A spectre is haunting data controllers – the spectre of group liability for data breach.
In Vidal-Hall v Google [2015] EWCA Civ 311 the Court of Appeal held that damages claims under section 13 of the Data Protection Act 1998 (DPA) can be brought on the basis of distress alone, without monetary loss. Since that decision there has much speculation that a major data breach could lead to distress-based claims against the data controller by a large class of individuals. Even if each individual claim was modest (in the hundreds or low thousands of pounds) the aggregate liability could be substantial.
Cases of this nature may give rise to important questions of public policy. Often the data controller will themselves be the victim of malicious or criminal conduct, involving a hack by outsiders or a data leak by insiders. In such situations, should the data controller be required to compensate data subjects? What if the very purpose of the hack or leak was to damage the data controller, so that by imposing civil liability on the controller the Courts would help further that purpose?
The recent decision of the High Court in Various Claimants v Wm Morrisons Supermarket PLC [2017] EWHC 3113 is the first significant case to grapple with these issues post Vidal-Hall. The case involves a group claim brought by some 5,500 Morrisons’ employees in connection with the criminal misuse of a significant quantity of payroll data by a rogue employee. In a lengthy judgment handed down on 1st December 2017, Langstaff J found that Morrisons were not directly liable to the claimants in respect of the criminal misuse of the data, whether under the DPA or at common law, but that they were nevertheless vicariously liable. The trial dealt only with liability: quantum remains to be determined.
11KBW’s Anya Proops QC and Rupert Paines acted for Morrisons. Continue reading