Compensation for distress under the data protection act 1998. Jan 05, 2014 please take note that unless i hear from you within the next 14 days with your proposals to settle this matter, i shall be issuing proceedings against you in the county court for breach of sections of the data protection act 1998 together with a claim for damages and distressunder section of the data protection act 1998 plus costs. The gdpr introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority. Although you may think that this only applies to larger companies, in fact most businesses hold some personal data for example. The data protection act 2018, which was signed into law on 24 may 2018, changes the previous data protection framework, established under the data protection acts 1988 and 2003 pdf. Damages awarded for data protection breaches ireland vs the uk 14 sep 2015 1.
There are changes that may be brought into force at a future date. The consequences of breaching the data protection act 1998. The data protection act 1998 was a united kingdom act of parliament designed to protect personal data stored on computers or in an organised paper filing system. Establishing a new data protection commission as the states data protection authority. Previously, under section 2 of the dpa, individuals in the uk could only bring a claim for distress if.
Data protection lawyers and practitioners will be well aware of this issue, and i wrote about it earlier this year. The data protection act 2018 is the uks implementation of the general data protection regulation gdpr. Data protection breachesare you entitled to damages. Traditionally, few people brought claims under section dpa, because it was. As actions for damages or infringement of data protection rights become increasingly recognised as a means of private enforcement, this reason will fall away, and the lot of data protection enforcement should improve. May 28, 2015 however, the court of appeals approach to section is in line with draft eu data protection regulation expected to be adopted in 2016 which enables damages to be awarded for nonfinancial loss. An individual has always had the right to claim damages for. The data protection act 1998 dpa defines the law in the uk for processing the data of identifiable living people.
Assessment of damages for breach of confidence, misuse of private information and data protection act 1998 compensation reid v price send to email address open help options for email address you can send the message to up to 4 other recipients. Data protection act 1998 information commissioners guidance about the issue of monetary penalties prepared and issued under section 55c 1 of the data protection act 1998 presented to parliament pursuant to section 55c6 of the data protection act 1998 as amended by section 144 of the criminal justice and immigration act 2008 december 2015. The data protection act 1998 requires tech talenta as data controller to process data in accordance with the principles of data protection. However, the court of appeals approach to section is in line with draft eu data protection regulation expected to be adopted in 2016 which. The nurse who accessed the data was the mans partner at the time. Practically it allows individuals to control information about themselves.
The meaning of likely to cause substantial damage or substantial distress. It precludes a claim for damages for distress for breach of data protection rights, pursuant to section 7 of the data protection act, 1988 also here hereafter. Current data security and breach regulatory notification regime. Ireland saw its first major data protection civil litigation case in 2012. Lynskey commented that lack of private enforcement is one of the reasons for widespread underenforcement of data protection law. It sets out the obligations that organisations currently have if they handle personal information. Legal risks to being a dpo international association of. The march 2020 queens bench division media and communications list judgment in alexander aristides reid v katie price 2020 ewhc 594 qb has added to the body of case law on damages for breaches under data protection legislation. Morrisons took active steps to remove the data and minimise the breach.
What was the meaning of damage in section of the data protection act 1998 dpa and, in particular, did it give rise to a claim for compensation without pecuniary loss. In my previous post in this series, i argued yet again that collins v fbd insurance plc 20 iehc 7 14 march 20 was wrongly decided. Damages for distress awarded for breach of the data. Damages for infringement of data protection rights.
Uk group data breach claims pose big financial risks. Morrisons fights liability for data breach at top uk court. Building on a case in which the workplace relations commission ordered. This case relates to intimate photographs and video footage of the claimant, mr reid, obtained without consent and said to have been disseminated by the defendant, ms price, to a range. We have prepared a response plan for addressing any personal data breaches that occur.
In the particulars of claim filed at court mr lang alleged that the chief constable of hertfordshire police failed in his duties under the data protection act 1998. Assessment of damages for breach of confidence, misuse of. In other words, a plaintiff could only secure an award of compensation for breach of data protection law on proof of actual loss or actual damage caused by the breach. Section 7 of the data protection act, 1988 states that data controllers and data processors owe data subjects a duty of care. In vidalhall 2 it was determined that claimants were not required to prove they had suffered a financial loss in order to claim compensation for a breach. Where personal information is sensitive personal data for the purposes of the data protection act 1998 dpa, such as medical information, that reasonable expectation of privacy is usually made out and the likelihood of distress being caused by its unlawful disclosure is increased.
