An Update on U.K. Data Breach Damages
Client Alert | 6 min read | 04.17.20
The 13 March 2020 Queen’s Bench Division Media and Communications List judgment in Alexander Aristides Reid v Katie Price [2020] EWHC 594 (QB) has added to the body of case law on damages for breaches under data protection legislation. Mr Reid was awarded £25,000 under the Data Protection Act 1998 (DPA 98) and other causes of action.
This alert covers the implications of that case, as well as placing it in the context of prior developments in data protection damages under DPA 98 and the GDPR.
Background
The case resulted from the fall out of a celebrity marriage between Ms Price, a TV personality and former model, and Mr Reid, a mixed martial arts fighter. Following divorce, Mr Reid brought an action against Ms Price for retention and dissemination of video recordings and photographs obtained during their marriage and which exposed his private sexual practices. Upon Mr Reid’s discovery that Ms Price had the material, he sought and Ms Price gave undertakings in 2011 that she would not make disclosures of this very private information. Ms Price then subsequently breached her undertakings. The dissemination was widespread and included distribution to newspapers, leading to press articles, to private parties and in Family Court proceedings.
Mr Reid had filed a claim for damages in 2017 limited to £25,000 “for issue purposes” (this is where a party needs to estimate the sum claimed on issuing proceedings) for breach of confidence, misuse of private information and breach of contract, and compensation under DPA 98.
Available Compensation the Same Across Causes of Action
First of all, while there were multiple causes of action, for all of which Ms Price was found liable, Warby J did not see that there was any difference in damages flowing therefrom. Instead: “[t]he essential task is to compensate the claimant for the wrongful retention and wrongful disclosure of images of his sexual conduct, and the wrongful disclosure of information about that conduct. In logic, and in the presentation of the case, it is the claim for wrongful disclosure that predominates. The claim in wrongful retention is secondary, and subordinate to that claim.”1
Quantum Informed By Aggravated Conduct of the Defendant
The fact that the claim had initially been issued seeking damages up to £25,000 fundamentally capped it. The claim would need to be amended, and owing to court rules a renewed filing fee of over £5,000 would have needed to be paid to do so. Owing to Ms Price’s bankruptcy proceedings, Mr Reid did not seek such an amendment.2 However, the judgment in any event discloses that the case was considered as unlikely worthy of damages much higher than that.
The disclosure in Family Court proceedings was not considered part of the wrongful conduct. Primarily, Warby J viewed the nature of Ms Price’s conduct as driving the award of damages:
The defendant’s conduct has considerably aggravated the harm caused by the disclosures themselves. Her behaviour has been persistent, flagrant, arrogant, high-handed, and inexcusable, and for those reasons very distressing and hurtful to the claimant. The claimant’s perception that the defendant has lied about whether she retained copies of the Personal Information, and that she has acted maliciously, is reasonable, and he is entitled to be compensated for the distress he has suffered as a result. The defendant’s frequent additional references or allusions to the Private Information, sometimes in threatening terms, have caused additional upset, “rubbing salt in the wound”.3
In two aspects though, the claims were seen as somewhat less than previous examples where unauthorised disclosures had affected a claimant’s private life, and which had attracted damages in the area of £70,000 to £80,000.4 First, the disclosures after the undertakings did not reveal anything secret. By then Mr Reid’s private life was already a matter of public knowledge (compared with Mosley, in which the claimant’s previously secret sexual preferences were first revealed publicly by a front page story without prior notice5). Second, the information was not originally obtained from unauthorised access to personal information (in Gulati, Mr Alan Yentob had been awarded £85,000 after his phone was hacked6). It was the later retention and dissemination which was at issue here.7
Moreover, the judge was mindful of comparisons to cases where psychological distress damages were awarded following physical disfigurement, such as loss of sight in an eye. He was further unconvinced the disclosures had, as alleged, destroyed Mr Reid’s life, calling this “a rhetorical exaggeration.”8 Thus, “[d]amages of £25,000 would be comparable to an award for moderately severe psychiatric harm, or a neck injury leaving markedly impaired function. Applying the principles I have identified above, an award at that level or more is fully merited, on any view of the authorities.”9
Psychiatric Harm and Expert Evidence
Key to the findings here is that the focus, as discussed above, was the aggravated nature of the defendant’s conduct. Meanwhile, the contention that the claimant’s life had been ruined was not credited. Warby J made clear that special psychiatric harm is a matter for further evidence on causation, “almost certainly including expert evidence.”10
Comparison with Other DPA 98 and GDPR Developments
The above case demonstrates that significant data breach damages for psychological harm are a matter either for very particular evidence of the circumstances of the claimant, or connected to the gravity of the conduct of the defendant. A general loss of data privacy which is found to breach DPA 98 without any special circumstances may attract damages for distress under section 13(2). £750 was awarded in Halliday v Creation Consumer Finance Limited [2013] EWCA Civ 333 under this head.
