A Scottish Sheriff Court has awarded more than £17,000 in damages for distress caused by intrusive CCTV and audio recordings under section 13(1) of the DPA.

The complainants lived in a flat where the building owner installed CCTV and audio recording devices. From 2013 four cameras and four audio devices were installed which intentionally also recorded the complainants' private property. The cameras recorded 24 hours a day and stored up to five days of data which was remotely accessible. The claimants claimed for distress from the concern of others listening to their conversations.

The court found that the owner who installed the CCTV, as data controller, had breached their data protection obligations under the first, third and fifth principle data protection principle. The devices were installed without notice, consultation or justification of a legitimate interest. The surveillance was deemed to not be relevant and labelled extravagant due to the extent of unnecessary areas captured. The defendant had no data retention policy and the data was stored for 5 days (owing to device default) rather than a shorter period such as one day which would be more appropriate to record any confrontations. The complainants' damages calculation was accepted by the court, however there is currently no legislative guidance for claims for distress under the DPA. The calculation was based on a sum per day per person since the start of the DPA breach, with a deduction of a month to account for periods when the claimants were not present at the property.

Anthony Woolley and Deborah Woolley v Nahib Akbar Or Akram [2017] SC EDIN 7, 3 February 2017