Johnson v Eastlight Community Homes

Reference: [2021] EWHC 3069 (QB)

Court: High Court (QBD)

Judge: Master Thornett

Date of judgment: 16 Nov 2021

Summary: Data Protection – Misuse of Private Information – Breach of Confidence – Negligence – Jameel – De Minimis – Allocation

Download: Download this judgment

Appearances: Ben Hamer (Defendant) 

Instructing Solicitors: Pure Legal for the Claimant; DAC Beachcroft for the Defendant.

Facts

The claimant’s rent statement was accidentally forwarded by email to a third party, who subsequently deleted the email.

The claimant brought a claim for damages, capped at £3,000, for distress in misuse of private information, breach of confidence and negligence, and under the GDPR. She was particularly concerned about her address, which was included in the statement, becoming known to her ex-partner. Liability for breach of Article 5(1)(a) and (b) of the GDPR was admitted by the defendant. The claimant also sought injunctive relief and a declaration.

The defendant applied to strike out the claim. Alternatively, the defendant sought for the claim to be transferred to the Small Claims Track of the County Court.

The claimant argued that Jameel applies only to non-statutory torts, that neither the de minimis principle nor the Jameel jurisdiction apply to the GDPR. The claimant submitted that the GDPR had direct effect and so superseded inconsistent provisions in the common law and other statutes. The claimant also argued in any event the claim was above this threshold. The claimant maintained that the claim had properly been brought in the High Court and was suitably for the multi-track.

Issue

  1. Should the claim in negligence be struck out under CPR 3.4(2)(a)?
  2. Does Jameel apply to the GDPR?
  3. Do the de minimis and Jameel principles apply to the GDPR?
  4. Should the claim be struck out or summary judgment granted?

Held

Should the claim in negligence be struck out under CPR 3.4(2)(a)?

This point did not need to be determined as the claimant formally withdrew the claim in negligence before the end of the hearing.

Does Jameel apply to the GDPR?

Yes, the Jameel jurisdiction can be applied to data protection claims. Vidal-Hall v Google [2016] QB 1003 and Higinbotham v Teekhungam & Anor [2018] EWHC 1880 (QB) followed.

Do the de minimis and Jameel principles apply to the GDPR?

Yes. There is nothing distinct in the wording of Article 82(1) of the GDPR as to negate the continued application of Jameel or de minimis principles. This conclusion is consistent with the application of the Regulation in other jurisdictions.

Should the claim be struck out or summary judgment granted?

By a very narrow margin the whole claim did not fall to be struck out, but all claims save for the GDPR claim should be struck out.

The claims in misuse of private information, breach of confidence and breach of Article 8 ECHR should accordingly be struck out. The claim in negligence was formally withdrawn during the hearing by the claimant. They would not materially change the overall picture presented by the GDPR claim and were likely to obstruct the just disposal of proceedings by taking up a disproportionate and unreasonable amount of court time and costs.

There was no basis for the claim to have been issued in the High Court. The presentation and processing of the case to date in this forum constituted a form of procedural abuse by the claimant. The case has all the hallmarks of a Small Track Claim that should have been issued in the County Court and so allocated. Whether the claimant is entitled to purely nominal or instead extremely low damages should be determined in the Small Claims Track of the County Court.

Comment

This judgment will have serious implications for claimant firms, making clear that low-level data breach claims are not suitable for the High Court. There will also be costs implications arising from the dismissal of the breach of confidence, misuse of private information and Article 8 ECHR claims. ATE premiums are recoverable for privacy and confidentiality claims but not in data protection claims.

The judgment also confirms that the Jameel jurisdiction and de minimis jurisdiction may be applied to data protection claims under the GDPR as well as the Data Protection Act 1998.