High Court awards GBP3,000 compensation for personal data breach – Ali v Chief Constable of Bedfordshire Police
In Ali v Chief Constable of Bedfordshire Police1, the English High Court awarded damages of GBP3,000 for the Defendant's breaches of the GDPR, misuse of private information, breach of confidence and breach of the Human Rights Act 1998.
BACKGROUND
In 2019, Isma Ali (Ms Ali) contacted Bedfordshire Police (Police) to report information concerning her ex-husband, who she believed was dealing drugs. Ms Ali repeatedly made clear to the Police that she did not want to be identified as the source of information. The Police gave Ms Ali assurances that she would remain anonymous.
The Police subsequently referred matters to the Social Services Department of Luton Borough Council (Council). The Police failed to anonymise Ms Ali as to the source of the information. An employee of the Council, Ms Begum, who was in a relationship with Ms Ali’s ex-husband, then unlawfully accessed the Council's systems and informed Ms Ali's ex-husband of the details she had shared with the Police.
Ms Ali claimed that by failing to anonymise the report to the Council, the Police breached her rights under Articles 5 and 6 of Regulation (EU) 2016/679 (GDPR), misused her private information, breached her confidence, and acted incompatibly with her rights to respect for her private life under Article 8 of the European Convention on Human Rights (ECHR) and therefore contrary to section 6 of the Human Rights Act 1998 (HRA).
HIGH COURT DECISION
The High Court upheld Ms Ali’s claims for breaches of Articles 5(1)(a) (lawful, fair and transparent processing) and (b) (collection for specified, explicit and legitimate purpose) of the GDPR, misuse of private information, and breach of section 6 of HRA.
GDPR
The High Court held that the Police had failed to demonstrate that it was necessary to disclose Ms Ali’s identity to the Council for one of the purposes identified in Article 6(1) of the GDPR. Articles 5(1)(a) and (b) of the GDPR were, therefore, breached for the following reasons:
- Ms Ali repeatedly made clear the importance she attached to anonymity. Ms Ali was assured she would remain anonymous.
- A witness for the Police accepted crime reports were sometimes filed with the relevant individuals identified as the “reporting party”. The same witness said he was not required to consider this under relevant procedures and did not do so.
- The Police failed to show why Ms Ali’s identity had to be disclosed to evidence credibility of the report.
- The Police failed to show that anonymisation of the report would have affected the quality of the information it contained.
- The Police failed to show that, even if the report had been anonymised, it would have been obvious Ms Ali was the reporting party.
Misuse of private information, breach of confidence, and the HRA
Ms Ali had an expectation of confidence because she was given assurances of anonymity and the information reported was of a private nature. Ms Ali’s reasonable expectation of privacy was not outweighed by countervailing interests. The Police, therefore, had misused her private information. For the same reasons, a claim for breach of confidence was also established, and the Police had also breached section 6 of the HRA.
CAUSATION AND QUANTUM
The High Court concluded that Ms Begum’s criminal disclosure to Ms Ali’s ex-husband broke the chain of causation. This criminal disclosure rendered the Police’s earlier breach merely part of the history of events. The High Court held, however, that the Police should not escape liability altogether. Even if Ms Begum’s criminal disclosure had not taken place, Ms Ali would still have suffered some distress had she been informed her identity was disclosed to Council.
Ms Ali was awarded compensation for distress under the GDPR of GBP3,000. The High Court noted this as an award in the bottom half of the range of awards for “less severe psychiatric harm” in the Judicial College Guidelines for the Assessment of General Damages in Personal Injury Cases (16th ed.).
If the GDPR claim had failed, Ms Ali’s private information was nonetheless misused, and she would have been awarded GBP3,000 in respect of the loss or diminution of the right to control the use of private information, independently of any distress. If necessary, the High Court would have awarded GBP3,000 for breach of Ms Ali’s rights under Article 8 ECHR/section 6 HRA.
COMMENT
The decision in Lloyd -v- Google Inc2 that “not everything that happens to a person without their prior consent causes significant or any distress” led to a reappraisal in the claimant data breach sector as to the viability of innocuous data breach claims. Ms Ali's claim arguably represents a restatement of Lloyd and similar authorities (such as Rolfe3 and Driver4), that for damages for distress to be awarded, real, demonstrable evidence of distress must be evidenced.
Notwithstanding the circumstances of Ms Ali's case, compensation of GBP3,000 was considered appropriate, being an award at the bottom half of the range of awards for “less severe psychiatric harm”. This was despite the safeguarding context where the claimant repeatedly asked for the information to be anonymised and believed disclosure would put her and her children at risk. The High Court’s willingness to award Ms Ali a greater sum may, however, have been tempered by the fact that the chain of causation was broken by Ms Begum’s criminal acts5.
1[2023] EWHC 938 (KB)
2[2018] EWHC 2599 (QB) & [2021] UKSC 50
3Rolfe & Others -v- Veale Wasbrough Vizards LLP [2021] EWHC 2809 (QB)
4Driver -v- CPS [2022] EWHC 2500 (KB)
5Ms Begum pleaded guilty before the Luton Crown Court to an offence under section 1 of the Computer Misuse Act 1990 and was sentenced to 3 months’ imprisonment, suspended for 12 months, and 150 hours of community service.
