Author(s)
Both s. 13 of the Data Protection Act 1998 (“DPA 98”) and Art. 82 of the General Data Protection Regulation (“GDPR”) provide an individual with a right to compensation where she suffers material or non-material damage (including distress) – see Google Inc v Vidal-Hall [2015] EWCA Civ 311 and s. 168 of the Data Protection Act 2018 (“DPA 18”) as a result of infringements of the data protection principles contained in the respective legislative schemes. The DPA 98 applies to data breaches occurring before 23 May 2018 whilst the GDPR, as supplemented by DPA 18, applies to breaches occurring on or after that date. After the end of the post-Brexit implementation period on 31 January 2020 the UK GDPR applies.
In the context of s. 13 of the DPA 98, and there is no reason in principle the same would not apply to Art. 82 GDPR, the decision of the Supreme Court in Google LLC v Lloyd [2021] 3 WLR 1268 (Lord Leggatt) has now settled the point that a claimant must prove non-trivial levels of distress were caused by an infringement in order to obtain an award of compensatory damages. Put another way the principle of de minimis applies:
“(f) Conclusion on the effect of section 13
138. For all these reasons, I conclude that section 13 of the DPA 1998 cannot reasonably be interpreted as conferring on a data subject a right to compensation for any (non-trivial) contravention by a data controller of any of the requirements of the Act without the need to prove that the contravention has caused material damage or distress to the individual concerned”.
A parallel right to compensation for distress might arise in misuse of private information (“MPI”) and breach of confidence (“BOC”) claims. As there is often a significant, though complete, overlap between the facts giving rise to each cause of action and the effects thereof, care must be taken by the court to avoid double recovery (i.e. by making a single award of damages for distress rather than one for each cause of action). Care must also be taken to ensure all elements of the MPI and BOC claims, which themselves differ, are present (see in particular on the different elements of the various causes of action Warren v DSG Retail Limited [2021] EWHC 2168 (QB)).
Absent any guiding principles for the quantification of damages for distress set out in the legislation, the courts have sought to provide guidance in cases such as Mosley v MGN Ltd [2008] EWHC 1777 (QB), recently affirmed in Gulati v MGN Limited [2015] EWHC 1428 (Ch), TLT v Secretary of State for the Home Department [2016] EWHC 2217 (QB) and Reid v Price [2020] EWHC 594 (QB), the TLT case being particularly relevant to lower value ‘one-off’ data breaches. The guidance in those cases is useful for quantifying damages in DPA 98, GDPR, MPI and BOC claims.
Having reviewed the various cases presented to him in argument, Warby J in Reid v Price identified principles relevant to damages for distress as follows:
“50. … [P]rinciples identified in Mosley v News Group Newspapers Ltd [2008] EWHC 1777 (QB) [2008] EMLR 20 include the following: damages may include compensation for distress, hurt feelings and loss of dignity; it may also be appropriate to take into account any aggravating conduct by the defendant which increases the hurt to the claimant’s feelings; damages should be proportionate, they should not be open to criticism for arbitrariness; but they must be adequate to mark the wrong and provide a measure of solatium; it will be legitimate to pay some attention to the current level of personal injury awards; and the court should have in mind the tariff applied so far as defamation awards are concerned (though the analogy with defamation can only be pressed so far).
51. Mr Williams has cited a number of subsequent cases…For reasons that will become apparent, I do not think it necessary or appropriate to indulge in any detailed analysis of these authorities. It is enough to say that among the points they add to the principles identified above are the following: if damages are to be an effective remedy, they must not be subject to too severe a limitation; although vindicatory damages are not recoverable in this context, in misuse of private information and data protection claims, damages may be awarded for loss of autonomy or loss of control; the nature of the information disclosed and the degree of loss of control should bear on this aspect of the court’s assessment of damages – the more intimate the information and the more extensive the disclosure, the greater the award.”
Mitting J was concerned with the award of damages to several claimants who had been victims of a data breach when various immigration related data were uploaded onto a publicly available Home Office website. He observed at §11 that: “it is common ground that I can and should take into account, in assessing damages for distress, awards made for psychiatric or psychological injury in personal injury cases to ensure that any award is not out of kilter with them”. He then reviewed the decision of Arden LJ in the Court of Appeal in Gulati (take care to read this decision now in light of Google v Lloyd in respect of damages for loss of control) and stated:
“18. The best guidance to the approach to the assessment of damages is I believe to be found in the judgment of Lady Justice Arden in Gulati at para.48, with modest amendments:
“Damages in consequence of a breach of a person’s private rights are not the same as vindicatory damages to vindicate some constitutional right. In the present context, the damages are an award to compensate for the loss or diminution of a right to control formerly private information and for the distress that the [claimants] could justifiably have felt because their private information had been exploited, and are assessed by reference to that loss.”
The only significant modification required is the substitution of “disclosed” for “exploited”. There is no suggestion of exploitation by the Home Office of confidential and private information on the facts of these cases.
19. I also accept the observation of Lady Justice Arden that damages are to be assessed under English domestic law and not the approach adopted by the Strasbourg court.
