KA-2024-BRS-000027 - [2025] EWHC 2919 (KB)

Background

Ms Baker had made a counterclaim against Saxby in relation to a specific incident of unauthorised disclosure of some of her financial data by a member of Saxby’s staff, Mr Russell, to a third party, a Mr Jones.

Ms Baker and Mr Jones were in an acrimonious and multifaceted neighbours’ dispute. That dispute was in turn connected with (a) litigation conducted by Ms Baker in the First Tier Property Tribunal against a property management company and (b) Mr Jones reporting Ms Baker to the Bar Standards Board.

Ms Baker’s counterclaim was originally pleaded by reference to section 55 of the Data Protection Act 1998 (which deals with the unlawful obtaining of personal data) and section 10 of the Data Protection Act 2018 (which sets out certain special categories of personal data). Her last pleading appears in her amended counterclaim dated 26^th April 2022, in which she claims ‘compensation for distress caused by the Claimant’s breach of the Data Protection Act 1998’. The defence appears to have been a simple denial of the fact that Saxby was responsible for any third-party disclosure as alleged.

The Judge found as fact that Mr Russell had disclosed to Mr Jones (a) Saxby’s position that Ms Baker was in debt to it to the extent of a six-figure sum, (b) she was in default and (c) legal proceedings were afoot. There is no challenge to those findings in this appeal or in Ms Baker’s application for permission to appeal

The Decision Challenged

The Judge’s decision on quantum of damages was as follows:

[138] The disclosure and its weaponising by Mr Jones to the BSB must have been really quite upsetting for Ms Baker in the position she was in with him and others at Leamington Court. Mr Jones was engaged in what seems to have been a rather spiteful campaign against Ms Baker, no matter how difficult she may have been acting (and I accept that she appears to have the capacity to be forceful and awkward). This information would have undermined Ms Baker’s position in the human dispute with Mr Jones et al and the legal dispute with the management company, perhaps by providing Mr Jones with mental ammunition and possibly leverage in any negotiations.

[139] The store by which Ms Baker put this issue reflects that she felt strongly about it, but I accept Mr Browne’s submissions that what Mr Jones chose to do with the information obtained from the Claimant is not the Claimant’s direct responsibility. However, it is just this third party abuse of disclosed information that the legislation seems aimed at meeting: information that a third party would not normally have and which can be used against the victim. On the authorities cited by Mr Browne, the level of compensation in these cases is modest to say the least. This case is not anywhere near as serious as Ali, though it does pass the de minimis threshold referred to in Rolfe. I award Ms Baker £1500 on the Counterclaim in respect of the data disclosure which will be offset against the sums I find to be due to the Claimant in the claim.

Ms Baker wishes to make a challenge that the sum of £1,500 is ‘wrong’ because it does not represent adequate compensation for the breach. She explains this by a wide-ranging set of criticisms of the Judge’s decision, including breaching her human rights, errors in fact-finding and evaluation, and failure of reasoning.

Consideration

The Judge’s finding of Saxby’s liability to Ms Baker on her data protection counterclaim is not in dispute in this appeal. However neither the pleading of the counterclaim in data protection, nor the part of the judgment dealing with liability in the counterclaim, identifies with any clarity the provision(s) of the potentially relevant legislation which were said to have been breached. The originally pleaded references to provisions dealing respectively with the unlawful obtaining of personal data and with special categories of personal data have no obvious relevance to her counterclaim. Her case against Saxby necessarily related to its disclosure of personal data (rather than Mr Jones’s obtaining of it), and financial data is not among the categories of special data. Her final pleading of breach of the Data Protection Act 1998 is wholly unparticularised.

If it is not clear what precise contravention of that Act was being alleged, it is however clear what she was not pleading. She was not pleading the torts of either breach of confidence or misuse of private information by Saxby.

The necessary inference from the Judge’s finding of liability, on the pleadings such as they were and on the findings of fact he had made, was that he was holding Saxby liable for the disclosure of the three pieces of information specified, as constituting the unlawful processing of personal data by a data controller, in breach of one or more of the data protection principles.

Ms Baker’s pleading did not seek to quantify her damages claim. In her submissions to the trial court and before me, she sought to make comparison with decided cases (such as Sir Cliff Richard OBE v BBC [2018] EWHC 1837 (Ch))in which data protection infringements had been alleged, and substantial (six figure) awards of damages made. But there are two obvious problems with claimed analogy with cases like these. First, none of them was a case in which data protection was the only, principal, or even material source of the liability found; these were principally misuse of private information cases in which, as is common practice, breach of data protection law is added for completeness. And second, none of them was realistically comparable on the facts.

The Judge found Mr Russell to have made the disclosures he did because ‘he may not have had the training and awareness that Mr Martin states that he and his staff have’. He accepted Mr Russell did not act out of malice. Bearing in mind the elevated evidential standard required for any finding of the latter, these were plainly findings which were properly open to the Judge on the materials before him. We are left then, from the perspective of Saxby’s obligations as a data controller, with the unwarranted disclosure of three headline facts, or items of personal data, to do with its dealings with Ms Baker, to someone who was hostile to her. That is not an insignificant matter. The Judge acknowledged as much, and had regard to the direct impact of the breach in the disputatious context into which the personal data was wrongly disclosed.

But I do not consider it arguable that the award of damages he made was on the face of it ‘wrong’ in these circumstances. There is no arguable indication that he misdirected himself, or was misdirected, on such authorities as there are on quantum of compensation in pure data protection claims. These authorities do indeed indicate modest awards in the very low thousands, and neither the Judge’s attention nor mine was drawn to authorities on properly comparable factual matrices suggesting a pattern of awards with which the Judge’s here could be argued to be out of line.

The specific case to which the Judge himself referred in his judgment was Ali v Chief Constable of Bedfordshire [2023] EWHC 938 (KB). That was a claim in data protection, misuse of private information, breach of confidence and ECHR Art.8. The Judge was entitled to find its factual matrix (disclosure by the police of a complainant’s criminal allegations against her former husband to the man in question, causing the complainant fear for her safety, and diagnosed psychological harm up to and including suicidal ideation) much more serious than that before him. The successful claimant in Ali was awarded £3,000 in damages for distress.

I do not consider it properly arguable in these circumstances that the Judge’s decision proceeded on the basis of error of law, defective findings of fact or improper discretionary evaluation. The Judge might have made a higher award, but I do not consider it arguable that he had to. The Judge might also, after all, have rejected the counterclaim for deficient pleading of the legal basis for the data breach complained of, in the first place. But he took a fair and pragmatic view of that at trial, made a finding of liability which is not challenged, and made a compensation award which I cannot find to be defective or inadequately explained or explicable in its own terms. If Ms Baker had pleaded other heads of liability and/or joined Mr Jones in her counterclaim then the outcome might conceivably have been different – but that would have meant a very different kind of trial, and its possible outcomes must remain in the realms of speculation.

I am not in these circumstances prepared to give permission for Ms Baker’s proposed appeal. I would inevitably have held it to fail on its merits.