On 25 May 2021, Singapore's High Court ruled on the right to bring a private action under Section 32(1) of the Personal Data Protection Act 2012 (PDPA). In the present case, a former employee used the clients' names, personal email addresses and investment information without their consent. The former employer, together with one of the affected clients, brought an action under section 32(1) of the PDPA. In particular, the Court of Appeal held that emotional distress is sufficient to constitute the "loss or damage" required for a private action under section 32(1) of the PDPA. The Singapore High Court held that loss or damage is required to bring a private action against an organisation for a breach of the PDPA, and that mere loss of control over personal data or distress caused by such loss of control is not sufficient.
Original source