) (collectively, the “Employers”) employed Alex Bellingham (“Bellingham”), a former marketing consultant at IPRE. Bellingham’s role included, amongst others, the management of an investment fund known as the “Edinburgh Fund”. In January 2017, Bellingham left IPRE and joined a competitor firm known as Q Investment Partners Pte Ltd (“QIP”) as the Head of Fund Raising. In August 2018, Bellingham contacted Michael Reed (“Reed”), an investor in the Edinburgh Fund, via Reed’s personal email address with the view to offer Reed certain investment opportunities with QIP before the scheduled termination of the Edinburgh Fund in the second half of 2018. Reed was very surprised that Bellingham knew his name, personal email address and investment activity in the Edinburgh Fund (collectively, “Personal Data”). Reed found it unacceptable that Bellingham had used the Personal Data to market opportunities regarding Reed’s impending exit from the Edinburgh Fund. He made an immediate complaint to IPIM about the situation, which eventually led to the Employers commencing proceedings against Bellingham.

III. Procedural history

The Employers first commenced the action against Bellingham in the District Court (“DC”). Specifically, the Employers commenced a private action under s 32(1)[2] of the PDPA (which confers a person who suffers “loss or damage” directly as a result of a contravention of certain provisions in the PDPA a right of action for relief in civil proceedings in a court) against Bellingham. Specifically, the Employers sought (a) an injunction restraining Bellingham from using the personal data belonging to Reed and other customers and (b) an order for Bellingham to surrender and deliver up the said data to the Employers. While the action against Bellingham was originally commenced by the Employers, in March 2019, the Employers applied to join[3] Reed as a plaintiff in the action. This application was granted in May 2019. Subsequently, the District Judge (“DJ”) in IP Investment Management Pte Ltd and others v Alex Bellingham [2019] SGDC 207 denied relief to the Employers on the basis that they lacked any legal standing to bring the action. He reasoned that s 32 only confers a right of private action upon the person whose personal data has been misused and not on any other entity. The DJ, however, granted Reed: (a) an injunction restraining Bellingham from using, disclosing or communicating Reed’s personal data (“the Injunction”); and (b) an order compelling Bellingham to undertake to destroy Reed’s personal data that was in his possession.

Bellingham appealed against the DC’s decision in all aspects to the HC, and the HC judge allowed the appeal. The HC judge noted that a plaintiff bringing an action under s 32(1) of the PDPA must show (a) a contravention of one or more provisions in Parts IV, V or VI of the PDPA; and (b) that he has suffered loss or damage directly as a result of such contravention.

For (a), the HC found Bellingham liable for breaching ss 13[4] and 18[5] of the PDPA (which fell within Part IV) for the unauthorised collection and use of the Personal Data. The HC found that Bellingham had breached s 13 of the PDPA because there was no consent from Reed in the use of his Personal Data. Additionally, the HC found that Bellingham had breached s 18 of the PDPA because the use of Reed’s Personal Data exceeded what a reasonable person would have considered appropriate.

For (b), the HC found that Reed had not suffered any “loss or damage” within the meaning of s 32(1) to grant Reed a right of private action for relief in civil proceedings. While Reed’s case was that he suffered the loss of control of his personal data and emotional distress, the HC held that the scope of “loss or damage” under s 32(1) of the PDPA should be interpreted narrowly to refer to the heads of damage under common law (pecuniary loss, damage to property, personal injury including psychiatric illness) and to exclude damages for emotional distress and the loss of control of personal data.

Dissatisfied with the HC’s finding, Reed appealed to the CA on two grounds to seek the reinstatement of the Injunction granted by the DJ. First, Reed argued that the scope of “loss or damage” in s 32(1) of the PDPA does not exclude the loss of control of personal data and emotional distress. Second, Reed argued that he had in fact suffered “loss or damage”. He had lost control over the Personal Data due to Bellingham’s conduct and was also emotionally distressed because this data concerning his personal investments had been misappropriated by Bellingham.

