This week, Google has been granted permission to appeal to the UK Supreme Court as part of the decision in Google Inc. v. Vidal-Hall & Others (2015). This is about rights to claim compensation for breaches of the Data Protection Act.
Compensation rights are defined in Section 13 of the Data Protection Act. Section 13 permits individuals to claim compensation for (i) damage; or (ii) damage and distress (but not, generally, distress alone).
Earlier this year the Court of Appeal, in this case, ruled that individuals could claim compensation for “mere distress”. This potentially opened the door to the risk of mass claims for data privacy breaches. Imagine you have a large data breach and this affects a few thousand, hundred thousand or even a million customers. If each can claim a small sum for associated distress (pretty easy to do!) this adds up to a big liability. This risk applies to any breach of the Act and isn’t limited to organisations that use cookies to track individuals as in the Google case.
We expect the Supreme Court to hear this some time early next year. We will keep you posted on developments.
For more info, here’s the Supreme Court post: https://www.supremecourt.uk/news/permission-to-appeal-decisions-28-july-2015.html
…