Public Bank Berhad v National Feedlot Corporation Sdn Bhd (P-1) (02(f)-14-05/2024(W))

AND NATIONAL FEEDLOT CORPORATION

NATIONAL MEAT & LIVESTOCK

DATO’ SRI DR MOHAMAD SALLEH BIN ISMAIL … RESPONDENTS (HEARD TOGETHER WITH CIVIL APPEAL NO: 02(f)-15-05/2024(W)

NATIONAL FEEDLOT CORPORATION

NATIONAL MEAT & LIVESTOCK

3.

4.

DATO’ SRI DR MOHAMAD SALLEH BIN ISMAIL ... APPELLANTS) 03/07/2025 11:11:18 02(f)-14-05/2024(W) Kand. 109 CORAM HASNAH MOHAMMED HASHIM, CJM ABDUL RAHMAN SEBLI, CJSS ABU BAKAR JAIS, FCJ GROUNDS OF JUDGMENT [1] There were two appeals before us. Appeal No.02(f)-14-05/2024(W) was an appeal by the appellant (“Public Bank”) against the decision of the Court of Appeal allowing the respondents’ appeal on liability whereas Appeal No.02(f)-15-05/2024(W) was an appeal by the respondents against the Court of Appeal’s decision awarding them only nominal damages of RM10,000.00 despite having proved liability against Public Bank. They had claimed RM60 million for general damages, RM250 million for aggravated damages and RM250 million for exemplary damages, totalling RM560 million. [2] In reversing the decision of the High Court on liability, the Court of Appeal found Public Bank to be in breach of an implied term of contract imposing a duty of confidentiality not to disclose the respondents’ banking information. As for the reason why the Court of Appeal awarded only nominal damages of RM10,000.00 to the respondents despite having found liability to have been proved against Public Bank, it was because the respondents were found to have failed to prove their loss. The learned judge of the High Court who tried the case at the first instance even suggested a token sum of RM15.00 (Fifteen Ringgit) as nominal damages had she allowed the respondents’ claim, which she did not. [3] Having heard submissions on 26 February 2025, 16 April 2025 and 26 May 2025, we dismissed Public Bank’s appeal on liability and adjourned the case to another date to hear arguments on damages. These are the grounds of our decision on liability. [4] The respondents’ claim against the bank arose from a press conference held by one Rafizi bin Ramli (“Rafizi”) on 7 March 2012. At the press conference Rafizi made statements concerning the respondents’ confidential banking information and circulated them in the form of Annexure A to E to his media statement. [5] The confidential banking document that Rafizi disclosed to the media was Annexure E which referred to the 5th respondent’s loan application with Public Bank for a loan facility to purchase 8 units of condominium at KL Eco City. He highlighted and explained the details of Annexure E, which is a management assessment document to enable Public Bank to assess and decide if the 5th respondent and his son were sufficiently eligible to obtain the loan facility from Public Bank. [6] The 5th respondent’s loan application was approved on 23 May

