What firms do YOU trust with your data? Plus, how to claim compensation if it is leaked

This is Money asked James Quartermaine, legal director at commercial law firm Doyle Clayton, how easy it is to get redress if your information is leaked. 

What options are available to me if my data has been leaked?

James Quartermaine says: ‘Where a company has failed to take adequate steps to secure your personal data, and that data has been leaked as a result of a data breach, the UK GDPR gives you the right to claim compensation for “material damage” if you have suffered financial loss and “non-material damage” where you have suffered distress.

All relative: James Quartermaine says the amount you might be entitled to is dependent on the distress caused

‘In some instances, you may be able to agree suitable compensation with the organisation responsible for the breach, but if that is not possible you may have to consider going to court.’

Quartermaine added that you can complain to the Information Commissioner’s Office, which he said could see regulatory or financial action taken against the data controller. 

‘While the ICO has draconian powers to impose fines on companies who have failed to take proper care to protect personal data, it does not have powers to award you financial compensation as a victim of the breach,’ he said.

How will I know if my data has been leaked, and by which company?

‘The onus is on the company responsible to get in touch with you,’ Quartermaine says. ‘Where companies become aware that they have suffered a data breach that poses a high risk to the rights and freedoms of individuals they have a duty to inform those affected without undue delay.’

According to Quartermaine, firms should provide the details of their data protection officer, as well as the possible consequences of the data breach in question, and the action they plan to take to reduce adverse effects.

‘This should include advice on steps you can take to protect yourself and details of any assistance that they are prepared to offer you,’ he said.

What compensation am I entitled to?

‘There is no one-size fits all approach to assessing compensation, and the precise amount will often be highly dependent of the facts of each individual case,’ Quartermaine says.

‘Much will turn on the sensitivity of the data that has been leaked. For instance, a leak of medical information or sensitive information relating to children will usually attract a higher level of award.

‘Where you can prove that you have suffered financial loss as a direct result of the breach you can claim for that loss.

‘However, in many cases people will not be able to prove direct financial loss but will instead be looking to recover compensation for the distress, anxiety or frustration they have suffered.

‘Damages for distress alone have traditionally not attracted large awards of compensation and the UK courts have taken the approach that a threshold of seriousness must be crossed before any compensation can become payable. Judges have been increasingly willing to strike out “trivial” data claims that do not cross the threshold of seriousness.’

Is it worth the effort?

 The amount that you can receive as a result of a claim is dependent on the extent of your suffering as a result of the leak. And, according to Quartermaine, this is assessed relative to other case types where suffering is involved. 

‘In assessing damages for distress in data breach cases judges bear in mind the level of awards made for psychiatric or psychological injury in personal injury cases to ensure that any award is not disproportionate to the amounts awarded there,’ he says. 

‘Previous case law suggests that the starting point for an award for distress alone in data cases at the lower end of the ‘seriousness’ spectrum may be in the region of £750 -£1,000.’

‘In such cases claims will ordinarily be allocated to the small claims track of the County Court. Obviously where there are aggravating factors and evidence of serious distress or psychological impact on an individual the awards will be much higher.’

However, that is not to say that it is not worth making a claim, especially if your finances have suffered. 

‘If you have been the victim of a data breach and you can show evidence that it has caused you significant distress or financial loss then you are likely to have the basis of a successful claim for compensation. 

‘If you cannot agree compensation with the data controller then you may have to consider litigation, but any litigation can be stressful so seeking specialist legal advice before you do so is highly recommended,’ Quartermaine says.