Auteurs

Michael Yates

Associé

Londres

Edward Spencer

Senior counsel

Londres

Matthew Caskie

Collaborateur

Londres

Auteurs

Michael Yates

Associé

Londres

Edward Spencer

Senior counsel

Londres

Matthew Caskie

Collaborateur

Londres

21 septembre 2021

Disputes Quick Read – 48 de 93 Publications

Disputes Quick Read: High Court rules that failure to provide adequate data security is not a positive act

Quick read

In Darren Warren v DSG Retail Limited earlier this year, the High Court struck out misuse of private information, breach of confidence and negligence claims, ruling that failure to provide adequate data security is not a positive act that can form the basis of such claims.

Background

DSG Retail Limited was the victim of a malware hack between 2017 and 2018 on 5,930 point of sale terminals. These terminals stored customer data, which the hackers compromised. The ICO investigated the attack and decided that DSG, as data controller, breached the seventh data protection principle (DPP7) – ie it failed to take appropriate technical and organisational measures against unauthorised or unlawful processing of data. The ICO issued a monetary penalty, which is currently under appeal to the FTT.

Darren Warren was a victim of the hack and discovered that the hackers had stolen his personal information. This included his name, address, phone number, date of birth and email address. Mr Warren claimed damages of £5,000 for distress via claims for:

breach of confidence (BoC)
misuse of private information (MPI)
negligence, and
breach of the Data Protection Act (under the 1998 Act).

In response, DSG applied under CPR 24 and CPR 3.4(2) for summary judgment/strike out of the first three claims. DSG argued that these claims had no realistic prospect of success based on the facts and were untenable as a matter of law.

The decision

The court noted that, when ruling on strike out applications, it assumes the primary facts alleged are true. This means that the court should not strike out a claim unless it's certain that the statements of case disclose no reasonable grounds for bringing the claim.

Mr Warren had argued that:

DSG intentionally and recklessly left his private information exposed to a real risk of intrusion from the world at large.
By failing to keep the data safe, DSG's actions were "tantamount to publication".
DSG's failure to implement basic security measures to protect information meant that it had effectively published Mr Warren's data to the third-party hacker.

Justice Saini disagreed and struck out the first three claims. He said that:

the law of BoC and MPI was for "prohibiting actions by the holder of information which are inconsistent with the obligation of confidence/privacy".
A positive action of the holder of the information would require something like publication or disclosure of information. A "misuse" or "use" or an "interference" with Article 8 rights requires a positive act, which was not the case here.
DSG had not carried out a positive act, and DSG (itself the victim of the cyberattack) was not accused of any positive conduct. There was no suggestion that DSG facilitated the cyberattack.
While DSG failed to keep Mr Warren's data safe, he could not advance claims for BoC and MPI on this basis, because these claims don't impose a data security duty on DSG.

The court also struck out Mr Warren's negligence claim. Justice Saini couldn't see the logic of imposing a common law duty of care when a statutory regime (ie the Data Protection Act 1998) was already in place, through which DSG owed duties to Mr Warren as the data controller. Warren had only claimed "distress", but a state of anxiety produced by a negligent act or omission – but which falls short of a clinically recognisable psychiatric illness – is not enough damage to complete a tortious cause of action.

Only Mr Warren's claim for breach of the Data Protection Act 1998 remained, which the court stayed pending the FTT case's outcome.