However, after 6 months had lapsed, the loan offer was withdrawn by Public Bank on 4 January 2012 and the loan was terminated. Therefore, there was no loan taken by the 5th respondent, contrary to the allegation made by Rafizi in his press conference on 7 March 2012. [7] In finding Public Bank liable for breach of banking secrecy and confidentiality, the Court of Appeal made the following observations at paragraphs [38] and [39] of its grounds of judgment: “[38] Insofar as the contractual duty is concerned, there is no dispute that there is an implied term in the contractual relationship between the Plaintiffs and the Bank that information relating to the Plaintiff’s banking details (CP-BS) will remain confidential and will not be disclosed to unauthorised persons. This is trite and is plain commercial and common sense. This is because confidentiality is the cornerstone of all banking business. The confidentiality is necessary to give confidence to customers in entrusting their banking business to financial institutions. [39] Thus, pursuant to BAFIA (FSA) the Bank as a financial institution owed a duty of secrecy over the customers’ banking information. Indeed, if such a duty into a banking contract is implied, then that would be repugnant to the statutory protection of customers’ banking information. Thus, the need to imply such a term is obvious, imperative and necessary.” [8] The respondents’ case against Public Bank was that in disclosing their confidential banking information, the bank had breached its: (a) statutory duty under the Banking and Financial Institutions Act 1989 (“BAFIA”); (b) fiduciary duty; and (c) contractual duty. [9] In its defence Public Bank pleaded, amongst others, that two of its staff, namely one Cheam Chen Hooi and one Johari bin Mohamad working hands in glove had, without its authority, accessed and printed the respondents’ confidential information from a restricted area of its computer system and for that reason it could not in law be held liable or responsible for the unauthorised and unforeseen acts of its staff. [10] It was submitted that the two “rogue” employees of the bank had gone beyond the scope of their employment and were on a frolic of their own. In other words, it was the bank staff and not the bank itself that should be held responsible for breaching the bank’s duty of secrecy and confidentiality to the respondents. Apparently the basis for this legal proposition is that the domestic inquiry that was conducted by Public Bank against the two bank staff had found both of them guilty. [11] On 29 July 2019, after a trial that lasted 5 years and heard before two judges (the first having retired before the trial was concluded) the learned judge who took over the conduct of the trial dismissed the respondents’ claim with costs of RM350,000.00 on the ground that the respondents failed to prove liability. [12] On 30 August 2023, the Court of Appeal allowed the respondents’ appeal in part by holding that Public Bank had breached its implied contractual duty of confidentiality owed to the 1st, 2nd, 3rd and 5th respondents. In its grounds of judgment, the Court of Appeal saw the case as “one which turns on the question whether the Bank had breached its implied contractual duty to maintain confidentiality over the Plaintiffs’ banking information.” [13] It was no doubt a decision that was grounded on the common law principle enunciated by the English Court of Appeal in Tournier v National Provincial and Union Bank of England [1924] 1 KB 461 (“Tournier”) where it was inter alia held by Bankes LJ as follows: “At the present day, I think it may be asserted with confidence that the duty is a legal one arising out of contract, and that the duty is not absolute but qualified. It is not possible to frame any exhaustive definition of the duty. The most that can be done is to classify the qualification, and to indicate its limits.” (Emphasis added) [14] The ratio decidendi of the case is that the bank’s duty of secrecy and confidentiality arises out of contract and is not absolute but qualified. It laid down and defined the scope of a banker’s duty of secrecy and confidentiality to its customers. [15] Arising from the decision of the Court of Appeal, two questions of law were posed by Public Bank for our determination and they were as follows: Question 1 “Whether a bank’s implied contractual duty of confidentiality is a qualified duty (as opposed to absolute duty) in that there are defences or exceptions to such a duty.” Question 2 “Where a bank’s implied contractual duty of confidentiality is a qualified duty, whether a bank’s liability thereunder, in a banker-customer contract of service, is a fault-based liability (as opposed to a strict liability).” [16] Question 1 seeks to persuade this court to adopt Tournier, the case that formulated the scope of a banker’s implied duty of secrecy and confidentiality and laying down four exceptions to such duty. Question 2 is a follow up and corollary to Question 1. [17] The four exceptions to the bank’s duty of secrecy and confidentiality that Tournier laid down are as follows:

where disclosure is under compulsion of law;

where there is a duty to the public to disclose;

