Compensation for Breach of a Subject’s Rights under the Data Protection Act 2018

An individual’s right to claim compensation following a breach of the General Data Protection Regulation (GDPR) is given effect in section 168 of the Data Protection Act 2018 (DPA 2018). An equivalent right is provided in section 169 for an infringement of the DPA 2018 which is not a contravention of the GDPR. Although the DPA 2018 does not assist with determining the amount of compensation, case law decided under its predecessor, the Data Protection Act 1998, continues to provide guidance.

Overlap with other types of claim

Unsurprisingly, claims under the 1998 and 2018 Acts frequently overlap with claims for misuse of private information, negligence, and contravention of the right to privacy under Article 8 of the European Convention on Human Rights. If multiple causes of action succeed, the usual approach is not to distinguish between them when awarding damages (Crook v Chief Constable of Essex Police [2015] EWHC 988 (QB)). Claims are unlikely to succeed if the damages claimed under data protection legislation cannot be treated as arising separately from damages already compensated via an alternative cause of action (Crook v Chief Constable of Essex Police [2015] EWHC 988 (QB)).

Damages for distress

It is well-established that damages under the 1998 and 2018 Acts may include full compensation for monetary loss and personal injury, including causation of mental illness. But what about distress caused by infringements of data privacy? The early case of Campbell v Mirror Group Newspapers [2002] EWHC 499 (QB) signalled that damages awarded for distress following a data privacy infringement would be limited. The defendant newspaper had published photographs of the claimant leaving a Narcotics Anonymous meeting along with an article containing details of her drug addiction and ongoing therapy. The High Court found that there had been a breach of the 1998 Act and awarded damages of £2,500.

By contrast, the High Court recently awarded £18,000 each for distress caused to two claimants whose data had been inaccurately featured in the infamous ‘Steele Dossier’ which alleged links between Vladimir Putin and Donald Trump (Aven and others v Orbis Business Intelligence Ltd [2020] EWHC 1812 (QB)).

The leading case in this area is now TLT v Secretary of State for the Home Department [2016] EWHC 2217 (QB). At least two developments can be identified from this case. First, there is a threshold of distress below which damages in respect of distress alone may not be awarded. The court did not specify where this threshold lies, apart from to say the de minimis principle applies. Second, there is no reason why compensation for distress alone cannot run into many thousands of pounds.