In 1998, when the Data Protection Act came into force, many thought that it would primarily be a concern for credit reference agencies and companies engaged in mass marketing. It has now become clear that the Act extends much further than initially thought. The Act is a complex piece of legislation which is hard to navigate. This, together with the onerous requirements of the act, can make compliance a challenge. Comfort was offered to organisations in section 13 of the Act which stipulated that it is necessary that the claimant had suffered damage before a claim for compensation could be made for a breach of the Act.
On the face of it, the meaning of this provision is extremely clear and for the first fifteen years in which the Act was in force the courts regularly dismissed claims for compensation for distress caused by a breach of the Act on the basis that no damage had been suffered. That position appeared to be shifting last year when, in a number of cases, the Court of Appeal circumvented the effect of section 13(2) by awarding nominal damages of £1 for breaches of the Act, following which it then made substantive awards for distress. This potentially set a precedent for other awards. However, there was some hope that this would not be the case as each of the three cases which had come before the Court of Appeal had relatively unique facts.
Any doubt about how the courts will approach these matters has now been dismissed due to (1) Vidal-Hall (2) Hann and (3) Bradshaw v Google Inc. (Google) In essence, the court has now completely removed the need for any damage to have been suffered before a claim for distress can be pursued. In this case the Court of Appeal was asked to determine whether, under section 13 of the Act, there could be a claim for compensation where no financial loss had been suffered.
The claim concerned the operation of what was referred to as the “Safari workaround”. The essence of the complaint was that Google collected private information about the claimants’ internet usage through its Safari browser without the claimants’ knowledge and consent. Cookies collated “Browser Generated Information” (“BGI”) which was used by Google as part of its commercial offering to advertisers. The BGI allowed advertisers to place advertisements targeted or tailored to the claimants’ interests on the screens of the claimants’ devices. This, in turn, revealed private information about the claimants which was (or might have been) seen by third parties. The collection of the data was contrary to Google’s publically stated position that this would not happen to Safari users, unless they had expressly allowed it to happen.
An interesting technical question arose as to whether misuse of private information was a tort (a prerequisite for an order for Google to be served out of the jurisdiction). However, the potentially more important was issue was the meaning of “damage” in section 13 of the Act.
The court accepted that on a literal interpretation of section 13 the claimants were not entitled to recover damages because their claims did not fall within either section 13(2)(a) or 13(2)(b).
The claimants in Google argued that the approach taken in the legislation and the cases that had followed was incorrect. The legislation was based on an underlying European Directive (Directive 95/46/EC). The claimants argued that the Directive was not as limited as the Act and that accordingly the Act failed to properly implement the Directive. The initial challenge for the court was that it had already considered this issue in Johnson v Medical Defence Union where Lord Justice Buxton had said that there was “no compelling reason to think that ‘damage’ in the Directive has to go beyond its root meaning of pecuniary loss” and where a claim for distress was dismissed on the basis that no financial loss had been suffered.
The Court of Appeal neatly overcame this by saying that Lord Justice Buxton’s comments were “not necessary for his determination of the [previous] appeal” and were obiter. The court in Google accordingly decided that it was not bound by the Johnson decision.
The Court of Appeal then looked at how the European Court of Justice had dealt with defining the term “damage” in other cases. It noted that in relation to package travel the court had provided a right to compensation for non-material damage. The court said that taking the same approach to the construction of the Directive in relation to data protection meant that “damage” should include both material and non-material damage.
The court said that since the Directive was seeking to provide protection for privacy rather than economic rights it would be strange if it could not compensate individuals whose privacy had been invaded in circumstances where they were caused emotional distress, but not financial loss. In cases involving invasion of privacy it was distress which was the primary form of damage and the court felt that an individual should have an effective remedy in respect of that damage. The court noted that the enforcement of privacy rights under Article 8 of the European Convention on Human Rights had always permitted recovery of non-financial loss. The Court of Appeal found that a restrictive interpretation of “damage” would substantially undermine the objective of the Directive. The only comfort it provided was that it said that “if a case is not serious in terms of its privacy implications, then that by itself is likely to rule out any question of recovery of compensation for mere distress”.
The court took the view that in the circumstances, “if interpreted literally, section 13(2) has not effectively transposed article 23 of the Directive into our domestic law”. The question that arose as a result was whether the court had to try to interpret section 13(2) in a way which was compatible with the Directive. The court could not interpret legislation in a way that would distort or undermine an important feature of the legislation. The first issue was therefore whether Parliament had deliberately limited the right of compensation. The court felt that it must have done so. As section 13 was a central feature of the Act, and the limit set by Parliament to the right to compensation was a fundamental feature of the legislation, the court was not in a position to interpret section 13(2) in a manner that was compatible with the Directive.
As a result, the court had to go back to first principles. The EU Charter provides (article 47) for a right to an effective remedy and a fair trial. The European Court of Justice has stated that where there is a breach of a right under EU law article 47 is engaged and that insofar as a provision of national law conflicts with the requirement for an effective remedy the domestic courts can (and must) disapply the conflicting provision (the only exception being where to do so would require the court redesigning the fabric of the legislative scheme).
The court said that “what is required in order to make section 13(2) compatible with EU law is the disapplication of section 13(2) no more and no less. The consequence of this would be that compensation would be recoverable under section 13(1) for any damage suffered as a result of a contravention by a data controller of any of the requirements of the DPA. No legislative choices have to be made by the court.”.
That is exactly what the court has done. The consequences are potentially dramatic. From now on, every time there is a breach of the Data Protection Act (for example where data is lost or stolen, where it is used for purposes that may not have been initially envisaged or where it is retained for longer than it should have been) there will be a potential claim for damages.
Many of the data breaches we see involve the data of large numbers of individuals. In theory, each of these individuals will now be entitled to pursue a claim. The only defences will be (i) the statutory defence that reasonable care was taken in relation to the data concerned (which is often extremely difficult to establish where there has been a breach) or (ii) that the breach is not serious in terms of its privacy implications (which will be hard to demonstrate where the information is financial, relates to health or involves serious allegations).
This case dramatically increases the exposure of any organisation that holds information or processes information to claims for damages and the possibility of group actions now seems even higher than it was before. The importance of ensuring that proper data protection policies and procedures are in place, of training staff and of obtaining appropriate insurance cover could not now be greater. The floodgates seem to have been opened and it may now simply be a matter of waiting until the claims arrive.
0+
