Court of Appeal awards compensation for data breach distress

The Court of Appeal has awarded £750 in compensatory damages for distress suffered by a man through a breach of the Data Protection Act 1998 by a consumer finance company. (Halliday v Creation Consumer Finance Ltd (CCF) [2013] EWCA Civ 333, 15 March 2013.)

The Court of Appeal has awarded £750 in compensatory damages for distress suffered by a man through a breach of the Data Protection Act 1998 (DPA) by a consumer finance company. Section 13(2) of the DPA entitles an individual to compensation from a data controller for distress suffered through a DPA contravention. The appellant, Mr Halliday, had purchased a television set through a credit arrangement with Creation Consumer Finance Ltd (CCF). Protracted dealings and court proceedings between the parties resulted after CCF committed numerous data breaches, which included providing incorrect data concerning Mr Halliday to a credit referencing agency, which was then made available to third parties for a period of four months. The court held that this breach was limited in nature, did not lead to loss of credit or reputation, and was a "single episode" case, as it arose through a single error. However, it held that Mr Halliday had suffered distress from non-compliance with data protection requirements, although no more than would be expected from frustration at the prolonged and protracted events. Therefore, the court felt there ought to be an award, albeit of a relatively modest nature. It took into account the distressing nature of CCF's disregard for a previous court order and Mr Halliday's related frustration, which was exacerbated by the history of the matter and the difficulty he had in previously receiving a satisfactory response from CCF. (The judgment transcript from this March 2013 hearing has only recently become available.)