|[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]|
England and Wales High Court (Queen's Bench Division) Decisions
You are here: BAILII >> Databases >> England and Wales High Court (Queen's Bench Division) Decisions >> Johnson v Eastlight Community Homes Ltd  EWHC 3069 (QB) (16 November 2021)
Cite as:  EWHC 3069 (QB)
[New search] [Context] [View without highlighting] [Printable PDF version] [Help]
QUEEN'S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
Strand, London, WC2A 2LL
B e f o r e :
| EMMA LOUISE JOHNSON
- and -
|EASTLIGHT COMMUNITY HOMES LTD
Mr Ben Hamer (instructed by DAC Beachcroft) for the Defendant
Hearing date: 14 October 2021
Crown Copyright ©
The endorsement on the Claim Form states that she is claiming:
"(Including aggravated damages), damages for Misuse of Private Information, Breach of Confidence and Negligence, together with damages for breach of Article 8 ECHR rights as incorportated [sic] in the HRA 1998 as well as damages pursuant to Article 82 GDPR and damages pursuant to section 169 of the Data Protection Act 2018."
"Further, the Claimant claims injunctive relief to prevent the recurrence of this type of breach and declaratory relief stating that the Defendant has breached the principles enshrined in the abovementioned legislation."
Supporting lengthy Particulars of Claim plead matters more widely, additionally seeking damages pursuant to s.169 of the Data Protection Act 2018, declarations that the processing of the Claimant's personal data amounted to (i) a breach of her Article 8 ECHR rights to privacy and/or family life; and (ii) a breach of Article 5(1) General Data Protection Regulation ["GDPR"].
Although the case had not been allocated and so no CCMC had been listed (assuming allocation justified such a hearing), the Claimant's solicitors filed a Precedent H Form confirming over £15,000 has already been incurred in costs and a total figure for costs just in excess of £50,000. Such costs are, as is required in a Precedent H, certified by the Claimant's solicitors as "reasonable and proportionate for my client to incur in this litigation".
The Claimant's Directions Questionnaire suggests a 2-day trial is appropriate.
The inadvertent disclosure therefore was to a single person, who took apparently no issue with it, and lasted less than three hours.
The extent to which the Claimant's personal information was ever considered by the Third Party has to be assessed in the context of the size of the attachment. The Claimant's details appeared at pages 880-882 into a document of almost 6,941 pages long, a point the Defendant says invites inference that it is highly unlikely that the Third Party read the Claimant's information at all.
By 16 November 2020, nonetheless, the Claimant had instructed solicitors and a letter before claim had been sent to the Defendant.
As a Witness Statement ordinarily features, the Claimant provides her personal address (which is in Essex) in the opening paragraph. She acknowledges that the data breach admitted by the Defendant was caused by human error but refers to having moved to her current home in around 2017, as let to her by the Defendant, to escape an abusive relationship "and, as such, had avoided making my new address "public" for fear of further contact with my former partner". Therefore, upon learning that her address had been given to an unknown third party "I was immediately concerned that the information would somehow become known to my former partner. I was aware that the chances of my former partner receiving the information, either first hand or otherwise, were extremely low, however the thought of such an occurrence left me stressed, worried and very anxious". The Claimant reiterates the comparatively low risk of her ex-partner learning of her address by reason of the Defendant's disclosure at Para 41: "I was aware that the chance of such an occurrence was extremely low". However, she maintains that this possibility, combined with the general feature of the disclosure, has played upon her pre-existing depression and anxiety.
What is not acknowledged by her (and remains so through to the date of the Defendant's Application, despite the point being pleaded in the Defence dated 21 April 2021) is the objective and entirely realistic possibility that the ex-partner had been for the three years prior to the Defendant's disclosure (and indeed has remained since) far more likely and able to locate her whereabouts simply utilising publicly available channels. The Defendant's properties are only in Essex and Suffolk and so, had the ex-partner wished to, a simple search on the BT Phone Book website or 192.com for those locations would have led to her. The Claimant had not elected for her details to be made "ex-directory", a free and well publicised service offered by BT.
On these facts, I struggle to understand how the Claimant can maintain this is a case where relief other than damages could realistically be under consideration. The claim for an injunction seems misconceived. An injunction is a discretionary remedy granted usually only where it is demonstrated a defendant threatens to commission further torts: Monir v Wood  EWHC 3525 (QB) at . There is no evidential basis put forward to maintain that this was anything other than a one-off error. There cannot realistically be suggested to exist an ongoing threat to the Claimant's personal data, such as to justify an injunction.
