The right to damages

This example is from the United Kingdom, as published at: http://www.nabarro.com/insight/briefings/2017/february/assessing-damages-for-data-protection-and-data-privacy/

“In October 2013, the Home Office published quarterly statistics about the family returns process by which applicants who have children but who have no right to remain in the UK are returned to their country of origin.

The Home Office uploaded anonymised statistics, but they also mistakenly uploaded a spreadsheet of raw data on which those statistics were based. This spreadsheet contained personal data and private information of approximately 1,600 individuals, including their names, ages, nationality, the fact of an asylum claim, the regional office which dealt with their case and their immigration removal status.

This data remained online for nearly two weeks before it was removed but during that time the webpage had been visited by IP addresses across the UK and abroad. As a result, a small number of these individuals brought claims for misuse of private information and breaches of the Data Protection Act 1998 (DPA).

The defendant accepted that their accidental publication of personal data amounted to a misuse of private and confidential information and a breach of the DPA. It was not disputed that, subject to proof, damages were recoverable for distress at common law and section 13 of the DPA, unless Google Inc v Vidal-Hall is overturned.

The six individuals who brought the claims were awarded between £2,500 and £12,500 in damages for misuse of their private information and the distress suffered as a result of the data breach.”

Write or speak to the organization which mishandled your personal information to see if you can reach an agreement and claim compensation. If you feel that your concern has not been satisfactorily addressed, you should write to the organization and inform them of your intent to take the matter to the court, before you start court proceedings. Talk to a legal adviser if you want to make a claim in court.

The NPC has no role in dealing with compensation claims. But you may request us to assess if the organization mishandled your personal data and broke the DPA. You can give a copy of the NPC’s letter to the court along with the evidence to prove your claim. This, however, does not guarantee that the judge will fully agree with NPC’s view. You may also require someone from the NPC to give expert evidence which will only be allowed if the judge orders it. The party calling the witness will have to shoulder the corresponding cost.