GDPR claims and (un) reasonable costs
04 January 2022
It is well known that where a data breach has occurred an individual is entitled to claim compensation for damage caused by the breach, including any distress suffered. The entitlement to claim for distress has resulted in a trend of low-value data breach claims (£2000.00- £3000.00 claims) litigated and placed in the fast/multi track with the Courts resulting in entitlement to reasonable costs, claimed at sometimes £30,00.00 or more- some may call this unreasonable.
In the case of Johnson v Eastlight Community Homes Ltd [2021] EWHC 3069 (QB), Master Thornett handed down a judgment which has huge ramifications for the manner in which low-value data breach claims, as described above, should be brought. The case outlines that while low-value data breach claims can still be brought they must be simplified and seen in the Small Claims Track of the County Court in order to control costs. The small claims Court is subject to fixed costs.
The facts of this matter were clear-cut. The Defendant had accidentally sent an email to a third party containing a collection of rental statements pertaining to a group of its customers, a mistake made by many a business. The Claimant’s data was on pages 880 – 882 out of the 6,941 pages. The third party and sole recipient immediately notified the Defendant and took steps to remedy the breach within 3 hours, confirming that the email was deleted. A claim was issued with damages capped at £3,000 and had an estimated budget for costs in excess of £50,000.
Master Thornett stated that the case had “all the hallmarks of a Small Claims Track claim that should have been issued in the County Court and so allocated”. This is significant as it means that only very limited fixed costs can be claimed by the Claimant for the whole claim.
In a final observation, Master Thornett stated that no “serious privately paying litigant would contemplate spending over £50,000 in costs, not all of which may prove recoverable even in the event of success, and similarly expose themselves to the risk of significant adverse Costs Order following High Court litigation if unsuccessful, for a damages claim less than £3,000” and that the manner in which the case was processed was a “form of procedural abuse”.
In this ruling the common tactic of inflating the complexity of a data breach case to advance costs was seen through and it was judged that cases such as these should be allocated to the Small Claims Track in the County Court.
Conclusion
If you find yourself/company as a possible party in a low-value data breach claim, whether that be because you receive a letter of claim or some sort of indication that you may receive a claim of this nature, it is advisable that you act promptly and a letter is drafted and sent to the other side stating that where a claim is issued, the letter will be relied on to argue that the matter should be allocated to the Small Claims Track at the County Court. It may also be advisable, dependant on the circumstances, to make an offer at the outset by way of Part 36 to restrict recovery of inflated costs.
If you receive a claim of this nature and want to discuss please contact the Dispute Resolution team on 01254 828300.
