In our recent video: what’s the big deal about cyber security we warned that the English courts are moving towards liberalising damages claims in relation to breaches of data protection laws and how that is one of the factors putting pressure on organisations to take data security more seriously. Now the Court of Appeal has taken that step in its ruling in Google Inc. –v- Vidal-Hall  EWCA Civ 311.
It will now be much easier for individuals who have suffered distress as a result of breaches of The Data Protection Act to bring damages claims. Though each individual claim might be relatively small, a few thousand pounds at most, where a large group of individuals is affected it really makes such claims economically viable for the first time. Group litigation may well “follow on” from findings by the regulator, the Information Commissioner, that an organisation has breached the Act and the compensation claims may dwarf the regulatory fines, currently limited to £500,000. Not only this, it will be possible to go back up to six years to past breaches and now bring compensation claims for those incidents as well.
There is a defence available however where the defendant can show it took reasonable care to comply with the Act. This is another reason to at least take some basic steps to comply with data protection law.
The case involved an application by Google Inc. to set aside permission which had been previously granted by the English Court to serve a Claim Form out of the jurisdiction on them in America.
One of the critical issues for the Court of Appeal to determine was whether, before a compensation claim for distress could be brought by a claimant for a breach of the Data Protection Act, the Claimant had to show some form of pecuniary loss. The Court of Appeal said that this is what Section 13(2) of the Data Protection Act provides. However, it held that this is incompatible with EU law which provides that everyone is entitled to an effective remedy for a breach of their rights. The Court of Appeal decided it had power to therefore dis-apply Section 13(2) and ruled that compensation could be claimed for distress alone caused as a result of a breach of the Act.