Data protection act 1998 information commissioners guidance. Please take note that unless i hear from you within the next 14 days with your proposals to settle this matter, i shall be issuing proceedings against you in the county court for breach of sections of the data protection act 1998 together with a claim for damages and distressunder section of the data protection act 1998 plus costs. The breach of the data protection act case was pleaded described in legal terms as follows. The united kingdoms data protection act 1998 dpa, allows for criminal liability for violations under the law. Landmark case opens the door to uk data protection consumer. Collinss data protection rights were breached by fbd, according to the. The changing landscape of data protection in the context of. To serve a monetary penalty notice for a breach of the dpa, the. Section 1 of the data protection act 1998 dpa provides that individuals can claim compensation if they suffer damage as a result of abreach of the dpa. An individual has always had the right to claim damages for any financial losses caused by a breach of the act. Apr 23, 2010 the data protection act 1998 is a piece of uk legislation thats designed to protect the privacy of personal data. Jan 04, 2017 request for details about breaches of the data protection act 1998 in your organisation.
Previously, under section 2 of the dpa, individuals in the uk could only bring a claim for distress if they also suffered pecuniary damage. It was enacted to bring uk law in line with the european unions eu directive on data protection. The data protection act 1998 dpa is, as its regulator the information commissioner ic concedes, complex and, in places, hard to understand. Recent case highlights the dangers of consequential damage. Awards of damages for data protection breaches uk and irish. The home office was held to be in breach of the data protection act 1998 as well as the common law tort of misuse of private information. Court of appeals for the eleventh circuitone of the highest federal courts below the supreme courtrecently affirmed a decision in silverpop systems, inc. Probably the first group action for damages under the. They sought compensation under section of the uk dpa for damage and distress but made no claim for financial loss. Breach of data protection laws can also result in regulatory sanctions. The patient claimed that the breach of the data protection act 1998 dpa and the way his subsequent complaint regarding the matter was handled had made worse a preexisting paranoid personality disorder and prevented him from working. Uk supreme court says employer not vicariously liable for. Damages for infringement of data protection rights eoin odell. For example, failure to comply with an enforcement notice or providing deliberately false information is a criminal offence subject to fines that may be of an unlimited amount.
Damages for data protection breaches ii why murphy v. Damages for data protection breaches ireland vs the uk. However a the dpa doesnt often lead to a clear or measurable financial loss. Sep 14, 2015 damages awarded for data protection breaches ireland vs the uk 14 sep 2015 1. Apr 07, 2020 an application for socalled summary judgment a litigation procedure used to try and bring an early end to proceedings andor striking out was brought by lgbt who were the defendant in a case brought by the claimant mr.
If the breach is likely to result in a high risk of adversely affecting individuals rights and freedoms, you must also inform. Aug 28, 2014 the data protection act 1998 dpa is, as its regulator the information commissioner ic concedes, complex and, in places, hard to understand. Contractual breach and remedies claims and remedies. Data protection act nonpecuniary damages in the county. Scott who represented himself in a claim for damages for breach of the uk data protection act 1998 dpa 1998 the. The data protection act 1998 allows data subjects to claim compensation for breaches of the act that cause distress, but only where the breach also causes damage s. An application for socalled summary judgment a litigation procedure used to try and bring an early end to proceedings andor striking out was brought by lgbt who were the defendant in a case brought by the claimant mr.
Hall concluded that, given that the aim of the dp act. They have well framed and established laws, exclusively for the data protection. Probably the first group action for damages under the data protection act posted on thursday 6th march 2014 by actnowtraining in december 20 a group legal action was settled against the london borough of islington following breaches of. Data protection act nonpecuniary damages in the county court. Data protection act 1998 is up to date with all changes known to be in force on or before 23 march 2020. The gdpr regulation of may 25th, 2018 provided muchneeded improvements to the data protection act dpa of 1998. In september 2018, the information commissioner fined equifax.