The prospect of an award of an injunction seems non-existent. I am quite satisfied the pleading of a claim for an injunction is merely an attempt to add credibility to the claim and to convey a greater impression of its importance.
As does, for the same reasons, the claim for a declaration. I recognise no such need.
I am satisfied that the claim has to be treated as only a claim for damages of, at best, modest damages. I am satisfied this should have been recognised and reflected at issue.
Article 82 of the GDPR which provides:
Right to compensation and liability
1. Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.
Nonetheless, the Particulars of Claim goes on to rely upon s.169 Data Protection Act 2018 ("DPA 2018"). This section relates to infringement of data protection legislation other than GDPR. However, it is not clear exactly what additional infringement is relied upon by the Claimant and to what effect. In any event, this provision of the DPA is equivalent to the GDPR, save that it says "damage" rather than "material or non-material damage". On the facts of this case, I am therefore not sure what such additional pleading adds unless, the intention is (again) to convey an impression that the claim is more complex than it need be.
To analyse further, the Defendant's Application is for (a) summary judgment on the whole claim under the de minimis principle; (b) strike out of the whole claim under CPR 3.4(2)(b) under the Jameel jurisdiction; and (c) strike out of the claim in negligence under CPR 3.4(2)(a).
"I understood it to be common ground that the threshold of seriousness applied to section 13 as much as to MPI [misuse of private information]. That threshold would undoubtedly exclude, for example, a claim for damages for an accidental one-off data breach that was quickly remedied".
So too in the context of misuse of private information and breach of confidence. See Baroness Hale at  in Campbell v MGN  2 AC 457:
"Not every statement about a person's health will carry the badge of confidentiality or risk doing harm to that person's physical or moral integrity. The privacy interest in the fact that a public figure has a cold or a broken leg is unlikely to be strong enough to justify restricting the press's freedom to report it. What harm could it possibly do?"
Similarly, in Ambrosiadou v Coward  EWCA Civ 409 Lord Neuberger MR said at :
"Just because information relates to a person's family and private life, it will not automatically be protected by the courts: for instance, the information may be of slight significance, generally expressed, or anodyne in nature. While respect for family and private life is of fundamental importance, it seems to me that the courts should, in the absence of special facts, generally expect people to adopt a reasonably robust and realistic approach to living in the 21st century".
The Claimant says that her personal concerns expressed in consequence to the disclosure are real and not de minimis. The Claimant submits that she cannot be described as having "no reasonable grounds" for bringing her claim under CPR 3.4(2)(a). This is not a case as is plainly and obviously bound to fail. Further, it has at least "realistic" as opposed to a "fanciful" prospect of success, given the breach, and so is more than merely arguable.
Having regard to the various data obligations on the Defendant [and Mr Metcalfe sought to apply broadly the same general principle to each], the Claimant says the court ought to find itself unable at this early stage in the proceedings to ascertain what damages might be awarded within the £3,000 cap adopted by the Claimant on issue.
The Claimant submits that because the Defendant describes the disclosure as a one-off transient human error, the Defendant has offered no details to support the implied proposition the description brings that appropriate security had otherwise existed and applied to the Claimant's personal data. As such, there remains for consideration at trial the likelihood that the Claimant's personal data was read by the Third Party, disseminated further by the Third Party and whether any of the Claimant's personal data was already in, or has since been put in, the public domain by the Defendant.
Mr Metcalfe confirmed during the hearing his case that the nature of the legislation underlying her claim entitled the Claimant to require the Defendant to set out and justify its data protection measures irrespective of whether actual loss to the Claimant could be proven or indeed could ever have existed even if hypothetically. The pursuit of what might to some seem like the Claimant taking on the greater role of statutory enforcer rather pursuing a modest personal claim for damages was according to Mr Metcalfe (and however one might choose otherwise to describe it) the effect of that legislation. Further, as was canvassed at the hearing, consequentially entitled her solicitors to treat and present that claim as one where costs could be awarded if successful.
So, it follows the Claimant submits, there can be no concept of mere "technical breach" as can justify the Application.
