Yet another blow to claimants in low value attritional data breach claims

21 Apr 2022

In William Stadler v Currys Group Limited [2022] EWHC 160 (QB) (a judgment given at the end of January 2022) the High Court struck out elements of a claim for misuse of private information, breach of confidence, negligence and breach of data protection legislation and transferred the balance of the claim to the County Court (where it indicated that the matter should be allocated to the small claims track).

Details

The claim concerned a television bought by the claimant from Currys which allowed the user to access third party apps, one of which was Amazon Prime. The claimant returned the TV for repair in September 2020. Although the TV was faulty it was still possible for a user to log out from any apps; the claimant was not asked to clear or remove any apps and was told to pass the TV to Currys' employees.

As you may anticipate from the above, the claimant failed to log out of his Amazon Prime app. Currys decided that it would be disproportionate to repair the TV; it offered to write it off and compensate the claimant with a voucher. He agreed and his understanding was that the TV would be destroyed. In fact, Currys sold the TV to a third-party company without performing a factory reset or data wipe.

Subsequently (in December 2020) someone used the claimant’s Amazon account to purchase a film for £3.49. The claimant raised this with Currys who reimbursed him. In January 2021 Currys contacted the claimant again to make sure that he had changed his passwords for Amazon and any other apps. The claimant confirmed that he had done so. Currys provided the claimant with a £200 shopping voucher as a gesture of goodwill.

The claimant brought a claim for damages for up to £5,000 for misuse of private information, breach of confidence, negligence and breach of data protection law and also sought an injunction requiring Currys to act in accordance with UK data protection legislation and a declaration that it had breached Article 5 of the UK GDPR.

Currys applied to strike out the claim on the basis that (i) it disclosed no reasonable grounds for bringing a claim; (ii) given the compensation already provided the only outstanding issue was the distress purportedly caused to the claimant during the short period in which he realised his accounts had not been logged out (which Currys said was “not worth the candle" and should be struck out) and (iii) the claimant had no reasonable prospect of success.

The Arguments Explored

The claimant resisted that application, arguing that there were areas of factual uncertainty that needed to be determined at trial including what information about the claimant was stored on the TV, whether the claimant told Currys at the outset that he had reset the TV, whether the repairs undertaken were subject to Currys’ terms and conditions; and the basis upon which the claimant had agreed that Currys could dispose of the TV and the terms on which matters were concluded.

The letter of claim alleged that the TV contained “vast amounts" of personal/financial and sensitive information belonging to the claimant. This was reiterated in a witness statement served by the claimant's solicitors (Irvings, who we come across often).  However, the claimant's pleaded case was narrower and simply that the information included his name, “account details” for several apps or accounts (the pleaded case was unclear as to what was meant by that) and payment details in respect of those accounts.

In addition, the judge noted that the claimant's case in relation to damages had also been inconsistent. The letter of claim said that the claimant had suffered psychological injury/ discomfort/distress/inconvenience/damage, whilst the witness evidence served by the claimant’s solicitor subsequently confirmed that when the claimant discovered that a film had been purchased on his account the claimant was “surprised and concerned". The particulars of claim stated that the claimant had suffered psychological distress, anxiety, loss and damage and that the distress and anxiety had been exacerbated due to the sensitive personal and financial nature of the data processed by Currys and accessed by a third party.

In many cases of this nature the claimant's solicitors assert that the court rules (in particular the Practice Direction that accompanies Part 53 of the Civil Procedure Rules) require such claims to be issued in the High Court.  The judge helpfully stated that “PD [Practice Direction] 53b only applies to cases in the MAC [Media and Communications] list.  It does not apply to cases in the County Court, even if they include causes of action that would be allocated to the MAC list if in the High Court.". This reinforces a view that we have been expressing to claimant solicitors for some time.

The Decision

The judge said that he was not satisfied that he should grant summary judgment on the basis that:

1. Further factual information was needed to evaluate the extent of the Currys’ duties to the claimant under data protection legislation, in particular in relation to what was said when the device was handed over, when it was agreed it would be scrapped and what terms and conditions applied to the repair and subsequent disposal of the TV.

2. The data protection claim had a reasonable prospect of success. On the basis of the claimant's account, it seemed that Currys would or should have been aware that there was personal data on the device, and it was arguable that it had duties as a data controller (particularly if at any point it became the owner of the TV). If it was the data controller it would have been under obligations in respect of the disposal of data (under Article 7(2) of the GDPR).

The judge did, however, agree that the claim was unquestionably of low value and was concerned that it would be disproportionate to allow such a claim to be litigated in the High Court with all of the costs that this entailed. He indicated that if the claim was one that could not be transferred to the County Court and the small claims track (for example, if it had been a claim for defamation) this would have been a good reason for striking it out on the grounds that the claim was “simply not…worth the candle". However, since the claim could be transferred the judge concluded that it could be managed in a way that was proportionate to its value through allocation to the small claims track.

