An individual’s right to claim compensation following a breach of the General Data Protection Regulation (GDPR) is given effect under section 168 of the Data Protection Act 2018 (DPA 2018). 

An equivalent right is provided in section 169 for any infringement of the DPA 2018 which is not a contravention of the GDPR. Although the DPA 2018 assists with determining the amount of compensation, case law decided under its predecessor, the Data Protection Act 1998, continues to provide guidance.

Overlap with other types of claim

Unsurprisingly, claims under the DPA 1998 and DPA 2018 Acts frequently overlap with claims for misuse of private information, negligence, and contravention of the right to privacy under Article 8 of the European Convention on Human Rights. If multiple causes of action succeed, the usual approach is not to distinguish between them when awarding damages (Crook v Chief Constable of Essex Police [2015] EWHC 988 (QB)). 

Claims are unlikely to succeed if the damages claimed under data protection legislation cannot be treated as arising separately from damages already compensated via an alternative cause of action (Crook v Chief Constable of Essex Police [2015] EWHC 988 (QB)).

Damages for distress

It is well-established that damages under the 1998 and 2018 Acts may include full compensation for monetary loss and personal injury, including causation of mental illness. But what about distress caused by infringements of data privacy? The early case of Campbell v Mirror Group Newspapers [2002] EWHC 499 (QB) signalled that damages awarded for distress following a data privacy infringement would be limited. The defendant newspaper had published photographs of the claimant leaving a Narcotics Anonymous meeting along with an article containing details of her drug addiction and ongoing therapy. The High Court found that there had been a breach of the 1998 Act and awarded damages of £2,500.

By contrast, the High Court recently awarded £18,000 each for distress caused to two claimants whose data had been inaccurately featured in the infamous ‘Steele Dossier’ which alleged links between Vladimir Putin and Donald Trump (Aven and others v Orbis Business Intelligence Ltd [2020] EWHC 1812 (QB)).

The leading case in this area is now TLT v Secretary of State for the Home Department [2016] EWHC 2217 (QB). At least two developments can be identified from this case. First, there is a threshold of distress below which damages in respect of distress alone may not be awarded. The court did not specify where this threshold lies, apart from to say the de minimis principle applies. Second, there is no reason why compensation for distress alone cannot run into many thousands of pounds.

In Woolley and Woolley v Akbar [2017] SC Edin 7, the Sheriff Court awarded each of the claimants £8,634 after their neighbour installed CCTV cameras and audio recording equipment directed at their property. The defendant did not dispute the claimants’ calculation of damages for distress, namely £10 per day the equipment was operational. In the absence of a dispute, the Sheriff merely commented that the calculation seemed logical and easily applicable.

Damages for mere breach

A breach of the DPA 2018 has generally been regarded as not actionable per se. A notable case in this area is Lloyd v Google Inc [2018] EWHC 2599 (QB), which concerned the defendant’s unlawful placement of tracking software on a large number of iPhones. At first instance, it was held that the infringement itself could not constitute damage. That decision was overturned by the Court of Appeal in Lloyd v Google Inc [2019] EWCA Civ 1599, but the defendant has now appealed to the Supreme Court.

Conclusions

The outcome of the case law is that damages for a breach of the DPA 2018 will be unpredictable and highly fact-specific. Currently, damages can be claimed for material and non-material loss, including distress. However, the Supreme Court’s decision in Lloyd in early 2021 could have far-reaching consequences for potential claimants under the DPA 2018 who have suffered no loss at all.

If you have been affected by a breach of your rights under the Data Protection Act do not hesitate to contact a member us.