The Claimant submits that the threshold point relied upon by the Defendant is, correctly interpreted and applied, not a ground for strike-out under CPR 3.4(2)(b) but instead for transfer to the County Court. On this point, however, I note that whilst the Claimant's solicitors had indeed offered to agree to transfer the case to the County Court, they have continued to maintain (a) that the claim had appropriately been issued in the High Court; and (b) the claim was not appropriate for the Small Claims Track in the County Court.
The Defendant therefore has succeeded on its Application at least on this aspect alone.
(a) The applicability of the de minimis and Jameel principles to the GDPR;
(b) The effect (if any) of the remaining claims – Article 5(1)(f) GDPR (the data security principle), the Article 8 claim and the breach of confidence claim – on damages beyond those that would be recoverable under 5(1)(a) and (b) of the GDPR.
The Claimant's position in response is, in summary, that:
(a) Jameel applies only to non-statutory torts; and
(b) Neither the de minimis principle nor the Jameel jurisdiction apply under the GDPR.
"i) The Court has jurisdiction to stay or strike out a claim where no real or
substantial wrong has been committed and litigating the claim will yield no tangible or legitimate benefit to the claimant proportionate to the likely costs and use of court procedures: in other words, "the game is not worth the candle": Jameel - per Lord Phillips MR and Schellenberg -v- BBC  EMLR 296, 319 per Eady J. The jurisdiction is useful where a claim "is obviously pointless or wasteful": Vidal-Hall -v- Google Inc  QB 1003  per Lord Dyson MR;
ii) Nevertheless, striking out is a draconian power and it should only be used in exceptional cases: Stelios Haji-Ioannou -v- Dixon  EWHC 178 (QB)  per Sharp J;
iii) It is not appropriate to carry out a detailed assessment of the merits of the claim. Unless obvious that it has very little prospect of success, the claim should be taken at face value: Ansari -v- Knowles  EWCA Civ 1448  per Moore-Bick LJ and  per Vos LJ;
iv) The Court should only conclude that continued litigation of the claim would be disproportionate to what could legitimately be achieved where it is impossible "to fashion any procedure by which that claim can be adjudicated in a proportionate way": Ames –v- Spamhaus Project Ltd  1 WLR 3409 - per Warby J citing Sullivan –v- Bristol Film Studios Ltd  EMLR 27 - per Lewison LJ".
Authority is against any submission from the Claimant to this effect. It has been addressed by the Court of Appeal in Vidal-Hall v Google  QB 1003 and more recently by Nicklin J Higinbotham in at :
"the Claimant contends that the Master was wrong to extend the Jameel abuse jurisdiction to Data Protection Act claims. No authority has been cited for that proposition and I am satisfied that it is not correct".
Nicklin J specifically referred to Vidal-Hall v Google at - where it was accepted that the Jameel jurisdiction could apply, though the Court of Appeal found it should not apply on the facts of that case (where there was commercial misuse of data).
a. The Claimant submits that the GDPR has direct effect and so supersedes inconsistent provisions in the common law and other statutes. Hence Lloyd v Google can be distinguished as concerning claims under the Data Protection Act 1998 (as implemented under the Data Protection Directive) and when GDPR was not in force. Reference is made to observations in TLT v Home Office  EWHC 2217 (QB) that the de minimis principle in data protection claims had been under the former regime.
b. I am not persuaded, however, that either the de minimis or Jameel principles have been displaced.
c. Section 13 of the Data Protection Act 1998 sought to implement Article 23 of the (old) Data Protection Directive (95/46/EC) which provided:
"Member States shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered."
d. The following underlined sections of section 13 were found in Vidal-Hall v Google to conflict with EU law:
(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if—
(a) the individual also suffers damage by reason of the contravention, or
(b) the contravention relates to the processing of personal data for the special purposes.
Nonetheless, whilst Vidal-Hall v Google held that "damage" under Article 23 of the Directive ought to have been given a broad interpretation to include non-pecuniary damage, at Para 136 the Court of Appeal acknowledged (although declined to apply it on the facts of that case) "the Jameel jurisdiction [which] is a valuable one where a claim is obviously pointless or wasteful". The principle as applicable to the 1998 Act was, as above, confirmed by Sir Geoffrey Vos in Lloyd v Google.
e. Nothing strikes me as distinct in the wording of Article 82(1) of the GDPR as negates continued application (if appropriate) of Jameel or de minimis principles to a damages claim brought under it.
Article 82(1) reads:
Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.
