Contact us today - 0330 094 9338

Clarity for organisations facing data breach claims

The little trodden path of data breach claims is a little clearer thanks to a judgment made on 16th November 2021 following a hearing in the High Court in the case of Johnson -v- Eastlight Community Homes Ltd.

Summary

The case centres around a data breach which occurred on 1st September 2020 when social housing provider Eastlight Community Homes Ltd sent an email attachment to a third party. The Claimant, Ms Johnson, was one of its tenants and the attachment inadvertently included her name, email address, and details of recent rent payments she had made. The details were on pages 880-882 of a 6,941 document and the error was immediately picked up by the recipient, who alerted the Defendant and deleted it within 3 hours of receipt.

The Defendant e-mailed the Claimant on 20th September 2020 to inform her of the incident, the fact that the recipient had deleted the information, and that the breach had been reported to the Information Commissioner’s Office (“ICO”) who subsequently confirmed that no enforcement action would be taken.

On 15th March 2021, the Claimant issued proceedings in the High Court, seeking damages limited to £3,000 for “Misuse of Private Information, Breach of Confidence and Negligence, together with damages for breach of Article 8 ECHR rights as incorporated in the Human Rights Act 1998, as well as damages pursuant to Article 82 GDPR and damages pursuant to section 169 of the Data Protection Act 2018.”

The High Court struck out all elements of the claim except for the claim for the breach of the GDPR and raised concerns that the High Court was being asked to consider a claim that was only worth £3,000, and thereby choosing to transfer the claim to the County Court to be dealt with on the small claims track.

Comment

The case provides much needed clarity for data controllers in what is still a relatively untested area of law. Clearly, all organisations should do their utmost to avoid data breaches of any kind. However, controllers will now have more confidence when it comes to settling cases.