InfoLawUpdate - £20,000 Award Upheld on Appeal
Burnetts' information law solicitor Natalie Ruane discusses compensation with regards to personal data.
If you breach your legal duties as regards personal data held under your control, what might you expect to pay by way of compensation to the affected individual?
Firstly the individual has to have suffered financial loss. If not, they are not entitled to a penny under section 13 of the Data Protection Act. Secondly if they get across that hurdle, how much might be awarded for distress? Generally reported awards have tended to be low and no more than a few thousand pounds.
However, the Court of Appeal of Northern Ireland in CR19 v Chief Constable of the Police Service of Northern Ireland in 2014 awarded £20,000 (plus interest) for the Constabulary’s negligence when data and records on a particular police officer, CR19, were stolen along with others. The Constabulary admitted negligence and a breach of the seventh data protection principle (failure to take appropriate technical and organisational measures).
The police officer in question already had post-traumatic stress disorder following exposure to some serious terrorist incidents and had an alcohol problem. He claimed as a result of the stress of the data loss, his post-traumatic stress and alcohol problems got worse, he lost out on an employment opportunity and his house was devalued as a result of threats to his property. He also claimed for extra security measures that he had had installed for his personal protection.
The police officer appealed saying that the award was too low. On appeal the Court of Appeal considered two previous cases where £750 and £2,250 had been awarded. The Court noted that three independent psychiatrists gave professional evidence as to the distress sustained by the police officer. They concluded that the damage for distress arising from the breach of the Data Protection Act was subsumed within the Judge’s overall award. They considered that the assessment had taken account of the distress caused by the breach of data protection but awarded a further nominal damages sum of £1 to reflect the fact that there was an admitted breach of section 4 of the Data Protection Act.
In contrast to the previous cases that the Court considered, this case illustrated how evidence, including expert medical evidence, can be deployed to substantiate a more significant award for distress.
About the author
Natalie is a Partner and leads the Employment Law & HR team and specialises in education.
Published: Tuesday 23rd September 2014
Categorised: Information Law