A Singapore court in Martin Piper v Singapore Kindness Movement [2024] SGDC 292 (Piper v SKM) had the opportunity to discuss further the right of private action under Section 48O (formerly Section 32) of the Personal Data Protection Act 2012 (PDPA).

Brief Background

The claimant, Martin Piper (MP), filed a complaint with Singapore Kindness Movement (SKM) against Ms Carol Loi Pui Wan (Ms Loi), founder of SKM’s affiliate “SGFamilies Ground-up Movement” (GUM).  The complaint relates to a Telegram chat group named “SG Families Watchgroup” (Telegram Group), which allegedly promoted discriminatory and false information against transgender people.  MP believed Ms Loi may be linked to the Telegram Group due to its name being closely related to GUM.

After an exchange of emails discussing the complaint regarding the Telegram Group, SKM emailed Ms Loi on 7 September 2022, directly copying MP in the email and setting out the email correspondence between them, requesting Ms Loi to communicate directly with MP.  MP took exception to this and argued that SKM revealed his personal data in breach of the PDPA and therefore, he is entitled to relief under Section 48O of the PDPA.

Ruling of the Court

The court ruled that there was no PDPA breach in disclosing MP’s personal data to Ms. Loi, as deemed consent applied.  When an individual voluntarily provides personal data to an organisation, it is assumed there is a purpose for doing so and that they consented to the collection, use or disclosure of the data for that purpose.

In this regard, the court found that it was reasonable for MP to voluntarily provide his personal data to make the complaint against Ms Loi, which satisfies the requirement of deemed consent under the PDPA.  This is because MP wrote a complaint of a serious nature, to get SKM to commence investigations.  MP would have to provide his identity if he expected SKM to investigate the complaint.

Additionally, the court considered the fact that (1) MP had voluntarily provided his personal data on multiple occasions to SKM although there was no need to; and (2) MP did not request for his complaint to be kept anonymous, private or confidential.

The court noted in obiter that MP failed to establish a direct causal link between the alleged loss or damage and SKM’s purported PDPA violations.  The court reiterated that the direct causal requirement in Section 48O of the PDPA is one of two control mechanisms identified by the Court of Appeal in Reed, Michael v Bellingham, Alex [2022] 2 SLR 1156 (Reed v Bellingham) limiting the right of private action, and is to be stringently applied (see our article on Reed v Bellingham).

Conclusion

Piper v SKM provides additional guidance on the propriety of an action under Section 48O of the PDPA and further insight on how deemed consent provisions under the PDPA are applied.  Individuals sharing their personal data should be mindful that consent to processing their data may be deemed from their actions.  On the other hand, organisations should maintain proper documentation when processing personal data, especially when handling complaints.

For More Information

OrionW regularly advises clients on data protection and cybersecurity matters.  For more information about compliance with data protection and cybersecurity laws, or if you have questions about this article, please contact us at info@orionw.com.

Disclaimer: This article is for general information only and does not constitute legal advice.