where the interest of the bank requires disclosure; and

where the disclosure is made by express or implied consent of the customer. [18] Tournier was a landmark decision which has been accepted as the correct position of the law on banking secrecy and confidentiality in the following Commonwealth jurisdictions: United Kingdom - See “The Law and Practice of Banking Volume 2: Securities for Bankers’ Advances”, Seventh Edition, J. Milnes Holden, ELBS at paragraph 2-100; the Privy Council case of Robertson v Canadian Imperial Bank of Commerce [1995] 1 All ER 824, 829; the Privy Council case of Stanford Asset Holdings Ltd and another (Appellants) v AfrAsia Bank Ltd (Respondent) [2023) UKPC 35; the Australian position as can be seen in “The Law Relating to Banker and Customer in Australia” by G.A. Weaver and C.R. Craige, The Law Book Company Limited, 1975 at paragraph 6-5; “Banking Law and the Financial System in Australia”, 5th edition, WS Weerasooria, Butterworths, Australia, 1000 at paragraph 27.4; In New Zealand see “Introduction to New Zealand Banking Law” by Mark Russell, Second Edition, The Law Book Company Limited 1991at page 58; In India see “The Banking Law in Theory and Practice, Third Edition, S.N. Gupta, Volume 1, Universal Law Publishing Co. Pvt. Ltd at page 246. [19] In Malaysia, the principle has yet to be affirmed and formally adopted by this court. It has however been accepted by the High Court and the Court of Appeal in the following cases: Tan Eng Seong v Malayan Banking Bhd [1997] 2 CLJ Supp 552 (High Court); Wong Yeng Mun v CIMB Bank Berhad [2011] 1 CLJ 785 (High Court); Ng Lee Kiau & Anor v Malayan Banking Bhd [2011] MLJU 562 (High Court); Tey Por Yee v Protasco Bhd [2021] 1 MLJ 76 (Court of Appeal); and in the present appeal case as reported in National Feedlot Corporation Sdn Bhd & Ors v Public Bank Bhd [2023] 10 CLJ 430 where S Nantha Balan JCA speaking for the Court of Appeal said at paragraph [27]: “[27] At page 471, the legal position at common law was clearly established that there is ‘no absolute contract’ that the customers confidential information will never be disclosed under any circumstances. In this regard, Bankes LJ made the following legal propositions: “I hold, as a matter of law, that there is no such absolute contract as Sir Harold Smith has contended for between a banker and his customer. He has contended that there is an absolute contract that the banker shall not under any circumstances disclose the state of a customer’s account to any person. I hold, as a matter of law, that there is no such absolute contract. … At the present day, I think it may be asserted with confidence that the duty is a legal one arising out of contract, and that the duty is not absolute but qualified.” [20] At the hearing before us, learned counsel for Public Bank candidly admitted that none of the exceptions laid down in Tournier apply in Public Bank’s favour. What he then urged upon us was to open up Tournier to a new exception, which is a fault-based exception instead of the duty of secrecy and confidentiality being a strict liability duty. Simply put, the contention was that no liability ought to be attached to the bank if the breach of the bank’s duty of secrecy and confidentiality was not committed by the bank but by others within the establishment without its knowledge. [21] On his part learned counsel for the respondents submitted that in the Malaysian context, the scope of the banker's duty of secrecy is, in addition to the general principles enunciated in Tournier, provided in the BAFIA which replaced the Banking Act 1973. It was submitted that the appellant had breached the law across all manner of confidentiality, contractual, fiduciary and statutory duties. On the bank’s duty of secrecy, we were referred to section 97(1) of BAFIA which provides as follows: “Secrecy.