Just as the Data Protection Directive and 1998 Act themselves had made no provision for a de minimis threshold and the courts (as above) have nevertheless found one applies, I am unpersuaded anything arises by which the same principles should apply to the GDPR. I see no practical distinction. Both claims under the 1998 Act and GDPR acknowledge the supremacy of EU law but operate through the prism of the law of this jurisdiction.
f. This conclusion is entirely consistent with the application of the Regulation in other jurisdictions, as helpfully illustrated by Mr Hamer. In Germany (where the GDPR is directly effective) it has been found that Article 82 does have a de minimis threshold, and that the provision should be interpreted such that damages do not arise unless it reaches a threshold of seriousness (Dresden Higher Regional Court, 11 June 2019, Case no. 2-7 O 100/20). The Higher Regional Court here (the equivalent of the Court of Appeal in this jurisdiction) held that Art. 82 should not be construed in such a way that it justifies a claim for damages for every individually perceived inconvenience or for minor breaches without serious detriment.
German law acknowledges that a claim can fall under the "Bagatellshaden", a 'bagatelle claim', equivalent to the concept of de minimis in this jurisdiction.
It is the prerogative of the individual state in question to apply the principles of the Regulation subject to its own legal principles. Recital 146 of the GDPR provides: "The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation. […] Data subjects should receive full and effective compensation for the damage they have suffered".
g. As Mr Hamer submits, there is no tension or discrepancy in this approach. It is consistent with the broad and inherent power of the court to control its own proceedings in the interests of the administration of justice.
h. Neither can it be argued that the principle of proportionality is one that only exists here within the common law. It is one of the general principles of EU law: see, for example Conserve Italia v Commission (Case T-306/00) EU:T:2003:339 at  and Article 5 of the Treaty on European Union.
Despite an initial impression of sophistry, the Particulars of Claim ultimately comprises a number of overlapping and often inadequately pleaded causes of action.
The primary focus of the revised Application engages the issues summarised at Para 17 above because, as I am satisfied, this case essentially concerns quantum of damages and in the procedural context elected by the Claimant. As was accepted by Mr Metcalfe and evident from the authority of TLT v Home Office, the test for damages on facts such as these is considered in the round, drawing upon all causes of action as relied upon. There is no separate or sequential process of assessment. Assuming, that is, the Jameel or de minimis threshold or gateway is satisfied.
On this basis:
(i) The Claimant's submission that the likely value of damages cannot be predicted at this stage because there necessarily first should be consideration of the Defendant's organisational and internal procedures for the extent of the breach to be appreciated seems ambitiously to inflate any realistic value the claim has. As I put to Mr Metcalfe in the hearing, such matters would not only be unknown to the Claimant but more particularly could never increase or aggravate her subjective distress or perception of loss. I am bound to comment that the suggestion of this being still a necessary and proportionate line of enquiry, despite the breach being admitted, seems more to justify the Claimant's position that even if her case is not suitable for retention in the High Court, it should continue upon transfer to the County Court and be allocated there;
(ii) Nothing independently by way of entitlement seems to derive from reliance upon Article 8;
(iii) The reference to misuse of private information appears only in the alternative to the Article 8 claim, which I take as a concession that it entirely overlaps with it. Therefore, nothing independent arises from it;
(iv) Save for appearing as a reference in the Prayer, there is no identifiable expressly pleaded claim drawing upon "breach of confidence" as if an independent cause of action. Properly treating this as a potential cause of action and not a relief, I therefore entirely disregard it as insufficiently particularised. Further, even if that is too stringent an approach for being a pleading point, taking the claim as a whole, the breach of confidence claim and the claim in privacy fail to satisfy me they add anything useful and independent to the claim arising from the admitted breach of the GDPR.
(v) As such, I agree with the Defendant's submission that claims collateral to the GDPR claim are likely to obstruct the just disposal of these proceedings and take up disproportionate and unreasonable court time and costs. They are struck out under CPR 3.4(2)(b). By the same reasoning, they should be excluded under CPR 3.1(2)(k) and/or (m).
Under "Where to start proceedings", CPR PD7A Para 2.1 is explicit:
"Proceedings (whether for damages or for a specified sum) may not be started in the High Court unless the value of the claim is more than £100,000".
Plainly, the value certified by the Claimant for her claim comes nowhere near this requirement.
