Piper, Martin v Singapore Kindness Movement

Complain at Your Own Risk? Deemed Consent and Data Disclosure Under the PDPA
Piper, Martin v Singapore Kindness Movement [2025] SGHC 173; [2025] 5 SLR 293

I. Executive Summary

This case arose from an e-mail complaint lodged by Mr Martin Piper (“Mr Piper”) with the Singapore Kindness Movement (“SKM”) against a third party, Ms Carol Loi (“Ms Loi”). While investigating Mr Piper’s complaint, SKM disclosed Mr Piper's personal information to Ms Loi on multiple occasions and without his express consent. Mr Piper alleged that SKM’s disclosure of his personal data to Ms Loi breached the organisation’s obligations set out within the Personal Data Protection Act 2012 (2020 Rev Ed) (“PDPA”). He thus brought a statutory tort claim against SKM under section 48O of the PDPA for actionable loss or damage suffered arising from their breach.

The General Division of the High Court (“HC”) held that while Mr Piper was deemed to have consented to the use of his personal data for the purpose of investigating his complaint, SKM's actual disclosures to the subject of the complaint exceeded the scope of that deemed consent and were unreasonable in the circumstances. Accordingly, SKM was found to have breached sections 13 and 18(a) of the PDPA. However, the appeal was ultimately dismissed as Mr Piper failed to establish that he suffered actionable loss or damage directly because of SKM's contraventions. 

II. Material Facts

On 27 August 2022, Mr Piper sent SKM an e-mail lodging a complaint against Ms Loi. Ms Loi was the co-founder of “SGFamilies Ground-Up Movement” (“SGFamilies GUM”), an affiliate of SKM. In the e-mail, Mr Piper alleged that Ms Loi was promoting discriminatory and false material against the transgender community via a Telegram chat group/channel named “SG Families Watchgroup” (“Telegram Group”). As the Telegram Group’s name bore a strong similarity to Ms Loi’s organisation, Mr Piper was concerned that Ms Loi was using her authority as co-founder to misrepresent SGFamilies GUM’s position (although in reality, the groupchat was not administered by SGFamilies GUM). He hoped for SKM to launch an investigation against Ms Loi’s message in the group chat, and to regain control of the group chat to address the message. 

On 1 September 2022, SKM informed Mr Piper that they had spoken to Ms Loi and that she had made the following clarifications. She explained to SKM that the Telegram Group was not associated with SGFamilies GUM, that she was not the founder or owner of the Telegram Group, and that she was involved in the Telegram Group in her personal capacity only as a concerned citizen. SKM added that Mr Piper could reach out to Ms Loi directly if he required further clarification.

Mr Piper responded on 4 September 2022 with two more e-mails where he sought to provide further evidence to show SGFamilies GUM’s connection with the Telegram group chat. At this juncture, SKM sent an e-mail to Ms Loi on 7 September 2022 that requested she respond to Mr Piper directly as SKM was not in the position to speak for her. In this e-mail, SKM summarised all the correspondence between them and Mr Piper between 27 August to 4 September 2022, and copied Mr Piper on this e-mail. Between 30 August and 1 September 2022, SKM disclosed Mr Piper's personal data to Ms Loi on three more occasions: once in a phone call, once at a face-to-face meeting, and once by blind-copying Ms Loi in an e-mail reply to Mr Piper. 

On 5 September 2022, Ms Loi filed a claim against Mr Piper under the Protection from Harassment Act 2014 (2020 Rev Ed) (“POHA”), alleging harassment arising from his complaint. She also publicly documented her preparation for the POHA claim on Facebook. In April and May 2023, Mr Piper received threatening messages referencing Ms Loi and her claim. Ms Loi ultimately withdrew her POHA application on 24 May 2023, but Mr Piper filed a claim against SKM for their alleged breach of the PDPA and for emotional damages allegedly arising from the harassment he suffered. 

In the court proceedings below, Mr Piper made two claims. The first claim was that SKM breached their section 13 (consent), 15 (deemed consent) and 18 (reasonableness limitations) obligations under the PDPA by revealing his identity and e-mail to Ms Loi, arguing this was akin to a whistleblowing situation deserving heightened protection. The second was a section 48O statutory tort claim for losses and damages stemming from SKM’s contravention of the PDPA obligations. He claimed that the disclosures caused him to receive death threats, which created emotional distress and financial loss while responding to and defending himself against the POHA claim. 

The District Judge dismissed his claim entirely, and Mr Piper appealed. 

III. Issues on Appeal

On appeal, the HC considered the following issues: 

1. Whether SKM contravened the PDPA (the “Breach Issue”);
2. Whether Mr Piper suffered actionable loss or damage under section 48O of the PDPA (the “Loss Issue”)  

A. The Breach Issue

The HC considered the following matters:

1. (i) Whether Mr Piper should be deemed to have given consent and the scope of such deemed consent, if any;
2. (ii) Whether SKM’s disclosure of the personal data to Ms Loi fell within the scope of the deemed consent and the Purpose Limitation (as defined below); and
3. (iii) Whether SKM can rely on the Investigation Exception (as defined below).

