CA-2024-000578 - [2025] EWCA Civ 1117

The next issue is whether some of the appellants have failed to plead a case of actionable damage. Mr Sharland submitted that on the true construction of the GDPR and DPA compensation is not recoverable for emotional responses other than distress. The claim of any appellant whose individual schedule failed to assert distress should therefore be dismissed. Mr Sharland identified 34 such appellants, being those who had pleaded that they (i) would not describe the feelings they suffered as distress; (ii) did not suffer distress; (iii) considered distress too strong a word to describe their experience, or said that they were too resilient to have suffered distress; and/or (iv) confine their pleading to “stress” as distinct from “distress”. In support of this submission Mr Sharland relied on the language of s 168(1) of the DPA.

In my judgment this submission is too stark and formalistic. I think there is much to be said for the view that compensation is not available in respect of (to adopt Mr Knight’s terminology) “all emotional responses to an infringement”. I shall come back to that. But I can see no justification for confining the right to compensation in the way suggested in this part of the respondent’s argument.

The governing provision is Article 82, which refers to “non-material damage” without limitation. Section 168(1) of the DPA tells us that this term “includes distress” but it is plain that this is an illustrative point. Section 168 does not purport to define or limit the scope of the term “non-material damage” in Article 82. Indeed, it seems clear that Parliament’s aim in enacting s 168(1) was not to limit the ambit of the right to compensation but rather to confirm its breadth. Notoriously, section 13(2) of the 1998 Act, which restricted the right to compensation for distress, had to be disapplied for incompatibility with Article 23 of the parent Directive: Vidal-Hall v GoogleInc [2015] EWCA Civ 311, [2016] QB 1003. It would be understandable for Parliament to make clear that it was not committing the same error in the 2018 Act. The Explanatory Notes to the DPA appear to confirm this was the aim, stating (at paragraph 481) that the right conferred by Article 82 “is broadly equivalent to section 13 of the 1998 Act, with the exception that the type of damage that can be claimed is broader...”.

In addition, it seems to me that Mr Sharland’s argument depends on an unjustifiably narrow interpretation of the term “distress”. In English law this term is not usually deployed to distinguish between forms or degrees of emotional harm. It is typically, and most commonly, used as an umbrella term for various forms of emotional harm (including, for instance, stress and anxiety) to distinguish harm of that kind from material damage (as in s 13 of the 1998 Act) or from other kinds of intangible loss (such as “loss of control”). The point is reflected in paragraph [92] of Lloyd v Google where Lord Leggatt observed that “The term ‘material damage’ is sometimes used to describe any financial loss or physical or psychological injury, but excluding distress (or other negative emotions not amounting to a recognised psychiatric illness)”.

In any event, our approach to the Regulation should not become bogged down in arguments about the meaning of “distress” in domestic law. We should have regard to the language of the GDPR, which is part of our law for this purpose. This includes the Recitals which state, among other things, that the kinds of “material or non-material damage” that a person may suffer as a result of a personal data breach include “limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage ...” (Recital (85)). All of this is clearly at odds with Mr Sharland’s submission. The Recitals also state that “The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice” (Recital (146)). We should therefore have regard, at least, to the way the CJEU approaches compensation for “non-material harm” in the context of the GDPR.