In the English common law there is no freestanding right to privacy. Privacy claims come within a number of different causes of action: misuse of private information, breach of confidence, breach of the Data Protection Act 1998 (‘DPA’), breach of the Human Rights Act 1998 (‘HRA’), and breach of the Protection from Harassment Act 1997.
Until recently, a claim under the DPA could only be brought where there had been a resulting financial loss, unless the narrow conditions set out in section 13(2) were met. The Court of Appeal in Google Inc v Vidal-Hall & Information Commissioner [2015] EWCA Civ 311 found that section 13(2) cannot be read compatibly with Article 23 of Directive 95/46/EC and it has been struck down. This means that all damages, including non-pecuniary damage, can now be claimed for under the DPA.
In Gulati & Others v MGN Ltd [2015] EWHC 1482 (Ch) – see my podcast – Mr Justice Mann awarded the highest ever sums for damages in a privacy claim in the U.K. The claimants were victims of phone hacking and blagging by journalists working at MGN’s newspapers. They had brought claims for misuse of private information. The methodology Mr Justice Mann applied, approved by the Court of Appeal, means that it is possible to recover damages simply for the loss of control of private information.
In TLT v Secretary for Home Department [2016] EWHC 2217 (QB) the claimants brought claims under the DPA and for misuse of private information. The Home Office had published, by mistake, raw data relating to families applying for asylum. The data included personal information such as names, approximate geographical locations, ages and nationalities. The data was available online for 13 days before it was removed.
Mitting J did not apply the methodology in Gulati on the basis that this was not a case involving deliberate dissemination of private information for financial gain. Instead, whilst taking into account the loss of control of private information, Mitting J assessed the distress of the claimants in line with psychiatric injury caused by an actionable wrong, using the brackets set out in the Judicial College Guidelines (‘JCG’).
The JCG determine the levels of general damages awards in personal injury cases by specific injury. Of note however, is the fact that none of the claimants suffered from a recognized psychiatric disorder as a result of the posting of their personal data.
Damages awards under the HRA are low and claimants tend to rely on other causes of action in privacy claims, although often the HRA will be included. Finally, harassment claims are generally at the more serious end of the spectrum of invasion of privacy and can, in certain circumstances, amount to criminal behaviour. Therefore to some degree these sorts of claims stand apart from privacy claims.
Harassment claims are assessed in line with the Court of Appeal guidance in Vento v Chief Constable of West Yorkshire Police [2002] EWCA Civ 1871. Three distinct bands were outlined in Vento[1]: up to £6,000 for isolated or less-serious cases, between £18,000 to £30,000 for serious cases involving a lengthy campaign of harassment, and between £6,000 and £18,000 for those cases falling inbetween.
As can be seen, quantifying damages for breach of privacy is no straightforward matter and the court’s approach to awards is still developing. As ever, awards will be fact specific. Putting a figure on distress will always be problematic given the subjective nature of injury to one’s feelings. It may be that over time, what will emerge may be specific levels, not unlike those set out in Vento and the JCG.
If you are interested in any further information or advice, please contact my clerks on 020 3179 2023 or privacylawbarrister@proton.me
privacy law barrister 