(i) Whether Mr Piper should be deemed to have given consent and the scope of such deemed consent, if any

Section 13(a) of the PDPA imposes an obligation on organisations to only collect, use or disclose personal data about an individual when the individual’s consent is given, or deemed to be given. Deemed consent is governed by section 15 of the PDPA, while deemed consent by notification is governed under section 15A of the PDPA. As the parties agreed that there was no express consent nor deemed consent by notification, the HC focused its inquiry on section 15(1) of the PDPA (deemed consent by conduct).

To establish deemed consent under section 15(1), two inter-related requirements must be satisfied: (a) the individual must have voluntarily provided his personal data to the organisation for a purpose; and (b) it must be reasonable that he would voluntarily provide such data. The purpose is limited to one that is objectively obvious. The HC also made the following observations about the scope of deemed consent: (a) it is wide in that it potentially enables the organisation not only to collect, but also to use or disclose the personal data which has been provided by the individual for a purpose; but (b) it is narrow in that it imposes a restriction by permitting the organisation to collect, use or disclose the personal data only for that purpose, and only to the extent that is required for that purpose. For instance, if a person calling a taxi operator’s hotline wants to book a taxi, it is reasonable that the customer service officer would ask for their name and number. The person is deemed to have consented to the taxi company using that personal data to contact them when the taxi arrives. However, if the taxi company wants to call the same person to market their separate limousine service, this use of their personal data would be beyond the purpose they provided it for.

Further, section 11(1) of the PDPA also states that “an organisation must consider what a reasonable person would consider appropriate in the circumstances”. This objective standard of reasonableness is ascertained by considering the particular circumstances and societal norms. In assessing what is reasonable, a possible step an organisation could take is to view the situation from the perspective of the individual and consider what the individual would think as fair. Finally, section 18(a) of the PDPA permits organisations to collect, use or disclose personal data but only for purposes that a reasonable person would consider appropriate in the circumstances (“Purpose Limitation”). This is in line with the inherent limitation of the scope of deemed consent.

Applying the above, the HC noted that Mr Piper must have voluntarily provided his identity and e-mail address in his e-mail to SKM on 27 August 2022 for the objective purpose of investigating his complaint. It was also objectively reasonable for him to voluntarily provide his name and e-mail address to SKM for the purpose of investigating the complaint, as SKM’s personal data protection policy stipulated that it could not investigate “anonymous complaints”. Mr Piper also had to provide his e-mail address for SKM to correspond with him to provide updates and/or seek further information following its investigations into the matter. Thus, Mr Piper should be deemed to have consented for his personal data to be collected, used, or disclosed, for the sole purpose of investigating his complaint against Ms Loi.

(ii) Whether SKM’s disclosure of the personal data to Ms Loi fell within the scope of the deemed consent and the Purpose Limitation

The HC held it was not reasonable for SKM to have disclosed Mr Piper’s identity and e-mail address to Ms Loi during the investigation. While Mr Piper is deemed to have consented to SKM’s disclosure of his personal data to investigate the complaint against Ms Loi, it was not objectively reasonable for SKM to have disclosed his data to Ms Loi as it was not required or necessary for investigating the matter.

The complaint was not about Ms Loi’s conduct in relation to Mr Piper. SKM could simply have approached Ms Loi, stated the allegations that it was investigating her for, and sought the necessary clarifications from Ms Loi. There was no need for SKM to have authenticated Mr Piper’s identity with Ms Loi before carrying out its investigations, because no part of the investigations would have turned on the identity or e-mail address of the complainant. 

If SKM considered that Mr Piper’s further complaints were without merit, it could simply have told him the same without disclosing his identity and e-mail address to Ms Loi. While SKM, out of goodwill, might have wanted to facilitate conciliation between Mr Piper and Ms Loi, such a purpose would not have fallen within that for which Mr Piper was deemed to have given his consent (i.e. for the purposes of investigating his complaint). 

The HC considered that in the context of complaints, one would reasonably contemplate the possibility of the person complained against feeling aggrieved and even taking some form of retaliatory action against the complainant. Even if a complainant should be expected to stand by his complaint, one would also reasonably contemplate the complainant being concerned about any such repercussions. Hence, it would be reasonable for an organisation to disclose the complainant’s personal data to the person complained against only if it is required or necessary for the purpose of investigating the matter. Therefore, the nature of the allegations is important. One instance where such disclosure may be required or necessary is if the complainant alleges wrongdoing specifically committed against himself or herself. 

However, under the circumstances here, unless SKM could avail itself of one of the exceptions in the PDPA, it had breached sections 13 and 18(a) of the PDPA as the disclosure of Mr Piper’s personal data did not fall within the scope of his deemed consent and the Purpose Limitation. 

