Clarifying Consent and Causation: An examination of tortious liability under the PDPA in Piper, Martin v Singapore Kindness Movement [2025] SGHC 173

In the recent decision of Piper, Martin v Singapore Kindness Movement [2025] SGHC 173, the Singapore High Court was presented with a relatively rare opportunity to clarify the scope of a statutory tort under the Personal Data Protection Act 2012 (“PDPA”). In particular, the High Court gave guidance on the scope of deemed consent under the PDPA, the content of a “strict causal link” in establishing causation for damages, and whether emotional distress can amount to actionable loss. In this legal update, we unpack the High Court’s decision.

Background

In summary, the claimant, Mr Martin Piper, had lodged a formal complaint with the Singapore Kindness Movement (“SKM”) regarding the conduct of Ms Carol Loi, who was the co-founder of an affiliate of SKM. In the course of investigating this complaint, SKM disclosed Mr Piper’s personal data—specifically, his full name and email address—to Ms Loi. This disclosure became a focal point of the dispute.

Following the disclosure, Ms Loi initiated legal proceedings against Mr Piper under the Protection from Harassment Act 2014 (“POHA”), alleging that his complaint to SKM constituted harassment. In preparing for her claim, Ms Loi publicly documented her process on Facebook, publishing a series of screenshots, photographs, and written posts in an album. Mr Piper also received threatening messages directed at him.

Believing that SKM’s disclosure of his personal data was wrongful and had directly caused him harm, Mr Piper commenced a statutory tort claim against SKM under Section 48O of the PDPA, which allows the High Court to grant damages, among other reliefs, to a claimant who has suffered loss or damage directly as a result of a contravention by an organisation of any provision of Part 4, 5, 6, 6A or 6B of the PDPA. This includes Section 13 of the PDPA which provides that an organisation is prohibited from collecting, using, or disclosing personal data unless consent has been given—either expressly or deemed—or unless the disclosure is permitted under the PDPA or other written law.

The District Judge’s dismissed Mr Piper’s claim. Mr Piper then brought an appeal to the High Court, which was dismissed. The High Court’s key findings are set out below.

Examining of the scope of deemed consent under the PDPA

As mentioned above, the alleged breach in question related to Section 13 of the PDPA. Consent under Section 13(a) may be established in three ways: express consent under Section 14, deemed consent under Section 15, or deemed consent by notification under Section 15A. Section 13(b) also provides certain situations when an organisation may collect, use or disclose an individual’s personal data without consent – this includes the investigation exception.

To rely on deemed consent under Section 15, two conditions must be satisfied: the individual must have voluntarily provided their personal data for a particular purpose, and it must be reasonable to expect that the individual would do so. When both conditions are met, the individual is deemed to have consented to the collection, use, or disclosure of their data for that purpose. This mechanism is designed to ease operational challenges for organisations in obtaining express consent.

The High Court found that Mr Piper had voluntarily provided his personal data to SKM for the purpose of investigating his complaint. It was also reasonable for him to do so, given that SKM does not process anonymous complaints and required his email address for follow-up communication.

However, the High Court found that SKM did not comply with an objective standard of reasonableness by disclosing Mr Piper’s personal data to Ms Loi.

1. The disclosure did not facilitate the investigation and SKM had no need to authenticate Mr Piper’s identity with Ms Loi. The identity of the complainant was immaterial to the investigation.
2. Even if SKM had intended to facilitate conciliation between the parties, such a purpose would not fall within the scope of the consent Mr Piper was deemed to have given—namely, for the investigation of his complaint.
3. It is foreseeable that the subject of a complaint may feel aggrieved and retaliate if the complainant’s identity is disclosed. Therefore, from both the complainant’s perspective and an objective standpoint, disclosure of personal data should only occur if it is strictly necessary for the investigation.

For these reasons, the High Court found that SKM had breached Section 13 of the PDPA as Mr Piper did not provide any deemed consent to the disclosure of his personal data to Ms Loi. On the same basis, the High Court also found that SKM could not rely on the “investigation exception” under Section 13(b) of the PDPA.

Any loss or damage resulting from breach of the PDPA requires a “strict causal link”

But the finding of a breach by SKM was not the end of the story. The High Court found that Mr Piper had not shown a strict causal link between SKM’s breach and any loss he suffered. Such a link had to be established in order for a claimant to succeed in a claim under Section 48O of the PDPA, as a safeguard against frivolous claims arising from minor or technical breaches.

While the High Court acknowledged that a person who is the subject of a complaint might retaliate if the complainant’s identity is revealed, it took the view that Ms Loi’s response of commencing POHA proceedings and publishing the process on social media could not be said to be “likely to occur” or “glaringly obvious” or to have posed a “manifest and obvious risk”. Therefore, the High Court found that Ms Loi’s behaviour had broken the legal chain of causation between SKM’s breaches of the PDPA and the purported loss suffered by Mr Piper. Mr Piper did not suffer any actionable emotional distress.

Conclusion

The High Court’s decision is a timely reminder to organisations dealing with personal data. In a situation where an individual voluntarily provides their data to the organisation for a specific purpose, the organisation must ensure that their use and disclosure of the personal data is strictly confined to the purpose for which the data has been provided. The finding that there was no actionable damage was made in the specific circumstances of the case. This may not be the case in future instances of PDPA breaches. Moreover, while the statutory tort may have failed, it remains the case that the High Court found a breach of the PDPA – and the party in breach may still be subject to other penalties arising from the breach from the Personal Data Protection Commission.

For more information, please contact:

Basil Lee (basil.lee@helmsmanlaw.com)

Irvin Ho (irvin.ho@helmsmanlaw.com)