20. When assessing the damages to be awarded to each claimant I have taken into account their loss of control over their private and confidential information.“
Therefore, a court should take into account all the circumstances of a case in valuing damages. Factors such as the nature of the information (medical information is particularly sensitive, for example), the reasons for and scale or seriousness of the disclosure, the manner in which information was obtained, and reason for the disclosure are all relevant. Photographic intrusions may generally considered to be more serious, as will intrusions into the privacy of minors. Further, the Defendant’s post-breach conduct may be relevant, for example, as any steps taken which cause or prevent further breaches. Or, negative conduct by the Defendant may serve to aggravate the injury to feelings of the claimant and increase the level of award.
In TLT the awards ranged from £2,500 – £12,500 (in 2016, which might now be uprated for inflation and/or subsequent editions of the Judicial College Guidelines) for the claimants whose immigration data had been wrongly disclosed. The case provides a very helpful yardstick (and repays full reading) for how compensation might be assessed for claimants of different ages and circumstances, who were the victims of different types of personal data breach. For example:
Some awards of damages for distress, particularly in media cases, have been substantial, albeit the award is subsumed within a global sum which includes damages for reputational harm or vindication which are only available in libel claims – see Mosley v MGN wherein £60,000 was awarded for the ‘unprecedented’ distress and indignity resulting from the widespread publication of stills from covertly recorded videos of the claimant engaging in sadomasochistic sexual behaviour.
Other cases of note are: Weller v Associated Newspapers Ltd, in which the publication of unpixellated photographs of three children’s faces attracted awards of £5,000, £2,500 and £2,500, and Lady Archer v Williams [2003] EWHC 1670 (QB) in which the claimant received £5,000 for the publication of details of her private life in a book, having expressly stated that damages was the least important remedy sought in the proceedings.
At the other end of the spectrum, there is now a growing body of first instance decisions suggesting the courts will apply a healthy degree of scepticism to claims for distress in respect of what might be viewed as less serious or even trivial data breaches. For example, in Rolfe v Veale Wasbrough Vizards LLP [2021] EWHC 2809 (QB) the High Court granted summary judgment for the defendant in a case concerning the sending of a letter before action for unpaid school fees and a statement of account via email to the wrong recipient, which was promptly deleted by the recipient and no further disclosure occurred.
In Stadler v Currys Group Ltd [2022] EWHC 160 (QB) the claimant sought damages in circumstances where the defendant retailer had re-sold the claimant’s smart TV without wiping it, leading to a subsequent purchaser using the claimant’s saved bank details to buy a film. HHJ Lewis (sitting as a High Court Judge) considered whether there was a pleaded case of more than trivial distress. HHJ Lewis held there was a sufficient case on distress to go to trial (albeit on the Small Claims Track in the County Court rather than in the High Court):
“40. In this case, the claim is unquestionably of low value. It arises out of a single incident – namely the disposal of the Smart TV without wiping the claimant’s personal data – and matters were remedied promptly.
41. Whilst the defendant is sceptical that the Smart TV will have held all the information identified by the claimant – in particular bank details and other significant personal information in respect of each app – I acknowledge that this is the claimant’s pleaded case. A statement of truth has been signed on the claimant’s behalf. This can only have been signed by the claimant’s solicitor on the express instructions of the claimant, confirming the claimant’s belief that the factual matters set out in the pleading are true.
42. If what the pleading says is correct, then in my view this cannot be characterised as a trivial breach given the nature of the information disclosed, and the fact that it appears at least one of the apps has been used by a stranger since the Smart TV was re-sold.”
The decision of Nicklin J in Underwood v Bounty UK Limited [2022] EWHC 888 (QB) is another example of trivial harm. He held there could be no liability in MPI where the second defendant NHS Trust had allegedly ‘permitted’ Bounty, the first defendant, to have access to patient maternity data ([52]). The information in question was found to be trivial information not reaching the seriousness threshold required for a claim in MPI.
Although many data breaches give rise to distress only, there will be occasions where the infringement also causes a psychiatric injury or aggravates a pre-existing condition as demonstrated by a medico-legal report. In such circumstances damages for distress will still in principle be recoverable, however, to avoid double recovery guidance can be obtained from the chapter for psychiatric injuries in the Judicial College Guidelines for the Assessment of General Damages in Personal Injury Cases (Chapter 4 in the 16th Edition). It seems most likely in cases where personal injury and distress are claimed there will be a global award designed to compensate the claimant for both elements of damage whilst avoiding over-compensation.
On 10 April 2024, the High Court handed down its decision in Williams-Henry v Associated British Ports Holdings Ltd [2024] EWHC 806 (KB). In that judgment the presentation of the Claimant’s claim for personal injury was considered fundamentally dishonest and so was dismissed under section 57 of the Criminal Justice and Courts Act 2015 (“the 2015 Act”). In considering whether…
After the introduction of the reforms to the Civil Procedure Rules in 2013, you may recall some judges becoming, at least initially, excited about the prospect of experts giving evidence concurrently (so-called “hot tubbing”). Since that early flush of excitement, I have been involved in only one trial in which it was used and I…
Provisional damages operate as an exception to the general rule that damages are assessed on a once-and-for-all basis. Where a claimant finds themselves at a risk of developing a disease or deterioration in their physical or mental condition in the future, the general rule would require the court to assess that risk and compensate the…
