Contributors
The judgment in the case of Driver v Crown Prosecution Service [2022] EWCH 2500 (KB) is useful guidance for the quantum the court will award for distress in data claims, awarding £250 in this claim. Interestingly, the court also takes an objective view when assessing the claimant's distress.
Background
The claimant is a local councillor and a well-known figure in Lancashire politics. In 2014 he was investigated as part of a local government corruption investigation, Operation Sheridan. In March 2016 he was excluded from the investigation and no longer a suspect but was later investigated in 2017 regarding allegations of perverting the course of justice. In 2018 Lancashire police referred the Operation Sheridan file to the CPS for their consideration regarding whether to bring charges against the eight individuals (including the Claimant) that were the subject of Operation Sheridan. At the time, this development was reported in the press and the claimant and seven other suspects were expressly linked to the Operation.
In June 2019, a member of the public who had 'an axe to grind' about the Claimant contacted the CPS regarding the investigation. The CPS responded confirming that 'a charging file' had 'been referred from the Operation Sheridan investigation team to the CPS for consideration'. The member of the public then wrote to general election candidates including political opponents of the Claimant, and also wrote to journalist Jeremy Vine and to another journalist regarding the ongoing investigation into the Claimant.
The Claimant brought a claim against the CPS for breach of UK GDPR, the Data Protection Act 2018 (DPA) and Article 8 of the European Convention on Human Rights (ECHR) as a result of the CPS sharing his personal data with the member of the public.
Decision
Justice Knowles decided that:
- Personal data: The information disclosed by the CPS did amount to the Claimant's personal data 'as it indirectly allowed him to be identified as one of the people in relation to whom a file had been sent to the CPS for a charging decision' (para 101). The 'mention of Operation Sheridan in the email was an 'identifier'' to which the Claimant was linked. Justice Knowles went on to say that 'Personal data can relate to more than one person and does not have to relate exclusively to one data subject, particularly when the group referred to is small' (para 101).
- DPA unlawful processing: The processing of the Claimant's personal data, namely the sending of the email by the CPS to the member of the public, was found to be unlawful as the CPS 'failed to show the disclosure' of the personal data 'was necessary' (para 115). There was no social need 'for this member of the public, on this occasion, to be updated about the case' (para 116).
- Misuse of private information: The court did not uphold the Claimant's claim for misuse of private information in Article 8 of ECHR. The Claimant had made a public statement about the ongoing investigation, so there was no expectation of privacy over the information that the CPS were considering a charging decision in relation to the Claimant (para 147). The Claimant had 'failed to show that he objectively had a reasonable expectation of privacy in relation to the relevant information' (para 159).
- Distress: Regarding the claim for breach of the DPA 2018, when considering the damages to award for the Claimant's alleged distress, Justice Knowles stated that it was not reasonable for the Claimant 'to fear from the June email that 'formal charges were likely to be brought'' against him (para 167). The judge also stated that 'on no reasonable view could it be regarded as representing a 'significant development'' in the investigation against the Claimant as was alleged by the Claimant. Justice Knowles has therefore appeared to apply an objective element by deciding what distress was reasonable for the Claimant to have allegedly suffered.
- Damages: Damages of £250 were awarded as 'this data breach was at the lowest end of the spectrum' (para 169).
Objective measure of distress in data claims?
One reading of the decision is that the Court appears to have applied an objective assessment of the distress it was reasonable for the Claimant to have suffered. The exact wording of the Judgment is not clear and this may in fact be Justice Knowles rejecting the Claimant's evidence regarding his alleged distress as not being credible, but that is not the way this has been worded in the judgment.
The Judges says:
- I am unable to accept the Claimant's evidence about the effect he said the emails had upon him and his characterisation of them, and what he said they had led him to believe, especially in [6]-[8] of his witness statement, which I set out earlier. On no fair reading did they suggest that he would be charged. Nor was it reasonable for him to fear from the June email that 'formal charges were likely to be brought against me'. On no reasonable view could it be regarded as representing a 'significant development' or a 'significant change'. As I have explained, whilst it was a breach of the DPA 2018, the email did no more than repeat that which had been in the public domain since August 2018. If seeing the words 'charging decision' did come as a surprise to the Claimant, that was through his own fault because, as I have said, he turned his face away from the obvious when the announcement was made by the police and CPS in August 2018, and he did not take the advice which he could easily have taken.
- I am prepared to accept that the Claimant would have experienced a very modest degree of distress upon discovering that the CPS's email had been sent to political opponents and the media by someone who had a grievance against him in an effort (as I find) to embarrass him. But for the reasons I have given I reject his evidence that it represented some fundamental sea-change in the complexion or likely outcome of Operation Sheridan, such that it could reasonably or properly have caused him anything like the level of anguish which he claimed. I accept he consulted his GP in 2020 as he said, but I am unable to conclude this was as a result of the emails rather than, for example, of the stress of having been under police investigation, by then, for six years or so. Ms Khan accepted that this was not a personal injury claim, and that there was no medical evidence. There is also the point made by the Defendant that the Claimant's own evidence was that he had been suffering from anxiety and depression since his arrest (emphasis added).
The judgment, in this case, seems to go against the principle of 'take your victim as you find them' or the 'eggshell skull' rule, whereby the frailty of the claimant is not a valid defence to the seriousness of any harm caused. This would bring in a defence against claims by those who are particularly sensitive to privacy issues or have personal circumstances resulting in them suffering a level of distress much higher than would objectively be expected.
WBD Cipher
When dealing with a claim for an alleged breach of data, these claims often cost more in legal fees to deal with than the value of the claim. Due to the nature, volume and pattern of these types of low-value data claims, we have developed a product: WBD Cipher. This is a cost-effective way of dealing with data claims. If you would like more information about WBD Cipher please do contact us.
