SINGAPORE: The High Court on Friday (Aug 29) ruled that a local charity breached an obligation to protect the personal data of a man by revealing his identity to the person about whom he had complained.
This is a turnaround in a lawsuit that started last year, when Mr Martin Piper sued the Singapore Kindness Movement (SKM) for revealing his details to Ms Carol Loi, whom he had accused of transphobia.
The case involves findings on the situations in which an individual is deemed to have consented to the collection, use or disclosure of his or her personal data.
Friday's decision comes after Mr Piper appealed against a district court's dismissal of his suit.
Justice Hoo Sheau Peng found that it was unnecessary for SKM to have disclosed Mr Piper's personal details to Ms Loi in the course of investigating his complaint against her.
Out of goodwill, SKM might have wanted to conciliate between Mr Piper and Ms Loi, but this did not fall within the purpose for which Mr Piper gave SKM his details, which was to investigate his complaint, she found.
The judge ruled that SKM had breached its obligations under the Personal Data Protection Act (PDPA). But she dismissed Mr Piper's appeal as she found that SKM's breach did not directly lead to his purported emotional distress.
Mr Piper told CNA he was relieved by the judge's finding on the PDPA breach.
"What matters most to me is the court's clear statement that organisations cannot simply expose the identity of complainants in the way SKM did," he said.
"In the right circumstances, complaints must be handled with confidentiality to prevent retaliation and to give people the confidence to speak up against wrongs.
"I hope SKM reflects on this judgment and improves how it handles complaints, so that no one else has to go through what I did. And perhaps, going forward, that it shows a little more kindness in practice."
SKM said in a statement that its actions were motivated by a commitment to transparency and resolving conflicts in an amicable manner.
"When Mr Piper contacted us with serious allegations, we served as an impartial facilitator and honest broker to help address the concerns raised," said the non-government organisation.
"Our intended outcome was always to promote direct, respectful communication between the parties involved while maintaining the integrity of our investigative process."
SKM also said that it had comprehensively reviewed its PDPA policies and guidelines after the case, and would maintain regular reviews to ensure compliance with evolving regulatory standards and best practices.
Ms Loi is the co-founder of SGFamilies Ground-up Movement, an affiliate of SKM.
On Aug 27, 2022, Mr Piper sent an email to SKM alleging that Ms Loi was promoting false and discriminatory material against transgender people through a Telegram group called "SG Families Watchgroup".
He said that he hoped SKM would reach out to Ms Loi, gain control of the Telegram group and remove the "nasty content" in it.
Mr Piper's email contained his full name and email address. This personal data was disclosed to Ms Loi when an SKM staff member copied her in a subsequent reply to Mr Piper.
In September 2022, Ms Loi sued Mr Piper for harassment. She also made Facebook posts documenting her process of filing the claim, after which Mr Piper received threatening messages.
Ms Loi withdrew the harassment suit in May 2023.
Last August, Mr Piper sued SKM for damages for emotional distress, and a declaration that the charity had breached its obligations under the PDPA.
During the trial, it emerged that even before Ms Loi was copied in the email reply, SKM had revealed Mr Piper's identity to her in a phone call, at a meeting and by blind copying her in an earlier email response.
A district judge dismissed Mr Piper's suit after finding that he was "deemed to have consented" to the disclosure because he volunteered his personal data, wanted SKM to investigate his complaint and did not request to be anonymous.
Mr Piper appealed against this decision, and the appeal was heard at the High Court.
Justice Hoo analysed whether Mr Piper had given his "deemed consent" for his details to be disclosed to Ms Loi.
To establish deemed consent, the nature of the personal data being disclosed must be weighed against the purpose of providing such data in the first place, she said.
"For instance, it would be reasonable for an individual to voluntarily provide his name and contact details within a form for the purpose of participating in a free-to-enter competition, where no prize money is involved," said the judge.
But if the form asks for bank account details, it would not be reasonable to say that the individual volunteered this information for the same purpose, she said.
This is because such sensitive personal data would not be required to join a free-to-enter competition with no prize money.
In Mr Piper's case, it was reasonable that he voluntarily provided his name and email address to SKM for the purpose of investigating his complaint, said the judge.
