What Are The Awards in a Data Breach Case?

Why can I be compensated?

As your Solicitor, our role is to help you obtain financial compensation which is owed to you as a result of a data breach. Whilst a data breach cannot be undone, we can help you obtain compensation which acknowledges that a breach has occurred and as much as possible, puts you back in the position which you would have been in had the breach not occurred.

What can I claim for?

Data breach is an involving and emerging area of law but there are guiding principles as to what a victim of the same can be awarded following a data breach.

The first type of damages which can be claimed for what is known as ‘general damages’. Following the recent cases of Lloyd v Google LLC [2019] EWCA Civ 1599, a victim of a data breach can recover damages without proving pecuniary loss or distress. However, if there is pecuniary loss or distress, these are claimed as part of ‘general damages’.

In addition to general damages, a victim of a data breach may be entitled to aggravated damages based on the opponent’s conduct. For example, the manner in which the wrong occurred, the motive when the breach occurred and also the subsequent conduct of the opponent are factors to consider when assessing whether aggravated damages are payable.

How much can I claim for?

As mentioned, data breach is a relatively new area of law and as such, the Courts have not yet established a definitive guide as to the level of damages. However, there are cases which have been previously decided which provide an indication as to the amounts which can be claimed.

Clearly, each case will be assessed based on its own circumstances so it is impossible to state an exact amount within which all these cases are worth. However, guidance of between £2,500 and £12,500 has been given in cases where sensitive data has been leaked inadvertently onto the internet and viewed by a certain amount of people. In addition and more generally, the following examples of the amount of compensation awarded for distress and injury to feelings are as follows :-

• Unlawful disclosure of personal details (name, date of birth, home and email address) range of between £1,000 and £1,500
• Unlawful disclosure of medical information (dependant on the nature, number of people disclosed to and whether material is lost or recovered) between £2,000 and £2,500
• Unlawful disclosure of financial information (dependent on the nature, number of people disclosed to, relationship with those disclosed to and consequential loss arising) range of £3,000 to £7,000

Valuing the loss of the privacy right/loss of the control of the right to privacy is separate and is to be taken on a case by case basis. The overall guidance is that victims of data breach should be entitled to ‘more than nominal damages’ because breach of privacy/loss of control of privacy is a fundamental human right which ought to be protected. If a victim of data breach provides medical evidence supporting a claim for psychological or psychiatric injury, then awards given in personal injury litigation give more definitive guidance of between £1,350 to £100,000 in the most severe cases.

If aggravated damages are to be awarded, it is usually included in the overall general damages sum. The overall guidance is that the general damages would be increased by 25-50%.