(iii) Whether SKM can rely on the Investigation Exception

Section 17 of the PDPA (read with the First Schedule and the Second Schedule) provides for certain situations when an organisation may collect, use or disclose an individual’s personal data without consent. These include the “Vital Interests Exception” (Part 1, paragraph 1(1)(b) of the First Schedule to the PDPA) and the “Investigation Exception” (Part 3, paragraph 3 of the First Schedule to the PDPA).

The Investigation Exception allows the collection, use or disclosure of personal data about an individual without the individual’s consent, when it is “necessary” for any “investigation”. An “investigation” includes “a circumstance or conduct that may result in a remedy or relief being available under any law”. Despite this broad definition, which is not limited to remedies or reliefs related to a wrong that is actionable in law, it remained unnecessary for SKM to have disclosed Mr Piper’s name and e-mail address to Ms Loi. Hence, it remains that SKM has acted in contravention of sections 13 and 18(a) of the PDPA. 

B. The Loss Issue

The HC considered the following:

1. (i) Whether the legal chain of causation between SKM’s breaches and Mr Piper’s alleged losses was broken; and
2. (ii) Whether Mr Piper suffered any loss actionable under section 48O of the PDPA.

(i) Whether the legal chain of causation between SKM’s breaches and Mr Piper’s alleged losses was broken

Section 48O(1) of the PDPA allows the claimant to bring a statutory tort claim. Such a claimant must show that his loss or damage was suffered directly because of the organisation's contravention of the PDPA. This requirement functions as a control mechanism to prevent individuals from commencing frivolous lawsuits against organisations even for minor or technical breaches of the PDPA. The HC held that this required a strict causal link test, which was also in line with Parliament’s intent in enacting the PDPA. 

In this regard, the HC held that SKM’s breach of the PDPA did not directly lead to the purported emotional distress suffered by Mr Piper arising from Ms Loi’s filing of her POHA claim against him and her publication of the process. Instead, Ms Loi’s POHA claim broke the chain of causation between SKM’s breach and Mr Piper’s purported emotional distress. To not break the chain of causation, the alleged intervention of human action must be something likely to occur, or the risks of such a happening was “glaringly obvious”, or there was “manifest and obvious risk”. The HC held that while one would reasonably expect the possibility of a person who is the subject of a complaint taking some form of retaliatory action against the complainant if the latter’s identity is leaked to the former, Ms Loi’s retaliatory behaviour (commencing an action against Mr Piper and documenting this process publicly) could not be said to be “likely to occur” or “glaringly obvious”, or to have posed a “manifest and obvious risk”.

(ii) Whether Mr Piper suffered any loss actionable under section 48O of the PDPA

For completeness, the HC considered whether SKM's PDPA breaches had itself caused Mr Piper actionable emotional distress. The inquiry must be anchored in whether the very individual before the court subjectively suffered emotional distress. The court must take a multi-factorial approach in determining this, including: (a) the nature of the personal data involved; (b) the nature of the breach; (c) the nature of the defendant’s conduct; (d) the risk of future breaches of the PDPA causing emotional distress to the claimant; and (e) the actual impact on the claimant. Based on the above, the HC held that the facts here suggested that Mr Piper did not suffer actionable emotional distress.

While disclosing the name of a complainant, which constituted sensitive data, and the breach was not one-off, the damage would already have been caused to Mr Piper on SKM’s first disclosure of his identity to Ms Loi on 30 August 2022. However, Mr Piper did not suffer any actionable emotional distress as a direct result of SKM’s breaches of the PDPA per se (i.e. independent of Ms Loi’s conduct). Instead, Mr Piper was mainly indignant over SKM’s breaches of the PDPA and their subsequent response, and any emotional distress he suffered stemmed primarily from Ms Loi’s actions following Mr Piper’s initial complaint against her to SKM. Further, while the evidence suggests that SKM’s breaches of the PDPA per se and its subsequent response caused Mr Piper some offence and indignation, they do not demonstrate that he suffered emotional distress.

While the HC agreed with Mr Piper that SKM was, especially from Mr Piper’s subjective perspective, somewhat evasive in managing the aftermath of its PDPA breaches, there was no evidence to suggest that Mr Piper faced any prospect of future misuse of his personal data, especially since Mr Piper’s complaint pertained only to Ms Loi. There was also insufficient evidence from Mr Piper’s witnesses and medical testimony to prove the emotional impact he claimed. the HC held that on a subjective multi-factorial approach, Mr Piper did not suffer any emotional distress actionable under s 48O of the PDPA. The HC clarified that this was not to say that Mr Piper did not suffer any emotional harm from the material events. However, the court must be cautious not to award damages for emotional distress too readily, especially since mental distress by itself does not traditionally constitute sufficient damage for a cause of action to arise.

Written by: Toh Ying Xi Zoe Alexandra, Third-Year LLB student, Singapore Management University Yong Pung How School of Law.
Reviewed by: Ong Ee Ing, Principal Lecturer, Singapore Management University Yong Pung How School of Law.