Going on to consider the claims for misuse of private information and breach of confidence, the judge concluded that much of the reasoning in Warren v DSG Retail Limited (in which Mr Justice Saini transferred a data protection claim to the County Court and struck out claims for breach of confidence, misuse of private information and negligence) was of application in Stadler (we discuss Warren here - https://www.blmlaw.com/news/high-court-deals-blow-to-claimants-in-low-value-attritional-data-breach-claims).

The judge said that the claimant had not pleaded his privacy claim adequately (simply asserting that the information concerned was information in relation to which he had a reasonable expectation of privacy without setting out the facts and matters upon which he relied to support this). The judge also concluded that the claimant had not pleaded his breach of confidence claim adequately (in failing to identify the information said to be confidential, why it was said that it was confidential information held under an obligation of confidence and the use of the information that was said to constitute a misuse).

In addition, in Warren the Court concluded that a positive act was required in a claim for breach of confidence or misuse of private information. Currys argued that the allegation against them was that they had failed to take protective measures rather than that they had taken positive action. The claimant tried to avoid this argument by saying that the positive step was the sale of the television without the claimant's personal information having been erased. However, the judge accepted Currys’ argument that there was a fundamental defect with the claims for misuse of private information and breach of confidence. In passing the TV to a third party Currys were not making use of the data or information that was the subject of the claim, “In fact, there is no evidence that the defendant had any actual knowledge of the information in question or made use of it".  It followed that there could not have been any unauthorised use or misuse of the information by Currys.

Turning to the negligence claim Currys argued that the courts had said that there was no need to impose a duty of care where there were statutory data protection duties and that there was no cause of action where the claimant had not suffered a loss. The judge determined the point on the second ground noting that the only financial loss suffered by the claimant was the cost of the film which had been refunded by Currys. The only other claim was for distress and anxiety and the claimant had therefore not suffered a recoverable loss with the result that he had not pleaded a complete cause of action in negligence. The negligence claim was therefore dismissed and/or struck out.

Procedural Matters

Concluding in relation to procedural matters, the judge said that “There does not appear to be any reason for this claim to have been issued in the High Court.  Whilst defamation claims must be issued in the High Court (with limited exceptions), the same is not true in respect of the causes of action pursued in this case.". He went on the say that “This is a very low-value claim.  Consumer disputes of equivalent complexity are heard every day in the County Court on the small claims track and do not need to be dealt with by a High Court judge. Whilst there will often be good reasons for including more than one cause of action in a claim, especially where there are differences between them in respect of proof of damage, or heads of loss, parties must always conduct litigation proportionately and in accordance with the overriding objective. By including multiple causes of action in respect of this low-value claim, the claimant has increased the complexity of the proceedings unnecessarily.".

In the circumstances all of the claims save for the Data Protection Act claim were dismissed and that was transferred to the County Court with the judge indicating that whilst the issue of allocation was for the District Judge their view was that the claim should be allocated to the small claims track.

What this means for you 

This is yet another extremely sensible judgment from the High Court in which a very modest/low-value data protection claim issued in the High Court which put forward multiple heads of claim was said by the Court to clearly be a low-value claim and that;

it should be transferred to the County Court and dealt with in the small claims track; 

duplicative heads of claim were to be struck out on the basis that they added to the complexity of the claim unnecessarily;

the claims for misuse of private information and breach of confidence were not properly pleaded (as no positive act was identified); and 

the claim for negligence failed to establish any loss and was dismissed/struck out.

This judgment further reinforces the views we have been expressing for some time that claimant solicitors are inappropriately issuing claims in the High Court for multiple heads of loss in circumstances where those claims should be restricted to one head of claim and should, given their value, be pursued in the County Court under the small claims regime with the consequent limitations as to the recovery of costs.

The protection of data provided for by the Data Protection Act 2018 and GDPR is laudable in its aims and no-one would support large organisations “playing fast and loose” with an individual’s data. However there have to be appropriate checks and balances in place. With what appears to be a drive for volume and a focus on the costs capable of being recovered, we are seeing claims being pursued for the most simple of human errors, involving anodyne data and without much in the way of credible evidence as to any detriment suffered. This claim against Currys is another of that ilk and the judgment provides a welcome illustration of what is a proportionate approach to the handling of such disputes.

 
 

<< Back

Disclaimer: This document does not present a complete or comprehensive statement of the law, nor does it constitute legal advice. It is intended only to highlight issues that may be of interest to clients of BLM. Specialist legal advice should always be sought in any particular case.

Related Expertise


Related Sectors


Related contacts


Tim Smith

Tim Smith

Partner and Head of TMT & Cyber Practice Group,
London


Who to contact


For more information about any of our news releases, please contact:

Jo Murray
+44 20 7638 2811
+44 20 7865 4849
Email Jo

|

Not what you are looking for? Click here!