Professional Negligence Claims Arising Out Of GDPR

Inevitably it will transpire that mistakes will have been made by professionals giving (often very expensive) guidance on GDPR compliance. Their clients will want to consider whether a claim for professional negligence can be made. In this article Neil Hext QC, Stephen Innes and Helen Evans of 4 New Square discuss some of the issues which are likely to arise in such claims.

Standard of care

Much of the advice which is being obtained in relation to GDPR is from lawyers. In that situation, the standard of care required is straightforwardly the reasonable care and skill of the solicitor of barrister, although there may be some scope for argument as to the level of specialisation expected: is it the reasonable care and skill of a commercial solicitor, or is it that of the solicitor specialising in information/data protection law?

In many cases it will be the latter, because of the way that advisers have been holding themselves out as specialists: see Jackson & Powell on Professional Liability, 8th edition, §11-101. Sometimes the specialism can be really quite precise, as recently in Agouman v Leigh Day [2016] EWHC 1324 (QB) where it was that of "a reasonably competent firm with a department specialising in group litigation for unsophisticated clients arising from events in a poor and unstable African country".

The position could be more difficult where the advice has not been given by legal professionals. Many have been advertising their services as "GDPR consultants". By what standard are they to be judged?

If, although not lawyers, in fact they have strayed into giving legal advice, it is suggested that they will be judged by the standards applicable to the legal profession: Jackson & Powell §2-137.

But if they have not given legal advice, can they be judged by the...