In addition to the scope of “loss or damage” in s 32(1) of the PDPA, the CA also sought submissions from the parties on the relevance of s 4(1)(b)[6] of the PDPA (which could potentially operate as a defence for Bellingham) and whether the HC judge was correct to hold that the obligations in ss 13 and 18 of the PDPA applied to Bellingham as an individual.

IV. Issues on appeal

On appeal, it was not in contention that Bellingham had contravened ss 13 and 18 of the PDPA. Hence, the CA only had to consider the following remaining issues:

  • whether Bellingham could rely on the defence under s 4(1)(b) of the PDPA for breaching ss 13 and 18 of the PDPA;
  • whether “loss or damage” in s 32(1) of the PDPA includes emotional distress and the loss of control of personal data; and
  • whether Reed had suffered emotional distress.

V. Whether Bellingham could rely on the defence under s 4(1)(b) of the PDPA for breaching ss 13 and 18 of the PDPA

As a preliminary point, the CA held that individuals are subject to obligations under the PDPA, even though the PDPA might, at first glance, only apply to organisations. This is because the definition of an “organisation” under s 2 of the PDPA includes “any individual”. Therefore, the obligations under ss 13 and 18 of the PDPA also apply to individuals such as Bellingham.  However, s 4(1)(b) of the PDPA grants an employee a full defence to avoid liability for any breach of the PDPA if the employee can prove on a balance of probabilities that he or she was “acting in the course of his or her employment with an organisation” when the relevant breaches of the PDPA occurred. To this end, s 4(1)(b) of the PDPA could exempt Bellingham from liability if Bellingham could show on a balance of probabilities that (a) he was an employee and (b) he was acting in the course of employment in committing the breach of the PDPA.

Applying s 4(1)(b) of the PDPA to the case at hand, the CA held that the critical point was that Bellingham “went off on a frolic of his own”[7] by misusing the Personal Data. Regarding Bellingham’s employment with IPRE, although Bellingham had collected the Personal Data in the course of his employment with IPRE, the CA held that this alone was insufficient as the wrongful conduct under ss 13 and 18 only occurred after he had left IPRE. Second, regarding Bellingham’s employment with QIP, although Bellingham had contacted Reed during his employment with QIP, the CA held that the temporal connection[8] between Bellingham’s employment with QIP and Bellingham’s wrongful conduct under ss 13 and 18 was insufficient to prove that the wrongful conduct occurred in the course of employment and for the purpose of his employment. This was because Bellingham was unable to adduce relevant evidence to show that his action should be attributed to QIP. Therefore, Bellingham could not claim the protection afforded by s 4(1)(b) of the PDPA.

The CA also clarified that principles on vicarious liability should not be imported into s 4(1)(b) of the PDPA. The doctrine of vicarious liability imposes secondary liability[9] upon an employer for a tort committed by the employee. This is so even if the employer was not personally at fault. Moreover, even if the employer was vicariously liable, the employee is not relieved of primary liability. This means that both the employer and employee would be held liable. However, the effect of s 4(1)(b) of the PDPA is to exempt the employee who was acting in the course of employment from any obligation under the PDPA, and hence any liability thereunder. In contrast to the doctrine of vicarious liability, if s 4(1)(b) of the PDPA was made out, only the employer would remain subject to obligations under the PDPA.

VI. Whether “loss or damage” in s 32(1) of the PDPA includes emotional distress and loss of control of personal data

Regarding the loss of control of personal data, the CA affirmed the HC’s holding that this does not constitute “loss or damage” under s 32(1) of the PDPA. The reason is that every breach of the PDPA would inevitably involve some form of loss of control of personal data such that it will render the requirement of “loss or damage” redundant if held to constitute “loss or damage”.

In contrast, the CA held that emotional distress falls within the ambit of “loss or damage”. The CA observed that Parliament had expressly created a new cause of action under s 32(1) of the PDPA with the intention of providing robust protection for personal data belonging to individuals. Moreover, as can be gleaned from s 3 of the PDPA, the purpose of the PDPA is “to govern the collection, use and disclosure of personal data by organisations in a manner that recognises both the right of individuals to protect their personal data and the need of organisations to collect, use or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances”. Additionally, the CA further explained that it would not be uncommon for emotional distress to be the only “loss or damage” suffered by a plaintiff owing to a breach of the PDPA by the defendant. If emotional distress did not fall within the ambit of “loss or damage”, the CA held that s 32(1) of the PDPA would become significantly denuded of practical use. Therefore, including emotional distress within the meaning of “loss or damage” would better fulfil Parliament’s intention and further promote the general purpose of the PDPA.

