CCR Magazine

You are here  :Home arrow News arrow Data Protection Claims: An Increased Risk for the Utilities and Financial Services Sectors
Contact Us Newsletter Signup RSS Feeds

Latest News Headlines


Commercial Credit News


Data Protection Claims: An Increased Risk for the Utilities and Financial Services Sectors PDF Print E-mail
Wednesday, 03 June 2015

The recent decision of the Court of Appeal in Google Inc. and Judith Vidal-Hall and others and the Information Commissioner, which was issued on 27 March 2015, is a landmark decision in relation to claims brought by individuals (data subjects) under the Data Protection Act 1998 (DPA). The decision significantly increases the risk which utility companies, debt collection agencies and debt purchase companies, for example, face from individuals in relation to claims that their personal data was unlawfully processed in breach of the DPA. Claims management companies are no doubt examining the decision with interest.

Before this decision an individual who had a claim on the grounds that his or her personal data had been processed in breach of the DPA could only include a claim for non economic loss, such as distress, hurt to feelings or anxiety, where they had also suffered an economic/financial loss. In other words an individual required to establish a financial loss before he or she could claim for distress. This restriction, contained in section 13(2) of the DPA, was an effective bar to many claims where the individual’s personal data had been processed in contravention of the DPA but they had not suffered an actual financial loss. In these circumstances the individual had no claim for damages under the DPA.

The recent Court of Appeal decision, however, declared that s.13(2) of the DPA conflicted with rights under articles 23 and 47 of the Data Protection Directive and that the Court would therefore disapply section 13(2). Article 23 stipulates that “Member states shall provide that any person who has suffered damage as a result of an unlawful processing operation ..... is entitled to receive compensation from the controller for the damage suffered.” Article 47 provides that “Everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy .....” The Court of Appeal in the Google Inc. decision held that the restriction contained in s.13(2) which prevented a party from claiming for damages for distress, unless that party had also incurred a financial loss did not properly implement article 23 and was inconsistent with article 47. The Court of Appeal therefore disapplied s. 13(2) of the DPA. This in effect means that the restriction which s.13(2) imposed on claimants no longer applies and that claims can now be made for distress alone without the claimant having to prove a financial loss.

In certain cases the courts have, in the past, negotiated around this restriction by awarding nominal financial damages to allow the claimant to proceed with a claim for damages for distress. In the case of Halliday v Creation Consumer Finance Limited (March 2013) the Court of Appeal awarded nominal damages of £1, but held that while there had been a wrongful processing of the claimant’s data it had not led to a loss of damage to his reputation and credit. The wrongful processing had been due to a technical error and was a single episode. The Court of Appeal held in relation to the damages for distress claim that there was no evidence of injury to the claimant’s feelings or distress apart from frustration at the non-compliance of Creation Consumer Finance but it was important to recognise that frustration with some kind of remedy. The Court of Appeal assessed the claimant’s compensation for distress alone in the sum of £750. This award, made in 2013, is arguably not an inconsiderable amount of compensation for “frustration”. If this were to become a benchmark award it would not be good news for businesses, such as utility companies, lenders, debt purchase companies and debt recovery agencies that process large volumes of personal data.

Prior to the Court of Appeal decision in the Google Inc. case, it was a significant disincentive to potential claims brought under the DPA if the individual claimant had not suffered an actual financial loss. The Court of Appeal’s decision in the Google Inc. case, however, now allows an individual to pursue a damages claim for distress even where that individual cannot prove a financial or pecuniary loss. Data subjects and claims management companies will not be slow to press such claims which in commercial terms will probably be settled before court proceedings. If the wrongful processing of the individual’s personal data is a systemic one, affecting perhaps many hundreds or even thousands of individuals then this emerging risk issue is a significant one. This recent Court of Appeal decision is not good news for businesses, such as utility companies, lenders, debt purchase companies and debt recovery agencies that process large volumes of personal data.

(Source - McClure Naismith LLP Legal Update)  


latest issue

CCR Cover

The latest edition of CCR Magazine, the leading editorial publication in the UK credit industry, is out.

Read the latest issue online


CCR is the premier magazine for consumer and credit professionals. It provides an independent voice to the industry, breaking major news stories and running in-depth features.

As a magazine, it works with and campaigns on behalf of the credit industry to promote its importance as a centre of potential profit and business development to the wider business world.

Subscribe to CCR Magazine

CCR World Magazine


Providing information and analysis for thousands of senior credit professionals worldwide, every quarter.

Find out more

GTS Media Ltd
81 Cambridge Road

Registered in England No: 05483197