This was because SKM's personal data protection policy stated that it was generally unable to deal with anonymous complaints, and so SKM could continue to correspond with him on the complaint over email.
"It then follows that SKM could only have collected, used or disclosed Mr Piper's full name and email address for the sole purpose of investigating his complaint against Ms Loi," said Justice Hoo.
The judge found that it was unnecessary for SKM to have disclosed Mr Piper's personal data to Ms Loi in the course of investigations.
"There was simply no need for SKM to have authenticated Mr Piper's identity with Ms Loi before carrying out its investigations, because no part of the investigations would have turned on the identity or email address of the complainant," she said.
"Put another way, it was immaterial whether Ms Loi knew Mr Piper's personal data."
Justice Hoo further noted that Mr Piper's complaint was not about Ms Loi's conduct towards him specifically.
"SKM could simply have approached Ms Loi, stated the allegations that it was investigating her for, and sought the necessary clarifications from Ms Loi," she said.
"Upon receiving Ms Loi's clarifications, SKM could have come to its findings, before taking the appropriate remedial action, if any."
If Ms Loi had refused to cooperate, SKM could have considered other means to escalate the matter for investigations, she said.
And if SKM thought that Mr Piper's complaints had no merit, it could have told him so, although even then there would have been no reason to disclose his personal details to Ms Loi, the judge found.
Justice Hoo also said that in the context of a complaint, the person being complained about could reasonably feel aggrieved, bear a grudge and even retaliate against the complainant.
It was reasonable for a complainant to be concerned about such repercussions, even if he or she was expected to stand by the complaint, she said.
It was therefore reasonable for an organisation to disclose the complainant's personal data only if needed for investigating the matter.
"The nature of the allegations would be important. One instance where such disclosure may be required or necessary is if the complainant alleges wrongdoing specifically committed against himself or herself," said the judge.
Mr Fong Wei Li, Ms Tiffanie Lim and Ms Choy Su Wen of law firm Forward Legal acted for Mr Piper.
SKM was represented by Senior Counsel Gregory Vijayendran and Ms Meher Malhotra of Rajah & Tann.
Continue reading...
This is a turnaround in a lawsuit that started last year, when Mr Martin Piper sued the Singapore Kindness Movement (SKM) for revealing his details to Ms Carol Loi, whom he had accused of transphobia.
The case involves findings on the situations in which an individual is deemed to have consented to the collection, use or disclosure of his or her personal data.
Friday's decision comes after Mr Piper appealed against a district court's dismissal of his suit.
Justice Hoo Sheau Peng found that it was unnecessary for SKM to have disclosed Mr Piper's personal details to Ms Loi in the course of investigating his complaint against her.
Out of goodwill, SKM might have wanted to conciliate between Mr Piper and Ms Loi, but this did not fall within the purpose for which Mr Piper gave SKM his details, which was to investigate his complaint, she found.
The judge ruled that SKM had breached its obligations under the Personal Data Protection Act (PDPA). But she dismissed Mr Piper's appeal as she found that SKM's breach did not directly lead to his purported emotional distress.
Mr Piper told CNA he was relieved by the judge's finding on the PDPA breach.
"What matters most to me is the court's clear statement that organisations cannot simply expose the identity of complainants in the way SKM did," he said.
"In the right circumstances, complaints must be handled with confidentiality to prevent retaliation and to give people the confidence to speak up against wrongs.
"I hope SKM reflects on this judgment and improves how it handles complaints, so that no one else has to go through what I did. And perhaps, going forward, that it shows a little more kindness in practice."
SKM said in a statement that its actions were motivated by a commitment to transparency and resolving conflicts in an amicable manner.
"When Mr Piper contacted us with serious allegations, we served as an impartial facilitator and honest broker to help address the concerns raised," said the non-government organisation.
"Our intended outcome was always to promote direct, respectful communication between the parties involved while maintaining the integrity of our investigative process."
SKM also said that it had comprehensively reviewed its PDPA policies and guidelines after the case, and would maintain regular reviews to ensure compliance with evolving regulatory standards and best practices.
Related:
MR PIPER'S COMPLAINT AND LAWSUIT
Ms Loi is the co-founder of SGFamilies Ground-up Movement, an affiliate of SKM.