Having so held, the CA went on to address one possible issue arising from the inclusion of emotional distress in the interpretation of “loss or damage”, which is that there might be a sudden increase in frivolous suits with emotional distress as the focus. To address this, the CA put in place several control mechanisms. First, a strict causal link needs to be established between any alleged emotional distress and the contravention of the PDPA by the plaintiff. Second, emotional distress does not include trivial annoyance or negative emotions that form part of the “ordinary vicissitudes of life”.[10] Third, the CA emphasised that the inquiry of whether a plaintiff has suffered emotional damage is a fact-specific inquiry, and should be ascertained from the perspective of the reasonable person in the position of the plaintiff’s subjective state of mind, with reference to the following factors:

  • The nature of the personal data involved in the breach: for instance, financial data is likely to be sensitive. Therefore, the court is more likely to make a finding of emotional distress when a breach of the PDPA involves financial data.
  • The nature of the breach: e.g., whether the breach of the PDPA was one-off, repeated and/or continuing. For instance, if the nature of the breach is continuing, the court is more likely to make a finding of emotional distress.
  • The nature of the defendant’s conduct: for instance, proof of fraudulent or malicious intent may support an inference that the plaintiff was more severely affected. In contrast, an accidental breach by a single typographical error is unlikely to cause cognisable distress. In addition, if the plaintiff reasonably seeks an undertaking from the defendant not to misuse his or her personal data, but the defendant unreasonably refuses to furnish an undertaking, this is a weighty factor in favour of the existence of emotional distress.
  • The risk of future breaches of the PDPA causing emotional distress to the plaintiff.  
  • The actual impact of the breach on the plaintiff.

VI. Whether Reed had suffered emotional distress

Having set out the scope and legal principles pertaining to “loss or damage” in s 32(1) of the PDPA, the CA went on to apply this provision to the facts of the present case.

The CA held that Reed had suffered emotional distress to the extent that it fell under the scope of “loss or damage” under s 32(1) of the PDPA. The CA found it unreasonable that Bellingham had refused to give his word that he would not use the Personal Data in the future. Although Bellingham promised to cease contact with Reed, the CA found that Reed was still placed in a vulnerable position as his Personal Data was still susceptible to misuse by Bellingham. Other factors that supported a finding of emotional distress include the following:

  • The Personal Data included information about Reed’s personal financial investment in the Edinburgh Fund and his impending exit. The CA found that the nature of personal investments that one makes, especially for a business leader like Reed (CEO of Manulife Asset Management (Thailand) Company Limited in Bangkok), would draw scrutiny from prying eyes.
  • When Reed found out that his Personal Data had fallen into the hands of Bellingham, Reed immediately made a complaint to IPIM. The CA found that Reed was anxious enough to flag the matter to IPIM when the potential misuse of his Personal Data had first surfaced.
  • In the subsequent email exchanges between Bellingham and Reed, Bellingham was evasive when confronted about the use of the Personal Data and dismissive of Reed’s concerns about the safety of the Personal Data. The CA found that Bellingham’s responses would have worked to increase Reed’s anxiety.

Pulling all the threads together, the CA was satisfied that based on the sequence of events, Reed was undoubtedly perturbed and anxious about the potential misuse of his Personal Data by Bellingham which demonstrated a direct causal link between Reed’s emotional distress and Bellingham’s contravention of the PDPA. Therefore, the CA allowed the appeal in full and restored the orders made by the DJ.