Key takeaways

This case makes an interesting distinction between a hacker and the data controller they hack. In Tchenguiz v Imerman [2011] Fam 116 and PML v Persons Unknown [2018] EWHC 838 (QB), the court held that a hacker who breaks into a computer system and steals information is bound by a duty of confidence. Here, the company that allegedly failed to keep data safe was not bound by this same duty.
Data controllers that have suffered cyberattacks but have not committed a positive act regarding the stolen information have less to fear from any subsequent data privacy claims. Only very brave claimants will proceed with BoC, MPI, and negligence claims, together with a data security claim, for fear of failing to resist a summary judgment/strike out application and ending up paying the cost.
The other outcome of this application saw this claim transferred to the small claims track of the County Court. That is a bad place for claimants to litigate because of the poor costs recovery, even if successful, and capped costs, which would affect the amount of damages they keep.
Turning to reputational damage, while CPR 53 PD B permits claimants to apply for and obtain a statement in open court if they wish to accept a Part 36 offer or other offer of settlement regarding a list of media law claims, data protection is not included in this list. Therefore, if BoC and MPI claims fall outside civil data breach claims, a successful claimant can't publicise a win via a statement in open court.

Find out more

To discuss the issues raised in this article in more detail, please reach out to a member of our Disputes & Investigation team.

Services et Groupes Résolution des litiges Données et cybersécurité Technologies de l'information Gestion de la réputation et protection de la vie privée

Dans cette série

Résolution des litiges

Disputes Quick Read: important environmental ruling?

16 July 2024

par Tim Strong, Kate Hamblin

Résolution des litiges

Notice of Claim: What constitutes 'reasonable detail'?

5 July 2024

par Stuart Broom, Tom Charnley

Résolution des litiges

Introduction of football regulator on hold for now

24 May 2024

par David de Ferrars, Joe Pengelly

Résolution des litiges

Proposed changes to the rules on ADR

20 May 2024

par Elizabeth Montpetit, Natalia Faekova

Résolution des litiges

Internal investigations - raising the bar

1 May 2024

par Andrew Howell

Résolution des litiges

New SFO Director announces bold plans to tackle fraud

21 March 2024

par Emma Allen, Amy Cheng

Résolution des litiges

What are the litigation trends for 2024?

1 February 2024

par Katie Chandler, Emma Allen

Résolution des litiges

ClientEarth v FCA: Challenging Regulator Decisions

12 February 2024

par Tim Strong, Nicole Baldev

Résolution des litiges

First of its kind judicial guidance on the use of AI in the courts

14 December 2023

Résolution des litiges

Witness familiarisation - does it affect the court's assessment of witness credibility?

13 December 2023

par Tim Strong, Helen Brannigan

Résolution des litiges

Court of Appeal confirms mandatory ADR is here to stay

4 December 2023

par Stephanie High, Elizabeth Montpetit

Résolution des litiges

The use of AI in Trial Witness Statements post-PD 57AC

23 October 2023

par plusieurs auteurs

Résolution des litiges

CAT to hear the first application for a collective settlement approval order

17 October 2023

par Katie Chandler, Samantha Brendish

Résolution des litiges

Law Commission's report on digital assets: what's next?

2 October 2023

par Georgina Jones, Claudia Blofeld

Résolution des litiges

Pre-Action Protocols – what is different?

12 September 2023

par Tom Charnley

Résolution des litiges

Failure to prevent fraud – a new offence?

14 August 2023

par plusieurs auteurs

Résolution des litiges

Supreme Court rules that APP fraud victims cannot rely on Quincecare Duty

4 August 2023

par plusieurs auteurs

Résolution des litiges

The Law Commission's Consultation Process on the Arbitration Act 1996 – taking stock

21 July 2023

par Nick Storrs, Elizabeth Montpetit

Résolution des litiges

What does the latest decision of the CAT in the Mastercard/Visa proceedings mean for class actions?

10 July 2023

par Katie Chandler, Samantha Brendish

Résolution des litiges

Disputes Quick Read: ClientEarth refused permission to pursue directors of Shell

1 June 2023

par plusieurs auteurs

Résolution des litiges

CJC costs review – what will change?

1 June 2023

par James Bryden, Helen Robinson

Résolution des litiges

Embargoed judgments – dos and don'ts

16 May 2023

par Stephanie High

Résolution des litiges

Disputes Quick Read – developments in the fixed costs regime

3 May 2023

par James Bryden

Résolution des litiges

Disputes Quick Read: Service by email – are the rules any clearer?

