Professional Negligence Claims Arising Out Of GDPR

Inevitably it will transpire that mistakes will have been made by professionals giving (often very expensive) guidance on GDPR compliance. Their clients will want to consider whether a claim for professional negligence can be made. In this article Neil Hext QC, Stephen Innes and Helen Evans of 4 New Square discuss some of the issues which are likely to arise in such claims.

Standard of care

Much of the advice which is being obtained in relation to GDPR is from lawyers. In that situation, the standard of care required is straightforwardly the reasonable care and skill of the solicitor of barrister, although there may be some scope for argument as to the level of specialisation expected: is it the reasonable care and skill of a commercial solicitor, or is it that of the solicitor specialising in information/data protection law?

In many cases it will be the latter, because of the way that advisers have been holding themselves out as specialists: see Jackson & Powell on Professional Liability, 8th edition, §11-101. Sometimes the specialism can be really quite precise, as recently in Agouman v Leigh Day [2016] EWHC 1324 (QB) where it was that of "a reasonably competent firm with a department specialising in group litigation for unsophisticated clients arising from events in a poor and unstable African country".

The position could be more difficult where the advice has not been given by legal professionals. Many have been advertising their services as "GDPR consultants". By what standard are they to be judged?

If, although not lawyers, in fact they have strayed into giving legal advice, it is suggested that they will be judged by the standards applicable to the legal profession: Jackson & Powell §2-137.

But if they have not given legal advice, can they be judged by the standard of "the reasonably competent GDPR consultant"? That would entail expert evidence from other GDPR consultants, but as these are not necessarily a part of a homogenous group, and as this specialism has sprung up relatively recently, it may be challenging for such an expert to give the requisite evidence of the accepted standards in the profession, rather than the (inadmissible) evidence of what he/she would have done differently.

Breach of duty

We will have to wait and see what specific errors come to light. Errors are inevitable, because of the length, complexity and opacity of the Regulations.

There may be cases in which the ICO or the courts adopt an unexpected...