Background

Mr Matthew McConville, the Head of our specialised Data Breach Department at Irvings Law has successfully represented a client in a data breach compensation claim. The said client wishes himself to be unnamed for the purposes of this case report and as such will be referred to as ‘Mr P’.

Mr P was previously employed by the BBC and was unable to participate in training due to not feeling well. In response to this, a note was written on an internal system citing Mr P’s depression which was only known to his manager at the time of this incident but the place in which this note was written was accessible to all colleagues of Mr P.

After this, Mr P contacted his union representative and he raised a complaint to the BBC on behalf of Mr P in respect of this said data breach. On the same day, it was confirmed that the comment had been removed and the situation was being investigated. Later this day, it was again confirmed that ‘…the steps that have been taken in relation to this breach, which included that [Mr P] has been removed from the main Allocate system and the web version is no longer visible, and that the data protection legal team have been spoken to and whom have taken the decision to report the breach to the information commissioner’. Mr P was informed directly that ‘the comment was made by one of the system administrators who had been advised such comments would not be visible’. It was not their intention to make it public and in their opinion it was information that was relevant to the situation that had arisen.

Following advice from the Data Protection Team, it was added to Mr P that ‘…we will not use Allocate to record this sort of information. The text was potentially visible to members of the team who viewed that individual shift. It was not viewable in the daily or weekly views of Allocate which most people used to look at their shifts. We believe that the likelihood on anyone else seeing the comments was low. Allocate has now been updated so that comments are not visible by the members of the team. The text was immediately deleted when we were made aware of it and a data breach report was made. The matter was also reported to the Information Commissioner by the BBC’s Data Protection Team. My apologies again that this situation arose’.

Representation

As the BBC had done this, Mr P sought assistance from Mr McConville. Without hesitation, Mr McConville offered to act for Mr P on a no win no fee basis and once instructed, Mr McConville submitted a Letter of Claim to the BBC alleging that they had not kept Mr P’s sensitive information safe and secure, they had breached / invaded his privacy under the Human Rights Act, had breached the Data Protection Act 2018/the General Data Protection Regulation (GDPR) as well as confidence following their misuse of private information pertaining to Mr P. To protect his human rights claim due to the time that had passed prior to Mr McConville’s involvement, Mr McConville issued High Court proceedings on behalf of Mr P.

Resolution

Following doing this, the BBC insisted upon settlement discussions with Mr McConville and Mr P. The BBC made Mr P an offer to settle his claim in the sum of £3,500.00 plus his legal costs and in accordance with Mr P’s instructions to resolve the matter without involving the Court any further, settlement was reached on this basis.