Neither, however, in my judgment does the subject matter of the claim elevate it to High Court status. By CPR 53.1(2), a "media and communications claim" is a claim that satisfies the requirements of paragraph (3) or (4) [sub-para (4) having no relevance here]. Sub-paragraph 3 does indeed include claims for misuse of private information or in data protection law. However, and significantly, the opening of paragraph 3 is clear this is only if the cited causes of action constitute "A High Court claim". As distinct from claims in defamation, jurisdiction of which is excluded from the County Court by section 15 of the County Courts Act 1984, the Claimant's causes of action therefore did not have to be brought in the High Court and so was not a High Court Claim.
Here I repeat that the Claimant's offer to accept a transfer to the County Court is hardly complete and unequivocal. Further, by maintaining her claim in negligence until just into the first half hour of the Application, neither has the Claimant shown any appropriate realism about the true scope of her claim.
Nonetheless, mindful that the court should strive to provide a remedy to any litigant if it can ["to fashion any procedure by which that claim can be adjudicated in a proportionate way"], the claim ought not to be entirely struck out but instead redirected to the more appropriate forum, the County Court. As distinct from defamation, where the game may not be worth the candle because there is only one permitted venue for the match, this very modest claim can and should proceed but be concluded elsewhere.
Countless examples could be found daily in virtually every County Court in this jurisdiction where limited time and resources and the requirements of the overriding objective combine to oblige the pragmatic and proportionate application of legal principle. The lure of adopting a more elaborate and expensive approach just because the subject matter can so permit is simply unacceptable. Put bluntly, the garment must be cut according to the cloth. So, accordingly, is potentially complex law applied proportionately in lower value claims in a way compatible to the limited resources those cases justify.
The only reason why the claim has been subject to detailed legal argument is because the Defendant is appropriately concerned to defend resolutely a claim brought in the High Court where the future costs and time to be incurred by a social housing client would always be grossly in excess of the matter in dispute and with little clear prospect of recovery even if successful. Clearly, the Defendant in raising such challenge also has to act proportionately. However, the Claimant can hardly complain if the Defendant's response has been contextually proportionate to the very venue chosen by the Claimant in which to litigate.
Note 1 From Jameel v Down Jones & Co Inc  QB 246 [Back] Note 2 The Particulars of Claim instead refers to disclosure of her e-mail (which was not disclosed) but the Defendant accepts one should assume this is an error and the reference should be to her address. [Back] Note 3 I was told in argument by the Claimant this is £274 but Mr Hamer has since drawn the court’s attention to the far more modest £11 fee for an online request on the HMCTS website. [Back] Note 4 E-mail from Steven Coyle of Claimant’s solicitors to Defendant 11/08/21 @ 13.45 [Back] Note 5 The ration in Warren is not new but draws upon the Rothwell v Chemical & Insulating Co Ltd  1 AC 281 and Smeaton v Equifax  EWCA Civ 108. [Back] Note 6 Mr Hamer’s skeleton argument referred to four other similar cases brought by the Claimant’s firm in respect of which the negligence elements had all been withdrawn only the week before this hearing. But there had been no express confirmation of withdrawal in this case. [Back] Note 7 The Claimant now accepts the Defendant’s submission that the relevant regime was the GDPR and not the UK GDPR as she had incorrectly pleaded. [Back]
Note 1 From Jameel v Down Jones & Co Inc  QB 246 [Back]
Note 2 The Particulars of Claim instead refers to disclosure of her e-mail (which was not disclosed) but the Defendant accepts one should assume this is an error and the reference should be to her address. [Back]
Note 3 I was told in argument by the Claimant this is £274 but Mr Hamer has since drawn the court’s attention to the far more modest £11 fee for an online request on the HMCTS website. [Back]
Note 4 E-mail from Steven Coyle of Claimant’s solicitors to Defendant 11/08/21 @ 13.45 [Back]
Note 5 The ration in Warren is not new but draws upon the Rothwell v Chemical & Insulating Co Ltd  1 AC 281 and Smeaton v Equifax  EWCA Civ 108. [Back]
Note 6 Mr Hamer’s skeleton argument referred to four other similar cases brought by the Claimant’s firm in respect of which the negligence elements had all been withdrawn only the week before this hearing. But there had been no express confirmation of withdrawal in this case. [Back]
Note 7 The Claimant now accepts the Defendant’s submission that the relevant regime was the GDPR and not the UK GDPR as she had incorrectly pleaded. [Back]