In more detail

In August 2022, the Appellant lodged a complaint with SKM in relation to the co-founder of one of SKM's affiliates. During SKM's investigation, it disclosed the Appellant's personal data to the person about whom he had complained. The Appellant commenced proceedings against SKM, alleging SKM had breached requirements under the PDPA and caused him to suffer direct loss and damages. The District Court dismissed the Appellant's claims, which led to the present appeal before the High Court.

The key issues considered by the High Court included:

• Whether the Appellant should be deemed to have consented to the disclosure of his personal data by SKM to the person about whom he had complained
• Whether the Appellant suffered actionable loss or damage

The High Court reiterated the requirements and scope of deemed consent under the PDPA, as follows:

• To establish deemed consent under the PDPA, it must first be shown that an individual voluntarily provided their personal data for a purpose, which is a factual inquiry focusing on the objectively obvious purpose for the voluntary provision of personal data, and that the person would reasonably provide such data. Both of these requirements are assessed via an objective inquiry.
• Deemed consent must be wide in that it potentially enables organizations not just to collect but also to use or disclose personal data for a purpose. However, it must be narrow such that it imposes a restriction by permitting the organization to collect, use or disclose the personal data only to the extent required for that purpose. In other words, there should be an important control mechanism inherent within the deemed consent framework.

In applying the deemed consent framework to the present case, the High Court found that it was not reasonable for SKM to have disclosed the Appellant's identity and email. Such disclosure was not objectively reasonable, unless the information was required or necessary for investigating the matter.

However, the High Court ultimately dismissed the Appellant's claim as it found that the Appellant did not suffer any actionable loss:

• SKM's breach of the PDPA did not directly lead to the purported emotional distress suffered by the Appellant, as there were other factors in the chain of causation. In particular, the person who was the subject of the complaint commenced a separate legal claim against the Appellant.
• The High Court could not find that the Appellant suffered actionable emotional distress as a direct result of SKM's breaches of the PDPA. Among other factors, the Appellant had not adduced sufficient evidence to prove the actual emotional impact that he claims SKM's PDPA breaches caused him.

The High Court emphasized that courts must be cautious not to award damages for emotional distress too readily, especially since mental distress by itself does not traditionally constitute sufficient damage for a cause of action to be found.

Key takeaways

The decision clarifies the scope of deemed consent under the PDPA and provides an analysis of how the deemed consent framework overlaps with the purpose limitation principle. Organizations that collect, use and disclose personal data based on deemed consent should reexamine how the personal data they collect may be used or disclosed, in line with the purposes for which data subjects are providing their personal data. The decision also demonstrates that claimants seeking damages for emotional distress under the PDPA face a high evidentiary burden in proving actual harm.

For further information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.

* * * * *

© 2025 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.