Compensation for distress caused by breach of Data Protection Act
The Data Protection Act (‘the DPA’) regulates how an individual’s personal information is used. Organisations that keep personal information must make sure the information is:
- used fairly and lawfully
- used for limited, specifically stated purposes
- used in a way that is adequate, relevant and not excessive
- kept for no longer than is absolutely necessary
- handled according to people’s data protection rights
- kept safe and secure
- not transferred outside the UK without adequate protection
There is stronger legal protection for more sensitive information, such as ethnic background, political opinions, religious beliefs, health, sexual health and criminal records.
It is common for disgruntled employees to complain that their data has been misused by their employer. If they have suffered financial loss because of a breach of the DPA they are entitled to claim compensation and the DPA says that any compensation awarded may take into account the level of any associated distress.
In the next case, the question was whether compensation for ‘distress’ under the DPA should be assessed in the same way as an injury to feelings awards in discrimination cases.
No, said the Court of Appeal.
Although not an employment case, the ruling is important to employers and HR professionals because the Court of Appeal decided that, although compensation should be awarded when there has been a breach of the DPA, it was not the intention of the legislation that substantial awards should be made. Secondly, the Court ruled that the line of authorities which deal with injury to feelings awards in discrimination cases ought not to apply to distress claims brought under the DPA. Drawing a distinction between the two types of complaint, the Court stated that "discrimination is generally accompanied by loss of equality of opportunity with far-reaching effects and is liable to cause distinct and well-known distress to the complainant", whilst a breach of the DPA typically causes frustration by the non-compliance.
In 2003, the Court of Appeal established three bands of award linked to the degree of seriousness of discrimination claims. The bands were updated for inflation in 2010 and currently are as follows. The lowest band is £600 to £6,000 for the less serious cases involving isolated incidents of unlawful conduct. The middle range is £6,000 to £18,000, which the Court of Appeal stated should be used for serious cases which do not merit an award in the highest band. The highest band is between £18,000 and £30,000 and sums in this range should be awarded in the most serious cases such as where there has been a lengthy campaign of discriminatory harassment on grounds of sex or race.
The complainant in the above case argued for an award for distress in the middle range, saying his was a serious case and that therefore an award between £6,000 and £18,000 should be made. However, the Court of Appeal ruled that injury to feelings awards in discrimination cases ought not to apply to distress claims brought under the DPA and the award he was given was £750.
If you would like advice about how the issues in this note apply to your situation, please contact Tony Brown on 01225 740097 or by e mail to firstname.lastname@example.org
Warning – this bulletin is for information only and does not claim to be comprehensive or to provide legal or other advice. You should take legal advice before taking or refraining to take any action. No liability is accepted for loss that may arise from placing reliance on this bulletin.