TLT and Others v The Secretary of State for the Home Department and the Home Office [2016] EWHC 2217 (QB), 24 June 2016 (“TLT”)
Background
The Data Protection Act 1998 (“DPA”) makes provision for regulation of “the processing of information relating to individuals, including the obtaining, holding, use or disclosure of such information.”
Section 13 of the DPA permits a person who suffers “damage” or “distress” by reason of any breach of his/her personal data, to take legal action to obtain compensation for failure to comply with the requirements with DPA.
In TLT (“Claimants”), the Home Office published on its website personal data (including the “name”, “date of birth”, “nationality”, “address”, “immigration case, type and status”) of the Claimants who had made an asylum application to remain in the UK.
The personal data of the Claimants was published in error for 13 days on the Home Office website. The Claimants personal data were accessed on the Home Office’s website on 27 occasions. Subsequently the Home Office notified the Claimants with an explanatory letter of apology about the erroneous disclosure on its website.
Decision
The High Court considered that the Home Office did not comply with the requirements of the DPA and awarded damages to the Claimants for the “immediate shock of the discovery of the disclosure, and the loss of trust in the authorities resulting from the data breach”. Compensation was also awarded for the serious consequences of the disclosure. Furthermore, the disclosure caused fear of safety for one the claimants if they returned to their country. Consequently the High Court allocated awards ranged between £2,5000 and £12,500 dependant on their respective injuries and evidenced they provided.
Comments
The High Court clarified the meaning of section 13 of the DPA and set out the basis on which the compensation was allocated: the following were taken into account:
From a legal perspective, before assessing the damages amounts, it is important to analyse:
- whether disclosure was intentional or not,
- the nature of the injuries suffered by the victims (more or less severe psychiatric and/or psychological injury) and evidence of these injuries,
- the short term / long term consequences of the disclosure.
The current case illustrates the basis upon which damages are awarded, and how important Data Protection is considered.
The above is a general position of the law and does not constitute legal advice. For further information and advice, please contact Nath Solicitors.