No director or officer of any licensed institution, or of any external bureau established, or any agent appointed, by the licensed institution to undertake any part of its business whether during his tenure of office, or during his employment, or thereafter, and no person who for any reason, has by any means access to any record, book register, correspondence, or other document whatsoever, or material, relating to the affairs or, in particular, the account, of any particular customer of the institution, shall give, produce, divulge, reveal, publish or otherwise disclose, to any person, or make a record for any person, of any information or document whatsoever relating to the affairs or account of such customer.” [22] It can thus be seen that in Malaysia the bank’s duty of secrecy is regulated by statute and not an implied contractual duty as in the case of common law under the Tournier principle. Learned counsel for Public Bank however argued that the provision does not apply to the bank. It was submitted that the provision is only directed at the bank’s director or officer and not at the bank as a financial institution. [23] In refuting the argument, learned counsel for the respondents submitted that the word “person” in the second part of the section includes the bank and not just its directors or officers. The argument was that Public Bank being a “corporation” and therefore a “person” within the meaning of section 2 of BAFIA, it can be held liable under section 97(1) of the Act for a breach of banking secrecy. [24] I agree because it makes no sense that a bank whose duty of secrecy is regulated by statute should be absolved of liability where the breach of that duty is committed by those under its employment, supervision and care. It may be hard on the bank to be burdened with such responsibility but to allow it to avoid liability by shifting the blame on its employees is to defeat the object behind section 97(1) of BAFIA rather than to put its object into effect. That will render the provision redundant and bereft of all meaning. [25] It needs to be appreciated that it is the second part and not the first part of section 97(1) that imposes the duty of secrecy on the bank. What the first part provides is to prohibit a director, officer, external bureau, or agent appointed by the bank from undertaking, at any time, any part of the bank’s business. It has nothing to do with the bank’s duty of secrecy. Therefore, the argument that the bank’s duty of secrecy under section 97(1) is not directed at the bank but at its director or officer is misconceived. [26] BAFIA it will be noted not only provides for the bank’s duty of secrecy. It also provides for exceptions to the duty and these exceptions are found in sections 97(2), 98(1) and 99(1). While section 98 applies only to the Central Bank, sections 97(2) and 99(1) are meant to absolve licensed financial institutions from liability provided they satisfy the strict criteria therein. The three subsections are reproduced below: Section 97(2) “97.(2) This section shall not apply to any information or document which at the time of the disclosure is, or has already been made, lawfully available to the public from any source other than the licensed institution, or to any information which is in the form of a summary or collection of information set out in such manner as does not enable information relating to any particular licensed institution or any particular customer of the licensed institution to be ascertained from it.” Section 98(1) “98.(1) Section 97 shall not apply to the disclosure of any information or document –

To the Bank, or to any director, officer or

employee of the Bank, or to any person

appointed by the Bank under subsection 3(3), or to the Advisory Panel, where the disclosure is for the purpose of the exercise of powers, the performance of functions or the discharge of duties of the Bank, or of the director, officer or employee of the Bank, or of the person appointed under subsection 3(3), or of the Advisory Panel; or (b) to any person rendering professional services to the Bank in relation to any matter of law, accountancy, valuation, or any other matter requiring professional knowledge, where he is authorised in writing by the Bank to obtain the information from the licensed institution for the purpose of his services to the Bank.” Section 99(1) “99. (1) Section 97 shall not apply to the disclosure of any information or document –

Which the customer, or his personal representative, has given permission in writing to disclose;

In a case where the customer is declared bankrupt, or, if the customer is a corporation, the corporation is being or has been wound up, in Malaysia or in any country, territory or place outside Malaysia;

Where the information is required by a party to a bona fide commercial transaction, or to a prospective bona fide transaction, to which the customer is also a party, to assess the creditworthiness of the customer relating to such transaction, provided that the information required is of a general nature and does not enable the details of the customer’s account or affairs to be ascertained;

For the purposes of any criminal proceedings or in respect of any civil proceedings –

Between a licensed institution and its customer or its guarantor relating to the customer’s transaction with the institution; or

(ii) Between the licensed institution and two or more parties making adverse claims to money in a customer’s account where the licensed institution seeks relief by way of interpleader;

Where the licensed institution has been served a garnishee order attaching moneys in the account of the customer;

To an external bureau established, or to an agent appointed, by the licensed institution with the prior written consent of the Bank;

Where such disclosure is required or authorised under any other provision of this Act;

Where such disclosure is authorised under any Federal law to be made to a police officer investigating into any offence under such law and such disclosure to the police officer being, in any case, limited to the accounts and affairs of the person suspected of the offence; or