VIII. Conclusion

All in all, this case was a significant judgement affirming the paramount importance of the protection of personal data to enhance Singapore’s status as a trusted hub and choice location for global data management and processing services. This case also serves as a reminder that employers should put in place good policies and practices to ensure that their clients’ personal data collected are adequately protected, even from their employees. Additionally, regarding s 32(1) of the PDPA, the CA clarified that the scope of “loss or damage” includes emotional distress but not the loss of control of personal data. This increases the scope of possible liability under the PDPA, although not without some residual uncertainty, because the test for s 32(1) of the PDPA hinges on the court’s assessment of each plaintiff’s alleged experience of emotional distress. Regardless, as further case law continues to be developed in this area of law, this subjectivity can potentially be alleviated by more judicial determinations of such situations.

— — — For a PDF version of this article, click here — — —

Written by: Alexis Loy, 4th-Year LL.B. student, Singapore Management University Yong Pung How School of Law.


Edited by: Adele Ling Yan Ying and Yeo Shan Lyn, 2nd-Year LL.B. students, Singapore Management University Yong Pung How School of Law.


[1] This version of the PDPA has since been replaced with the Personal Data Protection Act 2012. As a preliminary point, following amendments to the PDPA, the new provisions are still very similar to the old provisions. Due to this similarity, the court’s interpretation of the old provisions is still highly persuasive. Unless stated otherwise, the provisions discussed in the paragraphs below are with reference to the pre-amended Personal Data Protection Act (Act 26 of 2012).

[2] The following is an extract of s 32(1) of the PDPA.

Right of private action

32.—(1) Any person who suffers loss or damage directly as a result of a contravention of any provision in Part IV, V or VI by an organisation shall have a right of action for relief in civil proceedings in a court.

This section is similar to s 48O(1) of the current version of the PDPA, i.e. the Personal Data Protection Act 2012.

[3] In this case, a joinder refers to the process of adding a new party to the action when the action has already started.

[4] The following is an extract of s 13 of the PDPA.

Consent required

13. An organisation shall not, on or after the appointed day, collect, use or disclose personal data about an individual unless –

(b) the collection, use or disclosure, as the case may be, without the consent of the individual is required or authorised under this Act or any other written law.

This section is similar to s 13 of the current version of the PDPA, i.e. the Personal Data Protection Act 2012.

[5] The following is an extract of s 18 of the PDPA.

Limitation of purpose and extent

18. An organisation may collect, use or disclose personal data about an individual only for purposes—

(a) that a reasonable person would consider appropriate in the circumstances; and

(b) that the individual has been informed of under section 20, if applicable.

This section is the same as s 18 of the current version of the PDPA, i.e. the Personal Data Protection Act 2012.

[6] The following is an extract of s 4(1)(b) of the PDPA.

Application of Act

4.—(1) Parts III, IV, V, VI, VIA and VIB shall not impose any obligation on —

 (b) any employee acting in the course of his employment with an organisation.  

This section is the same as s 18 of the current version of the PDPA, i.e. the Personal Data Protection Act 2012.                 

[7] The CA opined that the issue of whether, in taking a particular course of action, an employee had acted in the course of his employment is a question of mixed fact and law. Evidence has to be adduced of what was done; what the employment required the employee to do and, in appropriate cases, whether the employee deliberately evaded practices set up by the employer to deter such action. Only then would the court be able to determine whether the employee’s action should be attributed to the employment or whether the employee was, as has often been said in this context, “off on a frolic of his own”.

[8] This means that the closeness in time between Bellingham’s employment with QIP and Bellingham’s wrongful conduct under ss 13 and 18 was insufficient for Bellingham to claim the protection afforded by s 4(1)(b) of the PDPA.

[9] In this case, it means that the employer would be held liable for the contravention of the PDPA by the employee even if the employer did not itself contravene the PDPA.

[10] On the “ordinary vicissitudes of life”, the CA did not deem it appropriate then to prescribe a general standard as to what constitutes emotional distress and thought it best to allow the law to develop on a case-by-case basis. However, the CA opined that some negative emotions should be tolerated as part of the ordinary vicissitudes of life and do not amount to emotional distress—“pure mental suffering without physical injury [is] an inevitable fact of interpersonal relationships in private and public life alike” and “people must learn to accept with a certain degree of stoicism the slings and arrows of this vale of tears” (quoted by the CA from the case of Arul Chandran v Gartshore and others [2000] 1 SLR(R) 436 at [13], per G P Selvam J).