Managing Speculative Claims Following A Data Breach

• Published date: 08 November 2021
• Subject Matter: Privacy, Data Protection
• Law Firm: Shepherd and Wedderburn LLP
• Author: Mr Matthew Phillip

Increased public awareness of data protection regulations has sparked a rise in claims for damages associated with distress caused by data breaches. Many claims are made in response to serious breaches that have caused financial loss or significant distress, however organisations are increasingly receiving significant financial claims for relatively minor breaches. In the recent decision of Rolfe and others v Veale Wasbrough Vizards LLP [2021] EWHC 2809 (QB), the High Court confirmed that awards for trivial claims will not only be refused, but may result in adverse costs orders.

The right to compensation for distress

Article 82 of the GDPR and section 169 of the Data Protection Act 2018 give individuals a right to receive compensation for damage suffered due to a breach of data protection legislation. Previously a right to compensation was only available if an individual could show that they had suffered financial loss. However, the decision in Vidal-Hall v Google Inc [2015] EWCA Civ 311 and section 169(5) of the DPA 2018 extend the right to cover other types of damage such as distress.

Examples of circumstances where individuals have obtained compensation for the significant distress that they have suffered include:

• asylum and leave to remain applicants who suffered distress after their personal data was wrongly published online by the UK Home Office (TLT v Secretary of State for the Home Department [2016] EWHC 2217 (QB)); and
• publication of a report that inaccurately disclosed sensitive personal data alleging that the Claimants had engaged in illegal activities (Aven v Orbis Business Intelligence Ltd [2020] EWHC 1812 (QB)).

Trivial claims for distress

The Claimants in Rolfe and others v Veale Wasbrough Vizards LLP sought compensation for distress after the Defendant, a firm of solicitors, mistakenly sent an email intended for them to someone else following a typographical error. The email and its attachments demanded payment of school fees by the Claimants to their daughter's school. However, other than the Claimants' names and home address, the email did not disclose any personal information. The Defendant was quickly notified of the error, and immediately asked the unintended recipient to delete the email. The unintended recipient complied and confirmed deletion.

The Claimants alleged that they suffered distress following the incident including loss of sleep and worry to the extent that they felt physically ill. However, the judge dismissed...