Can I claim compensation for a breach of my data protection rights?
Our personal data is important to us all.
Government institutions and corporations retain more data about us than ever before. Very often that data can be about highly sensitive matters such as our physical and mental health, political affiliations, sexual orientation, or involvement with the criminal justice system (whether as victim or as the accused.)
There is a framework of laws including the GDPR and Data Protection Act 2018 in place to protect our data protection rights. They set out a number of “data protection principles”:
- All processing of data must be lawful, fair and transparent
- Data must be collected for specific, explicit and legitimate purposes, and not further processed in a way that is incompatible with those purposes
- Data should be adequate, relevant and limited to what is necessary
- Data must be accurate and kept up to date – and any inaccurate data should be rectified without delay
- Data should be kept for no longer than necessary
- Appropriate security measures should be taken to protect against unauthorised/unlawful processing
- A data controller must be able to demonstrate compliance with the data protection principles
The law also provides that where an individual’s data protection rights have been breached, and that breach has caused “material or non-material damage” that individual is entitled to claim compensation.
There has been a series of cases fought in the courts over the last few years on this subject.
In 2021 the UK Supreme Court delivered a landmark judgment in Lloyd v Google (2021) which established that under the Data Protection Act, no claim can be brought simply for “loss of control” over one’s data. The claimant must be able to demonstrate that they have actually suffered damage.
A number of cases have been brought over relatively minor breaches of the Data Protection Act (for example see Warren v DSG Retail Ltd (2021), Johnson v Eastlight Community Homes (2021), Stadler v Currys Group (2021)). Whilst brought in different contexts the common theme was that the breaches were relatively minor or technical – and they were all given short shrift by the Courts.
Therefore wherever data protection cases are brought, the data controller will often try to argue that, whilst a breach of the data protection principles might have occurred, the individual has not suffered any damage – and so is not entitled to compensation.
It is important to keep in mind that in many circumstances data breaches can have disastrous consequences for individuals which do cause very significant distress. This is often the case where the data controller is a government body, prison, or police force, processing highly sensitive personal data in very sensitive circumstances. The case of TLT v Home Office (2016) was brought when the Home Office accidentally published the personal details of a number of asylum seekers on a public database, exposing the claimants to risk of reprisals in their home countries. The judgment established that where a data breach can be demonstrated to have caused distress, the compensation should be in line with what might be awarded in a personal injury claim for psychiatric injury. These can be significant. In that case the Court ordered a range of awards ranging from approximately £3,000 to £17,000. It is certainly conceivable that higher awards could be granted depending on the facts of a particular case.
Cases like this are a far cry from the more minor and/or technical breaches involved in a retail/consumer context, which the Courts have been so reluctant to grant. Where the data controller is a public authority such as police force or prison there is also a strong public interest in legal action being brought. It is important that lawyers and judges do not lose sight of this.
In conclusion: can you claim compensation for a breach of your data protection rights? Yes – but only if you have suffered real damage or distress.
If you feel that our data protection rights have been breached and this has had a significant impact on you please contact our specialist solicitors at Saunders Law today.