No harm, no foul? Court of Appeal provides clarifications around controllers’ liability in the context of compensation claims under Article 82 of the UK GDPR (Farley and others v Paymaster (1836) Ltd (trading as Equiniti) (Information Commissioner intervening))
Information Law analysis: In a landmark ruling, the Court of Appeal overturned a High Court decision which denied compensation to individuals affected by a data breach. The judgment contains helpful clarifications regarding compensation claims made pursuant to Article 82 of the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (the UK GDPR), including the requirements for establishing UK GDPR infringement, the scope of non-material damage and, more broadly, the position of the UK courts in relation to EU Court of Justice case law and its application in the context of domestic data protection rules. The Court of Appeal held that bringing a UK GDPR infringement claim does not require proof that personal data was actually disclosed to third parties. Unlawful processing is a sufficient basis in principle for damage to be suffered. There is also no minimum threshold for non-material damage when it comes to a data subject’s entitlement to compensation under Article 82 of the UK GDPR. The scope of such damage can include an objective, well-founded fear or apprehension of misuse of personal data. This judgment is also a helpful reminder of the broad scope of activities that fall within the concept of processing and the importance of controllers’ compliance with Articles 24, 25 and 32 of the UK GDPR and the general principles in Article 5(1) of the UK GDPR. Written by Marija Nonkovic, associate at Kemp IT Law.