Hogan Lovells - Asia-Pacific Data, Privacy and Cybersecurity Guide 2025 - Flipbook - Page 45
Asia-Pacific Data Privacy and Cybersecurity Guide 2025
to the co-founder, the defendant had breached
the consent and purpose limitation obligations
in the PDPA, which led to his suffering loss and
damage including emotional distress.
The Court held that there was no contravention
of the PDPA by the defendant. In particular,
the plaintiff was deemed to have given his
deemed consent for his identity to be disclosed
to the co-founder with a view to removing the
allegedly discriminatory messages from the
group chat. The conditions for deemed consent
to operate under the PDPA were found to be
met; namely, the plaintiff had voluntarily
provided his identity to the defendant; and
it was reasonable for him to have done so to
facilitate the defendant’s investigation into
the matter. Additionally, the Court noted that
the plaintiff did not at any time request for his
complaint to be anonymised, despite it being
open to him to have done so.
Finally, the Court considered that even if there
had been a breach of the PDPA (which was not
the case here), the plaintiff had failed to prove
that he suffered loss or damage that was caused
by the alleged contravention of the PDPA. Such
causal link must be made out before damages
can be awarded in a private action under the
PDPA, and this echoes the position taken by
the Singapore Court of Appeal in an earlier
judgment, Reed, Michael v Bellingham,
Alex in 2022.
Thematic observations
Singapore continues to see a very high level
of enforcement activity by the PDPC, which
remains one of the most active data protection
regulators in the region to-date. The publishing
of the PDPC’s enforcement decisions allow
us to understand the considerations that
are applied by the PDPC in any finding of a
contravention as well as award of a financial
penalty. In particular, section 48J of the PDPA
requires the following salient aspects to be
considered in the award of financial penalties
for failures to protect personal data: the gravity
45
