Jayaraj Palihawadana, a former UK representative of the political party of the former Sri Lankan President, has apologised unreservedly in Open Court to South African human rights lawyer and activist, Yasmin Sooka, for making false statements against her. Palihawadana published a report that he sent to 47 diplomatic missions in Geneva in 2021, falsely claiming that Sooka was biased in favour of a prescribed terrorist group.
Sooka brought a claim in the UK against Palihawadana under the Data Protection Act 2018 for his publication of inaccurate personal information detrimental to her reputation. The parties eventually came to a settlement, in which Palihawadana agreed to pay Sooka compensation and legal costs, retract his statements, and publish an apology online in English and Sinhala. Interestingly, Palihawadana agreed to make a Statement in Open Court as follows:
“The Defendant unconditionally retracts and apologises unreservedly for the aforementioned untrue allegations made against the Claimant in the Reports. To indicate the sincerity of this apology, the Defendant has agreed to pay the Claimant a substantial sum to compensate her for distress and harm to her reputation arising from the Reports. The Defendant has also agreed to bear the Claimant’s reasonable costs.”
Whilst Statements in Open Court are common for claims of defamation, malicious falsehood and misuse of private or confidential information, this is the first time that such a statement was permitted to be made in a UK Court in a data protection case.
Generally, damages are the chief remedy in a data protection claim, and Courts do not have an express power to order an apology or retraction of statements, or a Statement in Open Court, as in a claim in defamation, save correction of inaccurate personal data in accordance with section 46 of the Data Protection Act 2018 (DPA 2018) and erasure of personal data in accordance with section 47 of the DPA 2018. However, when parties to a data protection case settle, they can agree on more creative means of redress outside those that are permitted to be ordered by a Court. A Statement in Open Court in this case is an example.
Compensation in data protection cases
A victim of a data breach may claim monetary compensation for loss and damage suffered, including distress.
Article 82 of the GDPR sets out that:
“Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.”
Section 168(1) of the DPA 2018 states that:
“In Article 82 of the GDPR (right to compensation for material or non-material damage), ‘non-material damage’ includes distress.”
How much compensation a victim may be awarded depends on the nature and circumstances of the data protection breach, the types of data disclosed, and the impact of the data breach on the victim, financially and mentally. The Court has yet to lay down a specific set of guidelines on how quantum should be assessed, or bandings or tiers of damages for different levels of severity of breach and loss caused. However, helpful guidance can still be found in some previous decisions.
Case law of relevance
The Court of Appeal in the case of Halliday v Creation Consumer Finance Ltd [2013] EWCA Civ 333 ruled on the issue of the amount of damages to be awarded in a data breach case involving a one-off inadvertent mistake on the part of a data controller.
The Court of Appeal considered the nature of the data breach in that case and identified the following features:
- The breach was of a limited nature and did not lead to loss of credit or reputation;
- The breach was a single episode case caused by one error, and how the error and the breach had occurred had been explained, which was a mechanical error; and
- There was no proof of any fraudulent or malicious intent on the part of the Data Controller.
The Court of Appeal then concluded that the sum of compensation to be awarded should be of a relatively modest nature and upheld the figure of £750 awarded in the lower Court.
Conversely, in another case of Aven and others v Orbis Business Intelligence Ltd [2020] EWHC 1812 (QB), the Court awarded a substantial sum of damages for distress suffered and loss of control over personal data. This case concerned a memorandum produced by the Defendant in respect of an investigation into Donald Trump and his alleged links with Russia and President Putin. The memorandum contained propositions which included personal data about the Claimants. The Claimants argued that their personal data was processed in breach of the first and fourth principles of the now-repealed Data Protection Act 1998 (being the fair and lawful principle and the accuracy principle respectively).
The Court found in favour of the Claimants and awarded damages of £18,000 to each of them. It held that the compensation should account for the Claimants’ distress and loss of control over their data. It was also held that the law is clear that damage is not limited to material loss and therefore reputational damage should also be factored into the award.
As demonstrated in the above cases, the amount of damages that the Court may award can vary significantly. Whilst there are case authorities that can serve as some reference, there are few decisions that one can refer to for a clear indication of how the Court undertakes this assessment exercise. It is therefore important to seek expert legal advice before pursuing a claim and to balance the prospects of obtaining a large award of compensation and the legal costs that could be incurred.
How can we help?
Kevin Modiri is a Partner in our expert Dispute Resolution team, specialising in charity law, civil disputes, insolvency, inheritance disputes, data breach claims and defamation claims.
If you need any advice concerning the subjects discussed in this article, please do not hesitate to contact Kevin or another member of the team in Derby, Leicester, or Nottingham on 0800 024 1976 or via our online enquiry form.
Contact us