This is also being drawn out under GDPR, which applies in the U.K. owing to the Data Protection Act 2018. GDPR Article 82(1) gives a right to non-material damages similarly to section 13(2) DPA 98.
This was applied in the Austrian regional court of Feldkirch last year, where an individual whose personal data was processed without legal basis was granted €800 in damages. However, on 13 February 2020 the Higher Regional Court of Innsbruck reversed the award, finding that the breach was not sufficient to found non-material damages without some specific distress to the individual. In the summer of last year in Germany the Higher Regional Court of Dresden and the Regional Court of Karlsruhe also both held that minor loss did not give rise to any claim for non-material damages pursuant to Article 82.
In the Netherlands, on 2 September 2019 and 15 January 2020 respectively the Administrative District Court of Amsterdam and the Administrative District Court of the Northern Netherlands both awarded damages of €250 for unlawful data processing under the GDPR. Their attitude differed, finding that some kind of compensation must be granted under Article 82(1) even if it was difficult to quantify any specific non-material harm.
Accordingly, a consensus appears to be emerging that breaches of data protection not aggravated by malice and without specific evidence of psychiatric harm are unlikely to draw more than minimal awards in favour of the affected individuals. Nevertheless, even very limited damages amounts could reach significant aggregate totals in the case of breaches affecting large numbers of potential claimants. Large scale corporate data breaches may also independently attract significant fines from regulatory authorities under the GDPR regime.
1 Alexander Aristides Reid v Katie Price [2020] EWHC 594 (QB) [49].
2 Alexander Aristides Reid v Katie Price [2020] EWHC 594 (QB) [53].
3 Alexander Aristides Reid v Katie Price [2020] EWHC 594 (QB) [60].
4 Alexander Aristides Reid v Katie Price [2020] EWHC 594 (QB) [52].
5 Mosley v News Group Newspapers Ltd [2008] EWHC 1777 (QB) [2008] EMLR 20.
6 Gulati v MGN Ltd [2015] EWHC 1482 (Ch) [2016] FSR 12 and [2015] EWCA Civ 1291 [2017] QB 149.
7 Alexander Aristides Reid v Katie Price [2020] EWHC 594 (QB) [55].
8 Alexander Aristides Reid v Katie Price [2020] EWHC 594 (QB) [58].
9 Alexander Aristides Reid v Katie Price [2020] EWHC 594 (QB) [60].
10 Alexander Aristides Reid v Katie Price [2020] EWHC 594 (QB) [57].
Contacts
Insights
Client Alert | 7 min read | 08.16.24
Over the past several years, federal courts have increasingly questioned the authority of administrative law judges (ALJs) to adjudicate alleged violations of certain labor and employment statutes. In the last several weeks, two U.S. district courts in Texas issued decisions halting unfair labor practice proceedings before the National Labor Relations Board (NLRB) on the grounds that NLRB ALJs lack the constitutional authority to preside over such actions due to unconstitutional protections against their removal.[1] Similarly, the last year has seen several decisions by courts in the Fifth and Eleventh Circuits finding that ALJs, whose decisions are not reviewable by a Presidential appointee, lack constitutional authority under the Appointments Clause to adjudicate claims.[2] The trend illustrated by these decisions, combined with the Supreme Court’s decision in June to abandon the Chevron doctrine of extending deference to federal agency rule-making proceedings, portend significant changes in the way employers interact with federal agencies that enforce labor and employment law.
Client Alert | 2 min read | 08.15.24
Department of Defense Plans Increased Investment in Clean Energy
Client Alert | 7 min read | 08.15.24