Section 1 of the data protection act 1998 dpa provides that individuals can claim compensation if they suffer damage as a result of a breach of the dpa. Damages for data protection breaches 2, why murphy v. The court of appeal held that a claimant could recover damages under section of the uks data protection act 1998 for loss of control of personal data without proving pecuniary loss or distress, and that the representative action could proceed. The class action was brought by 5,500 employees seeking damages against the supermarket giant under the data protection law, as well as claims of misuse of private information and breach of. For example, failure to comply with an enforcement notice or providing deliberately false information is a criminal offence subject to fines that may be of an. Request for details about breaches of the data protection act 1998 in your organisation. How nigel lang won his breach of the data protection act claim. Nonetheless, approximately 9,000 of morrisons affected employees brought a claim against morrisons and sued for damages in respect of alleged distress, anxiety, upset and damage.
The transcript of the judgment in this case has only recently become available. We understand that a personal data breach isnt only about loss or theft of personal data. Article 23 has been implemented in the uk by section of the data protection act, 1998. In johnson v medical defence union, the court of appeal stated that this meant that compensation for distress would only be available where a claimant could also show pecuniary loss. The newspapers did not publish the data, and instead alerted morrisons to the data breach. The changing landscape of data protection in the context. Mar 06, 2014 probably the first group action for damages under the data protection act posted on thursday 6th march 2014 by actnowtraining in december 20 a group legal action was settled against the london borough of islington following breaches of the data protection act 1998 and the human rights act 1998. Compensation for distressonly claims under the dpa rpc. What impact will it have on compensation under section of the data protection act 1998. Assessment of damages for breach of confidence, misuse of private information and data protection act 1998 compensation reid v price information law analysis.
A previous court of appeal case has helddamage in these cases can cover distress suffered by the claimant alone and need not involve financial loss. This alert covers the implications of that case, as well as placing it in the context of prior developments in data protection damages under dpa 98 and the gdpr. Compensation for distress under the data protection act. The data breach occurred in 2017 and was the fault of its parent, equifax inc.
Awards of damages for data protection breaches uk and. It enacted the eu data protection directive 1995s provisions on the protection, processing and movement of data. Analysis data protection civil litigation cases are not. If you have been the victim of a breach of your personal data, the data protection act 1998 dpa gives you the right to compensation. The collection and use of personal data in the uk is primarily governed by the data protection act 1998 the act. Section of the act provides for compensation to be paid where there is a breach of the act, and under section 2 this includes distress suffered by an individual by reason of the breach. The claimants contended that this amounted to a misuse of their private information, a breach of confidence and a breach of the data protection act 1998 uk dpa. Section 1 of the data protection act dpa provides a right to compensation for a data subject who has suffered damage by reason of any contravention by a data controller of any of the requirements of the act. We have allocated responsibility for managing breaches to a dedicated person or team. Government efficiency, transparency and accountability. As with privacy compensation, data protection compensation is having a revolutionary year. May 25, 2018 the data protection act 2018, which was signed into law on 24 may 2018, changes the previous data protection framework, established under the data protection acts 1988 and 2003 pdf. Court of appeal considers damages for privacy breaches. You must do this within 72 hours of becoming aware of the breach, where feasible.
Probably the first group action for damages under the data. Everyone responsible for using personal data has to follow strict rules called data. Fitzgerald also commented on the possible impact of the constitution on claims for compensation for infringement of. Civil damages for distress in data protection cases after. Similarly, the data protection act 1998 dpa imposes obliga tions on data. Moreover, it has been observed that there islittle case lawmost damages claims under the dpa go to the county court, where unless you were in the case it is hard to know that it happened or. Building on a case in which the workplace relations commission ordered a. Quantifying damages for data breaches publications. Data protection under foreign law many countries other than india have their data protection laws as a separate discipline. Court of appeal considers damages for privacy breaches data. In johnson v medical defence union, the court of appeal stated that this meant that compensation for distress would only be available where a claimant could also show.
Section 1 of the data protection act 1998 dpa states that individuals who suffer damage as a consequence of a breach of the dpa by a data controller can claim compensation. Dec, 2019 in my previous post in this series, i argued yet again that collins v fbd insurance plc 20 iehc 7 14 march 20 was wrongly decided. Right to prevent processing likely to cause damage or distress. Analysis data protection civil litigation cases are not just. Data protection compensation claim fails to prove damage.
963 1458 1184 270 94 808 490 878 620 1320 186 321 164 569 732 468 818 858 1252 789 846 210 1398 194 1392 220 1277 829 1147 668 830 1008 530 700 818 90 1405 265