Family Court Responsible For Data Breach

Data breaches invariably are a cause for concern for anyone affected by them. In reality, however, there are very few scenarios where actual damage will be sustained by the victim of a data breach.

Information Commissioner’s Office investigation

Inadvertent errors such as sending a document containing personal data to the wrong email recipient can often be mitigated entirely by simply asking the recipient to irretrievably delete the document in question.

There are, however, some scenarios where the ramifications could be far more serious. The Information Commissioner’s Office (ICO) has recently concluded an investigation into an alleged data breach by the Family Court.

Ordinarily, adoption proceedings are anonymised in the Court system so as to prevent information that may prejudice one of the parties from being accidentally leaked. The rationale for this is fairly obvious but adoption cases often involve children who have been subjected to abuse by their birth parents and/or their birth parents are not happy for the adoption to take place.

The alleged data breach that the ICO was investigating related to such a case, where the Judge had ordered that the birth father was not to take part in the proceedings as he posed a risk to the family concerned. Notwithstanding this order, the Court failed to update its system accordingly and the birth father was sent details of the parties.

ICO decision

Unsurprisingly, the ICO found that there had been a data breach and issued a reprimand along with a number of improvements that must be complied with by the Courts by 7 December 2023. This will be little consolation to the family affected by the data breach. The decision of the ICO is, however, a strong indication that, if the family were to pursue a claim through the Courts for breach of their data protection rights, they would most likely succeed on the liability aspect of the claim.

Whilst the data protection legislation does provide for a mechanism for compensation to be paid to individuals who are victims of a data breach, including distress, the Court requires evidence as to what exact damage the data breach has caused.

Comment

Vague assertions about distress are unlikely to be sufficient and inadvertant errors such as the one referred to towards the start of this blog, where the recipient has confirmed deletion, are unlikely to justify anything more than a nominal award in damages.

Accordingly, the legal fees associated with pursuing such a claim would make it uneconomical to pursue. In the current case, it would be expected that the family would be deeply concerned about the threat that the birth father poses and accordingly could well consider relocating. This is often not a cheap process and this in itself could justify a claim being pursued. They could further justifiably be suffering from mental health issues as a result and this too could be a reasonable claim to evidence and pursue.