Compensation awarded for misuse of data processing powers

In my post on the TLT case last week, I mentioned a second recent judgment awarding compensation for a DPA breach. This is the judgment of the Central London County Court (HHJ Luba QC) in Andrea Brown v Commissioner of Police for the Metropolis and Chief Constable of Greater Manchester Police (judgment available via Inforrm here).

Whereas TLT concerned a data breach (accidental public disclosure), Brown concerned the unfair use of policing powers to obtain information for an employment disciplinary matter. The Court awarded £9,000 in compensation, arising as follows.

Ms Brown was a police officer with the Met. In late 2011, she went to Barbados with her daughter while on sickness absence, without notifying her employer. The Met contemplated disciplinary action. It gathered information about Ms Brown’s movements, including by requesting from the National Border Targeting Centre, which is run by Greater Manchester Police. In response to the Met’s queries, the Centre provided information about the movements of Ms Brown and her child, including travel agency and booking information and details of flights taken over the previous six years. In the end, only informal employment action was taken against Ms Brown.

She brought claims against both forces. Liability under the DPA and Article 8 ECHR were conceded: the Met should not have asked for this information, and GMP should not have provided it. They had used powers conferred for policing purposes in an almost ‘cavalier’ and ‘casual’ fashion for employment-related purposes.

The Court decided that this was an appropriate case for awarding compensation. There had been more than one contravention. The contraventions were not inadvertent or technical. They also involved misusing private information about a child.

The Court’s approach to quantum is notable. Under section 13 DPA, it was satisfied that Ms Brown had suffered distress, but not damage in the sense of any recognised psychiatric injury. Ms Brown’s evidence about the effects on her health were found to be inaccurate and grossly exaggerated, but the Court accepted the she suffered anger, upset and shock.

The Article 8 breach did not add anything in quantum terms to the DPA breach. But what about the tort of misuse of private information? This was pleaded, disputed and resolved in Ms Brown’s favour. Could that add anything to the size of the award? Answer: yes. Damages awards for that tort encompassed hurt feelings and loss of dignity and control over one’s private information (see Gulati). The common law goes further than the DPA in this respect.

The Court was not persuaded, however, that in such a case, awards should start at a minimum of £10,000. It awarded Ms Brown £9,000, two thirds of which was payable by the Met.

The Court also rejected the claim for aggravated damages. Lastly, it dismissed the claims for declaratory relief (which would serve no purpose here) and for rectification under section 14(4) DPA (even if Ms Brown had suffered damage, there was no reason to fear a repeat of the contravention).

Robin Hopkins @hopkinsrobin