An Update on U.K. Data Breach Damages

The 13 March 2020 Queen’s Bench Division Media and Communications List judgment in Alexander Aristides Reid v Katie Price [2020] EWHC 594 (QB) has added to the body of case law on damages for breaches under data protection legislation. Mr Reid was awarded £25,000 under the Data Protection Act 1998 (DPA 98) and other causes of action.

This alert covers the implications of that case, as well as placing it in the context of prior developments in data protection damages under DPA 98 and the GDPR.

Background

The case resulted from the fall out of a celebrity marriage between Ms Price, a TV personality and former model, and Mr Reid, a mixed martial arts fighter. Following divorce, Mr Reid brought an action against Ms Price for retention and dissemination of video recordings and photographs obtained during their marriage and which exposed his private sexual practices. Upon Mr Reid’s discovery that Ms Price had the material, he sought and Ms Price gave undertakings in 2011 that she would not make disclosures of this very private information. Ms Price then subsequently breached her undertakings. The dissemination was widespread and included distribution to newspapers, leading to press articles, to private parties and in Family Court proceedings.

Mr Reid had filed a claim for damages in 2017 limited to £25,000 “for issue purposes” (this is where a party needs to estimate the sum claimed on issuing proceedings) for breach of confidence, misuse of private information and breach of contract, and compensation under DPA 98.

Available Compensation the Same Across Causes of Action

First of all, while there were multiple causes of action, for all of which Ms Price was found liable, Warby J did not see that there was any difference in damages flowing therefrom. Instead: “[t]he essential task is to compensate the claimant for the wrongful retention and wrongful disclosure of images of his sexual conduct, and the wrongful disclosure of information about that conduct. In logic, and in the presentation of the case, it is the claim for wrongful disclosure that predominates. The claim in wrongful retention is secondary, and subordinate to that claim.”¹

Quantum Informed By Aggravated Conduct of the Defendant

The fact that the claim had initially been issued seeking damages up to £25,000 fundamentally capped it. The claim would need to be amended, and owing to court rules a renewed filing fee of over £5,000 would have needed to be paid to do so. Owing to Ms Price’s bankruptcy proceedings, Mr Reid did not seek such an amendment.² However, the judgment in any event discloses that the case was considered as unlikely worthy of damages much higher than that.

The disclosure in Family Court proceedings was not considered part of the wrongful conduct. Primarily, Warby J viewed the nature of Ms Price’s conduct as driving the award of damages:

The defendant’s conduct has considerably aggravated the harm caused by the disclosures themselves. Her behaviour has been persistent, flagrant, arrogant, high-handed, and inexcusable, and for those reasons very distressing and hurtful to the claimant. The claimant’s perception that the defendant has lied about whether she retained copies of the Personal Information, and that she has acted maliciously, is reasonable, and he is entitled to be compensated for the distress he has suffered as a result. The defendant’s frequent additional references or allusions to the Private Information, sometimes in threatening terms, have caused additional upset, “rubbing salt in the wound”.³

In two aspects though, the claims were seen as somewhat less than previous examples where unauthorised disclosures had affected a claimant’s private life, and which had attracted damages in the area of £70,000 to £80,000.⁴ First, the disclosures after the undertakings did not reveal anything secret. By then Mr Reid’s private life was already a matter of public knowledge (compared with Mosley, in which the claimant’s previously secret sexual preferences were first revealed publicly by a front page story without prior notice⁵). Second, the information was not originally obtained from unauthorised access to personal information (in Gulati, Mr Alan Yentob had been awarded £85,000 after his phone was hacked⁶). It was the later retention and dissemination which was at issue here.⁷

Moreover, the judge was mindful of comparisons to cases where psychological distress damages were awarded following physical disfigurement, such as loss of sight in an eye. He was further unconvinced the disclosures had, as alleged, destroyed Mr Reid’s life, calling this “a rhetorical exaggeration.”⁸ Thus, “[d]amages of £25,000 would be comparable to an award for moderately severe psychiatric harm, or a neck injury leaving markedly impaired function. Applying the principles I have identified above, an award at that level or more is fully merited, on any view of the authorities.”⁹

Psychiatric Harm and Expert Evidence

Key to the findings here is that the focus, as discussed above, was the aggravated nature of the defendant’s conduct. Meanwhile, the contention that the claimant’s life had been ruined was not credited. Warby J made clear that special psychiatric harm is a matter for further evidence on causation, “almost certainly including expert evidence.”¹⁰

Comparison with Other DPA 98 and GDPR Developments

The above case demonstrates that significant data breach damages for psychological harm are a matter either for very particular evidence of the circumstances of the claimant, or connected to the gravity of the conduct of the defendant. A general loss of data privacy which is found to breach DPA 98 without any special circumstances may attract damages for distress under section 13(2). £750 was awarded in Halliday v Creation Consumer Finance Limited [2013] EWCA Civ 333 under this head.

This is also being drawn out under GDPR, which applies in the U.K. owing to the Data Protection Act 2018. GDPR Article 82(1) gives a right to non-material damages similarly to section 13(2) DPA 98.

This was applied in the Austrian regional court of Feldkirch last year, where an individual whose personal data was processed without legal basis was granted €800 in damages. However, on 13 February 2020 the Higher Regional Court of Innsbruck reversed the award, finding that the breach was not sufficient to found non-material damages without some specific distress to the individual. In the summer of last year in Germany the Higher Regional Court of Dresden and the Regional Court of Karlsruhe also both held that minor loss did not give rise to any claim for non-material damages pursuant to Article 82.

In the Netherlands, on 2 September 2019 and 15 January 2020 respectively the Administrative District Court of Amsterdam and the Administrative District Court of the Northern Netherlands both awarded damages of €250 for unlawful data processing under the GDPR. Their attitude differed, finding that some kind of compensation must be granted under Article 82(1) even if it was difficult to quantify any specific non-material harm.

Accordingly, a consensus appears to be emerging that breaches of data protection not aggravated by malice and without specific evidence of psychiatric harm are unlikely to draw more than minimal awards in favour of the affected individuals. Nevertheless, even very limited damages amounts could reach significant aggregate totals in the case of breaches affecting large numbers of potential claimants. Large scale corporate data breaches may also independently attract significant fines from regulatory authorities under the GDPR regime.