How to Assess Damages for Breaches under the GDPR : A Practical Guide

Valuations of claims for general damages for breaches of the GDPR are tricky, not least because of the absence of a large body of higher court authority. However, it is possible to discern through authorities the general approach adopted by the courts.  Summarised below by Huw Davies and Leonard Wigg of Farrar’s Building, are some general observations to assist in assessment.

Claims for breach of the GDPR/DPA go hand-in-hand with other ‘privacy’ claims

Claims for damages for breach of the GDPR/DPA are usually brought with a multitude of other ‘privacy’ based claims i.e  misuse of private information (MPI) and equitable claims such as a breach of confidence. All  these claims will generally related to the same subject matter, namely privacy.

Courts will make single awards for the same breach of privacy, despite the possible number of separate causes of action

The approach of the Courts has been to make one award of ‘general’ damages when there has been a breach of privacy, despite the fact that the same breach may constitute a number of separate causes of action. It will not ‘double’ up damages. i.e see TLT v Secretary of State for the Home Department [2016] EWHC2217 (QB

Non-pecuniary, ‘general’ damages will primarily be for distress, albeit that  loss of control is available.

• Awards for breach of privacy will be in respect of the loss of control of personal and confidential information, a proposition settled by the Court of Appeal in [2016] 2 WLR Gulati v MGN Ltd. 1217.

• In Lloyd v Google,  the Court of Appeal held that a claimant could recover damages for loss of control of their data (under the DPA 1998) without the need to prove any mental distress.

• The method of ascertaining the ‘value’ of a loss of control is difficult, though understanding the nature of the award as ‘licence fee damages’  for the value of the use of the information will likely aid the court in quantifying the damages.

• Save in cases where there is clear commercial value in the information that is subject to the privacy claim (i.e phone hacking, web browser information) , the general approach of the courts has been to roll up loss of control within the overall award made.

There is no mathematical formula for assessing these ‘general damages’

The Court of Appeal has stated that it should be slow to interfere with an assessment of damages in such cases where the measure of damages was necessarily general and could not be calculated mathematically.

A useful yardstick in gauging the likely level of an award will the to ‘cross-reference’ with PI awards for psychiatric and psychological injury

This was the approach of Mr Justic Warby in TLT : “It is common ground that I can and should take into account, in assessing   damages for distress, awards made for psychiatric or psychological injury in personal injury cases to ensure that any award is not out of kilter with them.Note that in assessing general damages, the JCB Guidelines provide the following factors as relevant for assessment:

(i)the injured person’s ability to cope with life, education, and work;

(ii)the effect on the injured person’s relationships with family, friends, and those with whom he or she comes into contact;

(iii)the extent to which treatment would be successful;

(iv)future vulnerability;

(v)prognosis;

(vi)whether medical help has been sought;

Note that  in Simmons v Castle [2012] EWCA Civ 1288 [2013] 1 WLR 1239 the Court of Appeal  held that awards for torts causing inter-alia distress were to be 10% higher than previously awarded.

Comparison with discrimination awards however is not a useful yardstick

In Halliday v Creation Consumer Finance Limited,  the Court of Appeal specifically rejected the guidance given in Vento  as to bands of damages for discrimination cases.

Proof of distress is not necessary, albeit that awards will be very modest absent evidence

There does not have to be proof of an injury to feelings and distress: the Court will make modest award when it is to be expected that a degree of distress/frustration would be suffered. In Halliday, and award of £750 was made despite a lack of evidence.

Distress is subjective and the egg shell rule does apply

The egg shell rule does apply i.e Burrell v Clifford  the “thin skull” principle was applied when it was recognised that the butler was entitled to damages to be assessed on the basis of the extent of the distress that he had suffered even though a more robust individual would not have suffered distress to that extent.

However, distress has to be genuine: the more extreme reaction the less likely it is to be genuine and the more likely it is to be exaggerated.

It seems probable that at some stage distress will cross into a recognisable psychiatric injury for which medical evidence will be expected.

Awards for the Famous and Infamous will be higher than for Joe Bloggs.

Cliff Richard was awarded £190,000 general damages and £20,000 aggravated damages  against the BBC in Richard v BBC in relation to the police search of his home by police investigating alleged historical sexual offence.

Max Mosely was awarded £60,000 for a “scale of the distress and indignity in this case is difficult to comprehend. It is probably unprecedented. “

It seems highly unlikely that a non-celebratory claimant would achieve such high levels of awards: put bluntly there will be unlikely to be such a significant public interest in disclosure that has been made, and as such ‘distress’ objectively lower. Given the comparison with the JCB Guidelines, it is difficult to envisage the majority of damages extending beyond £25,000. Save in des minimis cases, a range of awards is likely to fall between £1,000 and £25,000.

The awards made in TLT v Secretary of State for the Home Office are currently the most useful comparable cases and a useful starting off point for  pitching an award.

Factors that will be relevant to an assessment of awards.

The following factors are likely to be  of particular relevance in assessing where within such notional bracket an award is likely to fall:

(i) The nature and content of the private information revealed. The more private and significant the information, the greater the effect on the subject will be (or will be likely to be);

 9ii) The scope of the publication/disclosure. The wider the publication, the greater the likely invasion and the greater the effect on the individual.

(iii) The presentation of the publication/disclosure. Sensationalist treatment might have a greater effect, and amount to a more serious invasion, than a more measured publication.

(iv) The likely individuals who will access or be perceived as likely to access such information. i.e disclosure to professionals used to dealing with confidentiality is likely to be viewed as less serious than to close family members or the public more generally;

(v) The Court will take a sensible approach to whether or not there is or was likely to have been real interest in the disclosure.

---

• Share article:

---