TLT v Secretary of State for the Home Department

Reference: [2016] EWHC 2217 (QB)

Court: High Court, Queen's Bench Division

Judge: Mitting J

Date of judgment: 24 Jun 2016

Summary: Data Protection - privacy - misue of personal information – damage under the Data Protection Act 1998 – quantum in data protection claims – evidence in data protection claims

Download: Download this judgment

Instructing Solicitors: Bindmans LLP for Cs, The Treasury Solicitor for D.

Facts

D is a government department responsible for the ‘family returns process,’ the process by which individuals with children who have no right to remain in the United Kingdom are returned to their country of origin.

D stores quarterly statistics about the process in a spreadsheet containing two tabs: the first tab containing anonymised statistics; the second containing a substantial amount of personal information, including: the name of the lead family member; his or her age and nationality; whether they had claimed asylum; the office which dealt with their case, from which the general area in which they lived could be inferred; and the stage which they had reached in the family returns process.

In October 2013, D uploaded the quarterly statistics for the period April to 30 June 2013 onto the internet, however it accidentally uploaded the information contained in both first and second tabs rather than just the first. The information contained details of 1,598 applicants.

While it was online, the page was accessed by IP addresses within the United Kingdom on 27 occasions by 22 different IP addresses and by 1 in Somalia. At least one unknown individual had downloaded/saved the spreadsheet. A copy of the spreadsheet was also upload onto a US file-sharing website.

The ICO was notified, a statement was made to Parliament about the data breach, and the individuals affected were notified.

Cs, a number of individuals who were affected by the data breach, brought claims in misuse of private information and breach of the Data Protection Act 1998. Two of the individuals: TLU and TLV were not named in the spreadsheet.

Issue

(1) Whether TLU and TLV can recover damages despite not being named in the spreadsheet

(2) Whether there was a threshold that the level of distress needed to cross in order for damages to be awarded.

(3) Whether any useful guidance in assessing damages is provided by comparison with cases involving exploitation and dissemination of private and confidential information by media defendants.

(4) Whether damages should be awarded for loss of the right to control of personal and confidential information.

(5) The level of damages that should be awarded to the Cs.

Held

(1) TLU and TLV were able to recover damages despite not being named in the spreadsheet. Their identify could readily be inferred from TLT’s family name, and so anyone with knowledge of the family would be able to identify them. The data was their personal data as defined by s.1 Data Protection Act 1998.

(2) There is a threshold: the ‘de minimis’ principle, but no other.

(3) The cases involving dissemination of private and confidential information by media defendants were not instructive. This case was more similar to cases where psychiatric injury had been caused by an actionable wrong.

(4) In principle damages can be awarded in respect of the loss of control of personal and confidential information, referencing Gulati v MGN Ltd [2016] 2 WLR 1217.

(5) In assessing damages for distress the court should take into account awards made for psychiatric or psychological injury in personal injury cases to ensure that any award is not out of kilter with them. Taking into account the Cs loss of control over their information, and the impact of the data breach upon each of the Cs, as outlined in their witness statements damages were awarded to each of the Cs ranging from £2,500 to £12,500.

Comment

This judgment provides further guidance on the approach that the court will take when assessing quantum for damages for distress in DPA claims. The court did not choose to follow the quantum awards in Gulati, preferring instead to most closely mirror psychiatric injury damages. Mitting J’s in-depth discussion of the evidence of each of the Cs provides useful guidance as to what a court will take into account in assessing quantum in DPA claims. Despite this judgment there is still uncertainty in this area and there will undoubtedly be further litigation on the issue of quantum in DPA claims.