Where such disclosure is authorised in writing by the Bank.” [27] By the terms of sections 97(2), 98(1) and 99(1) of BAFIA, it is patently clear that under Malaysian law, the exceptions to the bank’s duty of secrecy are more precise and more elaborate than the four broad exceptions provided by Tournier. None of these statutory exceptions apply in favour of Public Bank and none was pleaded in its defence. It must therefore be taken that the breach of section 97(1) by the bank was without justification. [28] Given the fact that there is written law in force in Malaysia on the bank’s duty of secrecy and the exceptions to the duty, we had on the second date of hearing on 16 April 2025 invited parties to address us on the applicability of Tournier, an English common law position, in the light of section 3(1) of the Civil Law Act 1956 (“the Civil Law Act”) although not addressed by the parties both in their written and oral submissions. [29] With section 3(1) of the Civil Law Act staring us in the eyes, it would not have been proper for us to close one eye to the statutory provision just because it was not brought to our attention. It is our duty as the apex court to uphold the law. This is especially necessary in view of Public Bank’s heavy reliance on Tournier (and the cases that followed it) to avoid liability and its proposal to open up a new exception to the four already set out in the case as encapsulated in leave Question 2. [30] If indeed Tournier has no application in the light of section 97(1) of BAFIA read with section 3(1) of the Civil Law Act, then it will not be open to Public Bank to rely on the four common law exceptions or on any new common law exception outside the scope of sections 97(2) and 99(1) of BAFIA to avoid liability. It is a cardinal principle of legislative interpretation that Parliament does not legislate in vain. It would have inserted in section 99(1) the fault-based exception as suggested by learned counsel for Public Bank if it had such intention, but Parliament in its wisdom omitted to do so. [31] An example where the Tournier principle is incorporated into BAFIA is subparagraph (1)(a), and to some extent subparagraphs (1)(d), (g) and

of section 99, which allow for disclosure of confidential information or documents by the bank under those limited circumstances. These are adoptions, albeit in different terms, of exceptions 1, 2 and 4 of the bank’s duty of secrecy and confidentiality under the Tournier principle. [32] It was with a view to clear our minds on this issue that half way through the submissions on 16 April 2025, we adjourned the hearing to another date to give ample time and opportunity to both counsel to provide us with written submissions on the interplay between section 97(1) of BAFIA and section 3(1) of the Civil Law Act vis-a-vis the common law position as laid down in Tournier. They had obligingly done so, for which we are thankful, and the matter was fully argued on the third and last day of hearing on 26 May 2025. [33] Section 3(1) of the Civil Law Act provides as follows: “Application of U.K. common law, rules of equity and certain statutes 3.(1) Save so far as other provisions has been made or may hereafter be made by any written law in force in Malaysia, the Court shall –

in Peninsular Malaysia or any part thereof, apply the common law of England and the rules of equity as administered in England on the 7th of April 1956;

in Sabah, apply the common law of England and the rules of equity, together with statutes of general application, as administered or in force in England on 1 December 1951;

