As many people will know, there is a statutory regime in place that regulates how a person’s personal data is collected, used and stored. The central piece of legislation is the Data Protection Act 1998 (“DPA”). A person’s personal data includes data that relates to a living individual (e.g. not a deceased individual, or a company). Those who have control over the processing of personal data are known as “data controllers”.
Where a data controller breaches any of the requirements of the DPA, and this causes an individual to suffer “damage”, that individual may claim compensation from the data controller. Whilst the English Court of Appeal has considered the relevant section of the DPA in light of EU law (Vidal-Hall v Google Inc 2015), there is not a great deal of authority on determining the appropriate level of damages that an individual can claim. There are also a variety of ways in which a data controller can fall foul of the DPA, and accordingly an award of damages in any given case is not necessarily helpful in a different type of case (e.g. losing an employee’s file compared with an ongoing breach such as CCTV).
In Halliday v Creation Consumer Finance Ltd 2013 the Court of Appeal awarded damages of £750.00 for distress. In this case a finance company had wrongfully registered a default against Mr. Halliday’s credit file. Whilst Mr. Halliday failed to prove that his reputation or credit worthiness had suffered, the fact that there was (i) a breach of the DPA, and (ii) some evidence of distress was enough to produce an award.
In AB v Ministry of Justice 2014 the High Court awarded £2,250.00 owing to distress as a result of the delay in releasing information to AB concerning his deceased wife. This case is perhaps distinguishable from most other cases, owing to the very particular circumstances at play.
The case of TLT v Secretary of State for the Home Department 2016 concerned a very serious (but accidental) breach of the DPA that resulted in details of approximately 1,600 “lead applicants” for asylum or leave to remain being published online. This included their names, ages, nationality and additional information. In that case the High Court held that whilst there was a de minimis threshold for the award of damages for distress, in this case the distress was so severe that it was appropriate to be guided by the bands of awards relating to psychiatric and psychological damage. Awards of between £2,500.00 and £12,500.00 were made.
Finally, in Wolley v Akbar or Akram 2017 a Sheriff was faced with the difficult task of quantifying an award of damages where Mr. and Mrs. Wolley had been unlawfully recorded (audio and video) in and around their home by a neighbour over a period of approximately two and a half years. In that case neither the Sheriff, nor the solicitor-advocate or advocate involved, were able to point to any previous case law on this point (as opposed to ‘one off’ breaches such as Halliday). The result was that the Sheriff accepted the Pursuers’ submission that a figure of £10.00 per person, per day, was a logical starting point. On that basis, each of Mr. and Mrs. Wolley were awarded £8,634.00.
This selection of cases goes some way to putting some flesh onto the bones of the relevant provisions of the DPA, although it may well take a few more cases being decided before there is any certainty in this area. It does however appear clear that (i) courts will not award damages for distress if there is not really any distress, (ii) if the distress is so severe it is appropriate to have regard to guidelines for psychiatric harm, and (iii) courts may be amenable to assessing damages in ‘ongoing breach’ cases with reference to a figure per day, multiplied across the duration of the breach.
Contact our Litigation Solicitors Glasgow
This article is for general information only. Nothing in this article should be taken as legal advice. If you have any queries on the content of this article please contact us.
