What does “damage” mean under the DPA?

Upper Tribunal declines to follow preliminary view expressed by Tugendhat J in Vidal-Hall v Google Inc

On 11 June 2014, Wikeley J dismissed the Information Commissioner’s appeal (IC v Niebel [2014] UKUT 0255 (AAC)) against the First-Tier Tribunal’s decision to allow Mr Niebel’s appeal against a monetary penalty notice (MPN) of £300,000 issued against him. Mr Niebel had sent millions of unlawful spam texts to the public, but the Information Commissioner’s MPN was founded on only 286 of those, being those individuals who had agreed to their information being used in appeal proceedings.

Mr Niebel was fined for a serious breach of the Privacy and Electronic Communications Regulations 2003 (PECR). The Information Commissioner has the power to issue fines for breaches of the PECR under section 55A of the Data Protection Act 1998 (DPA), provided the three statutory requirements of section 55A(1) are met. The appeal concerned the proper interpretation of the requirement in section 55A(1)(b) that “the contravention was of a kind likely to cause substantial damage or substantial distress”.

The issue of the meaning of “damage” under the DPA was considered by Tugendhat J recently in Vidal-Hall v Google Inc [2014] EWHC 13 (QB). Tugendhat J did not decide the question, but offered his preliminary view to the effect that damage in section 13 of the DPA did include non-pecuniary damage.

Given Tugendhat J’s view, Wikeley J was invited to adopt a similarly broad approach but declined to do so. He held that the legislation in issue here referred disjunctively to “substantial damage or substantial distress”. The guidance given by the Commissioner in accordance with section 55C of the DPA correctly differentiated between “damage” and “distress”. If “damage” had been meant to encompass emotional turmoil, then there would have been no need to refer separately to “distress” in the legislation. Tugendhat J had decided nothing beyond that there was a serious issue to be tried in the Vidal-Hall litigation; his observations on section 13 of the DPA were therefore necessarily tentative. In any event, whether or not Tugendhat J’s approach was a proper reading under section 13 of the DPA (in which the terms were deployed separately in subsections (1) and (2) respectively, which may not rule out some degree of overlap), in Wikeley J’s judgment, it could not apply to section 55A(1)(b), where the expression of “substantial damage or substantial distress” was plainly disjunctive.

On 7 March 2014, Gloster LJ granted Google permission to appeal Tugendhat J’s judgment. Clarification on whether “damage” within section 13 of the DPA – and the DPA generally – can be read to include “moral damage” will be of great interest.

As to the Niebel decision, the Upper Tribunal recognised that the substantive outcome of the decision might be “a question mark over whether the Commissioner’s powers are in the terms of the Directive “effective” and “dissuasive” (howsoever those terms are defined)”, but pointed out that the threshold was set at domestic rather than European level, so the statutory test could be revisited: “for example, a statutory test that was formulated in terms of e.g. annoyance, inconvenience and/or irritation, rather than “substantial damage or substantial distress”, might well have resulted in a different outcome.” Given the annoyance caused by spam texts and calls, it will be interesting to see how the Government responds.

Links

Information Commissioner v Niebel [2014] UKUT 0255 (AAC)

5RB Case Report – Vidal-Hall v Google