in Sarawak, apply the common law of England and the rules of equity and statutes of general application, as administered or in force in England on 12 December 1949, subject however to subparagraph (3)(ii); Provided always that the said common law, rules of equity and statutes of general application shall be applied so far only as the circumstances of the States of Malaysia and their respective inhabitants permit and subject to such qualifications as local circumstances render necessary.” [34] I had occasion to deal with this provision in Tun Dr Mahathir Mohamad & Ors v Datuk Seri Mohd Najib Tun Hj Abdul Razak [2018] 4 CLJ 361 where, in delivering the unanimous decision of the Court of Appeal, I had said at paragraph [16]: “[16] Common law refers to rules of law developed by judges as opposed to those created by statute. Section 3 of our Interpretation Acts 1948 and 1967 (“the Interpretation Acts”) defines “common law” to mean the common law of England. But it must not be assumed that every sphere of the common law of England is applicable in this country. Its applicability is governed by s. 3(1) of the Civil Law Act 1956 (“the Civil Law Act”) which provides as follows… …….. [17] What this provision means in its application to Peninsular Malaysia is that the common law of England as administered on 7 April 1956 is only to be applied where there is no written law in force in Malaysia after the coming into force of the Civil Law act on 7 April 1956.” [35] Since there is written law in Malaysia on the bank’s duty of secrecy after the coming into force of the Civil Law Act on 7 April 1956, in this case section 97(1) of BAFIA, the common law of England on such duty of the bank as administered on 7 April 1956 has no application. Therefore, being the common law of England on banking secrecy as administered prior to the coming into force of the Civil Law Act, Tournier has no relevance in determining whether Public Bank is liable for breaching its duty of secrecy to the respondents. The case was decided in 1924, some 30 years before the cut off date of 7 April 1956. On this score alone Public Bank’s appeal, based as it was on the Tournier principle, must fail. [36] With regard to the fault-based exception, the argument of learned counsel for Public Bank was that under a banker-customer contract of service, a bank has a “Quincecare duty” to carry out a customer’s instructions with reasonable care and skill. Like Tournier, the “Quincecare duty” is also a common law concept that was expounded in Hilton v Westminster Bank Limited [1926] 135 LT 358 and which culminated in the recent Supreme Court case of Philipp v Barclays Bank UK Plc [2023] 4 All ER 847, 849 where it was held at page 34: “[34] As for any contract for the supply of services in the course of a business, there is a term implied by law in a contract between a bank and its customer that the bank must carry out the services with reasonable care and skill..” [37] The following authorities were also cited in support: Carter’s Breach of Contract, JW Carter, LexisNexis Butterworth, 2011, Australia at paragraph 2-65; Liverpool City Council v Irwin [1977] A.C. 239 (House of Lords); Trietel, Law of Contract, Eighth Edition, 1991, by G.H. Tritel at page 739; Frustration and Force Majeure, Third Edition, at page 5; Greaves & Co (Contractors) Ltd v Baynham Meikle and Partners [1975] 3 All ER 99,103; Platform Funding Ltd v Bank of Scotland plc (formerly Halifax plc) [2009] QB 426; CIMB Islamic Bank Bhd v Mohd Saufi Taib [2015] 6 CLJ 897. [38] Westminster Bank was followed in Selangor United Rubber Estates Ltd v Cradock (a bankrupt) and others (No.3) [1968] 2 All ER 1073; [1968] 1 WLR 1555. On the strength of these common law authorities, it was submitted that Public Bank is only required to carry out its implied contractual duty of confidentiality with reasonable care and skill. It was submitted that so long as the bank has carried out its implied contractual duty of secrecy and confidentiality with reasonable care and skill, the bank cannot be faulted or be held liable for breach of contract if the customer’s confidential information/documents were disclosed by its rogue employee or employees. [39] Public Bank’s dissatisfaction with the decision of the Court of Appeal was in failing to hold that the bank’s implied contractual duty of confidentiality is a qualified duty, i.e. that Public Bank’s liability under such qualified duty, in a banker-customer contract of service, is a fault-based liability and not a strict liability. But the judgment of the Court of Appeal does not bear this out. Paragraph [27] of the grounds of judgment reproduced in paragraph [19] above clearly shows that the Court of Appeal proceeded on the basis that the duty is qualified and not strict. [40] Of pertinence to note is that Public Bank accepted that the two individuals responsible for breaching its duty of secrecy which led to the press conference by Rafizi were its employees. With due respect to learned counsel, the distinction that he drew between qualified duty and strict liability is illusory at best, because if the bank’s duty of secrecy is a qualified duty, it means that liability is not strict. Strict liability means there is no qualification or exception to the duty. The availability of the four exceptions in Tournier itself as defences to a breach of the duty of secrecy and confidentiality renders the argument wholly untenable. In any event it is BAFIA that governs the bank’s duty of secrecy and not the common law principles propounded in Tournier and Barclays Bank. [41] It was for all the reasons aforesaid that we found no merit in Public Bank’s appeal, hence the decision to dismiss the appeal with costs to the respondents. We saw no necessity to answer the two leave questions posed as they were predicated on the common law of England which has no application in the light of section 3(1) of the Civil Law Act. My learned sister Justice Hasnah Mohammed Hashim, Chief Judge of Malaya and my learned brother Federal Court Judge Justice Abu Bakar Jais have seen this judgment in draft and have agreed with it. Signed ABDUL RAHMAN SEBLI Chief Judge (Sabah and Sarawak) Dated: 1st July 2025. For the Appellant: Chan Kok Keong and Tiang Min Min of Tetuan Shook Lin & Bok For the Respondents: Tan Sri Dato’ Sri Muhammad Shafee Abdullah, Sarah Abishegam, Noor Farhah Binti Mustaffa, Tharrence Anthony (PDK) and Suhail Shamsuddin (PDK) of Tetuan Shafee & Co.