Compensation for Breach of Data Protection Legislation

In Halliday v Creation Consumer Finance Ltd [2013] EWCA Civ 333, the Court of Appeal considered the issue of compensation for distress caused to an individual by a breach of the UK's data protection legislation, the Data Protection Act 1998 (DPA).

Mr Halliday purchased a television through a credit arrangement with Creation Consumer Finance Ltd (CCF).  CCF distributed Mr Halliday's data in breach of the DPA and this resulted in him being given a poor credit rating.  Mr Halliday brought a claim for compensation for the distress he suffered as a result of the breach.  The Court decided that compensation should be awarded but felt that it should be relatively modest (£750) to reflect the fact that: (a) the distress suffered had been no more than frustration, (b) CCF had not behaved maliciously, and (c) the breach had been due to a technical error and was an isolated incident.  Interestingly, the Court added that the usual principles for assessing awards for injury to feelings in discrimination cases (which can range from £600 to £30,000) should not apply to the assessment of compensation for breaches of the DPA.

Although this was a commercial case, it is still of interest to employers as they are also required to comply with the DPA.  The case shows that the courts will award compensation for breaches of the DPA, but the awards may be relatively modest, at least in comparison to injury to feelings awards in discrimination claims.