20 April 2023

par James Bryden

Résolution des litiges

Disputes Quick Read: Breaking the north/south divide?

5 April 2023

par Saleem Fazal MBE, Tom Charnley

Résolution des litiges

Disputes Quick Read - What do practitioners think about making alternative dispute resolution (ADR) compulsory?

8 March 2023

par Elizabeth Montpetit, Stephanie High

Résolution des litiges

Disputes Quick Read: What are the litigation trends for 2023?

2 March 2023

par Katie Chandler, Emma Allen

Résolution des litiges

Disputes Quick Read: further guidance on witness statement preparation rules

14 February 2023

par Stephanie High, Kate Hamblin

Résolution des litiges

Disputes Quick Read: A cautionary tale – settlement agreement (un)wittingly releases all claims for fraud

13 February 2023

par Georgina Jones, Ella Bazini

Résolution des litiges

Disputes Quick Read: Why the UK should join the Hague Judgments Convention 2019

8 February 2023

par Jessie Prynne

Résolution des litiges

Disputes Quick Read: extensive information orders granted against crypto exchanges following hack

19 January 2023

par Laurence Lieberman, Georgina Jones

Résolution des litiges

Disputes Quick Read: A new approach to giving evidence? WhatsApp with that?

3 October 2022

par Gemma Broughall

Résolution des litiges

Disputes Quick Read: Ethereum Merge - what legal issues arise?

22 September 2022

par Ben Jones, Emma Allen

Cryptoactifs, blockchain et technologie des registres distribués (DLT) et projets Web 3.0

Disputes Quick Read: New obligations on cryptobusinesses to report under the UK sanctions regime

9 August 2022

par Nick Maday

Résolution des litiges

Disputes Quick Read: Disclosure - What information can be redacted?

25 July 2022

par Edward Spencer

Résolution des litiges

Disputes Quick Read: what claims exist when a smart contract is breached?

6 July 2022

par Emma Allen

Résolution des litiges

Disputes Quick Read: New gateway for serving Norwich Pharmacal Orders and Bankers Trust orders out of the jurisdiction

Welcome news for those pursuing fraud claims in the English Courts

28 July 2022

par Emma Allen, Samantha Brendish

Résolution des litiges

Disputes Quick Read: Disclosure Pilot Scheme – here to stay

21 July 2022

par Edward Spencer

Résolution des litiges

Disputes Quick Read: Defining the duty - the limits of the responsibility assumed by professionals

27 July 2022

par Stuart Broom

Résolution des litiges

Disputes Quick Read: Climate change litigation – successful challenge to government's Net Zero Strategy

29 July 2022

par Jess Thomas (Pro Bono), Lucy Waddicor

Résolution des litiges

Disputes Quick Read: Judicial Review and Courts Act 2022 – now in force

17 June 2022

par Stephanie High

Résolution des litiges

Disputes Quick Read: an important reminder of the duty to disclose electronic documents in native format

13 June 2022

par Edward Spencer

Résolution des litiges

Disputes Quick Read: ENRC prevails in claim against former solicitor

26 May 2022

par Emma Allen, David de Ferrars

Résolution des litiges

Disputes Quick Read: Climate change litigation update – McGaughey v Universities Superannuation Scheme Limited

31 May 2022

par plusieurs auteurs

Résolution des litiges

Don't lose your keys: Bitcoin developers do not have a duty to assist owners in recovering lost cryptocurrency

4 April 2022

par Emma Allen, Samantha Brendish

Résolution des litiges

Disputes Quick Read: The new witness statement preparation rules – a year on

5 April 2022

par Stephanie High

Résolution des litiges

Disputes Quick Read: ClientEarth v Shell – climate change litigation shifts focus to UK companies

31 March 2022

par plusieurs auteurs

Résolution des litiges