On Aug 27, 2022, Mr Piper sent an email to SKM alleging that Ms Loi was promoting false and discriminatory material against transgender people through a Telegram group called "SG Families Watchgroup".
He said that he hoped SKM would reach out to Ms Loi, gain control of the Telegram group and remove the "nasty content" in it.
Mr Piper's email contained his full name and email address. This personal data was disclosed to Ms Loi when an SKM staff member copied her in a subsequent reply to Mr Piper.
In September 2022, Ms Loi sued Mr Piper for harassment. She also made Facebook posts documenting her process of filing the claim, after which Mr Piper received threatening messages.
Ms Loi withdrew the harassment suit in May 2023.
Last August, Mr Piper sued SKM for damages for emotional distress, and a declaration that the charity had breached its obligations under the PDPA.
During the trial, it emerged that even before Ms Loi was copied in the email reply, SKM had revealed Mr Piper's identity to her in a phone call, at a meeting and by blind copying her in an earlier email response.
A district judge dismissed Mr Piper's suit after finding that he was "deemed to have consented" to the disclosure because he volunteered his personal data, wanted SKM to investigate his complaint and did not request to be anonymous.
Mr Piper appealed against this decision, and the appeal was heard at the High Court.
"DEEMED CONSENT"
Justice Hoo analysed whether Mr Piper had given his "deemed consent" for his details to be disclosed to Ms Loi.
To establish deemed consent, the nature of the personal data being disclosed must be weighed against the purpose of providing such data in the first place, she said.
"For instance, it would be reasonable for an individual to voluntarily provide his name and contact details within a form for the purpose of participating in a free-to-enter competition, where no prize money is involved," said the judge.
But if the form asks for bank account details, it would not be reasonable to say that the individual volunteered this information for the same purpose, she said.
This is because such sensitive personal data would not be required to join a free-to-enter competition with no prize money.
In Mr Piper's case, it was reasonable that he voluntarily provided his name and email address to SKM for the purpose of investigating his complaint, said the judge.
This was because SKM's personal data protection policy stated that it was generally unable to deal with anonymous complaints, and so SKM could continue to correspond with him on the complaint over email.
"It then follows that SKM could only have collected, used or disclosed Mr Piper's full name and email address for the sole purpose of investigating his complaint against Ms Loi," said Justice Hoo.
UNNECESSARY TO REVEAL HIS DETAILS
The judge found that it was unnecessary for SKM to have disclosed Mr Piper's personal data to Ms Loi in the course of investigations.
"There was simply no need for SKM to have authenticated Mr Piper's identity with Ms Loi before carrying out its investigations, because no part of the investigations would have turned on the identity or email address of the complainant," she said.
"Put another way, it was immaterial whether Ms Loi knew Mr Piper's personal data."
Justice Hoo further noted that Mr Piper's complaint was not about Ms Loi's conduct towards him specifically.
"SKM could simply have approached Ms Loi, stated the allegations that it was investigating her for, and sought the necessary clarifications from Ms Loi," she said.
"Upon receiving Ms Loi's clarifications, SKM could have come to its findings, before taking the appropriate remedial action, if any."
If Ms Loi had refused to cooperate, SKM could have considered other means to escalate the matter for investigations, she said.
And if SKM thought that Mr Piper's complaints had no merit, it could have told him so, although even then there would have been no reason to disclose his personal details to Ms Loi, the judge found.
CONCERNS ABOUT RETALIATION
Justice Hoo also said that in the context of a complaint, the person being complained about could reasonably feel aggrieved, bear a grudge and even retaliate against the complainant.
It was reasonable for a complainant to be concerned about such repercussions, even if he or she was expected to stand by the complaint, she said.
It was therefore reasonable for an organisation to disclose the complainant's personal data only if needed for investigating the matter.
"The nature of the allegations would be important. One instance where such disclosure may be required or necessary is if the complainant alleges wrongdoing specifically committed against himself or herself," said the judge.
Mr Fong Wei Li, Ms Tiffanie Lim and Ms Choy Su Wen of law firm Forward Legal acted for Mr Piper.
SKM was represented by Senior Counsel Gregory Vijayendran and Ms Meher Malhotra of Rajah & Tann.
Continue reading...