View source for EWHC (UK) - Stadler v Currys Group Ltd

{{COURTdecisionBOX

|Jurisdiction=United Kingdom
|Court-BG-Color=
|Courtlogo=Courts_logo1.png
|Court_Abbrevation=EWHC (UK)
|Court_With_Country=EWHC (UK)

|Case_Number_Name=QB-2021-002102
|ECLI=[2022] EWHC 160 (QB)

|Original_Source_Name_1=BAILII
|Original_Source_Link_1=https://www.bailii.org/ew/cases/EWHC/QB/2022/160.pdf
|Original_Source_Language_1=English
|Original_Source_Language__Code_1=EN

|Date_Decided=31.01.2022
|Date_Published=31.01.2022
|Year=2022



|National_Law_Name_1=24.2 CPR
|National_Law_Link_1=https://www.justice.gov.uk/courts/procedure-rules/civil/rules/part24#:~:text=24.2%2520The%2520court%2520may%2520give%2520summary%2520judgment%2520against,of%2520succeeding%2520on%2520the%2520claim%2520or%2520issue%253B%2520or
|National_Law_Name_2=Article 82 UK-GDPR
|National_Law_Link_2=https://www.legislation.gov.uk/eur/2016/679/contents
|National_Law_Name_3=CPR 3.4
|National_Law_Link_3=https://www.justice.gov.uk/courts/procedure-rules/civil/rules/part03#3.4
|National_Law_Name_4=Practice Direction 53B
|National_Law_Link_4=https://www.justice.gov.uk/courts/procedure-rules/civil/rules/part53/practice-direction-53b-media-and-communications-claims
|National_Law_Name_5=section 168 DPA 2018
|National_Law_Link_5=https://www.legislation.gov.uk/ukpga/2018/12/contents
|National_Law_Name_6=section 169 DPA 2018
|National_Law_Link_6=https://www.legislation.gov.uk/ukpga/2018/12/contents

|Party_Name_1=William Stadler
|Party_Link_1=
|Party_Name_2=Currys Group Ltd
|Party_Link_2=
|Party_Name_3=
|Party_Link_3=
|Party_Name_4=
|Party_Link_4=
|Party_Name_5=
|Party_Link_5=

|Appeal_From_Body=
|Appeal_From_Case_Number_Name=
|Appeal_From_Status=
|Appeal_From_Link=
|Appeal_To_Body=
|Appeal_To_Case_Number_Name=
|Appeal_To_Status=Unknown
|Appeal_To_Link=

|Initial_Contributor=Florian Wuttke
|
}}

The UK High Court rejected a data subject's claim for damages under Article 82 UK-GDPR on the basis that they did not suffer any damage, harm or injury, as the defendant reimbursed them after an unauthorised purchase was made on their user account.

== English Summary ==

=== Facts ===
The claimant is a data subject who purchased a Smart TV from the defendant, a consumer electronics chain. After a certain period of use, the device broke down. On the device, the claimant had stored personal data such as names, account details and payment data for several apps. The defendant requested the return of the device for repair but the claimant was not asked to delete and/or remove personal data before sending it in. Although faulty, the device had enough functionality to allow a user to log out from any apps. Notably, the claimant did not log out of their Amazon app before leaving the TV with the defendant. 

Later, the parties agreed that any repair of the device would be disproportionately costly and so the TV should be written-off. The claimant’s understanding was that the device would be destroyed. However, the defendant re-sold the unit without performing a factory reset or data wipe. Subsequently, someone used the claimant's Amazon account through the unit to make a small in-app purchase. The claimant became aware of the transaction and, following a complaint, the defendant refunded the cost incurred and provided a shopping voucher as a gesture of goodwill.

The claimant argued that the defendant breached its data protection duties by disposing of the device without first wiping any data stored on it, and brought an action for damages in the High Court for misuse of private information, breach of confidence, negligence, and breach of data protection law under Article 82 UK-GDPR and sections 168 and 169 of the [https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted Data Protection Act (DPA) 2018].

The defendant applied for the claim to be struck out under 3.4(2)(a) and (b) CPR or, alternatively, to grant summary judgement under 24.2 CPR since “''it did not process the data and was not a data controller because it did not know about the data, had not been made aware of it, and reasonably believed it to be the responsibility of the claimant. Furthermore, it says that it only ever held the television as a physical asset and did not make use of the claimant's accounts''”. 

=== Holding ===
The facts of the case were insufficient to make out claims for either misuse of private information or breach of confidence. The claimant’s negligence claim was also dismissed. On the claimant’s data protection claim, the court dismissed the defendant's applications to strike out the claim or give summary judgement, and transferred the case to the County Court.

'''On the data protection claims:'''

First, the court considered the claimant's entitlement to damages. Under Art. 82 UK-GDPR “''any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.''” In relation to contraventions of the UK-GDPR, section 168 DPA 2018 provides that "non-material damage" in [[Article 82 GDPR]] includes distress. In relation to breaches of other data protection legislation, section 169 DPA 2018 defines “''damage''” as including financial loss and damage not involving financial loss, such as distress. 

In assessing whether the claim should be struck out on Jameel grounds, consideration was given to ''Sullivan v Bristol Film Studios Limited'' [2012] EMLR 27 and whether “''there is a means by which the claim can be adjudicated without disproportionate expenditur''e”. The court acknowledged that if the Smart TV did indeed store bank details and other sensitive personal data, the defendant's handling of the device with the data on it "''[could not] be characterised as a trivial breach''" [42] and concluded that, although the claim was of low value and arose out of a single incident, it was inappropriate to strike it out on Jameel grounds. Instead, the claim could “''be managed in a way that is proportionate to its value through allocation to the small claims track.''” [44]

The court considered it conceivable “''that the defendant would or should have been aware that there was personal data on the device. [If] the defendant was a data controller, then it would have been under data protection duties in respect of the disposal of data [and] further factual information is needed to evaluate the extent of the defendant's duties to the claimant under data protection legislation''”. As such, the court also refused to grant summary judgement. [31]-[33]

'''On Misuse of Private Information and Breach of Confidence:'''

The court found that the claimant did not comply with Practice Direction 53B. They failed to specify the actual information said to be confidential and did not plead the use (or threatened use) of the information. [51] However, the court refused to strike out the claim for failure to comply, inter alia, because the Practice Direction does not apply when the remaining claim is transferred to the County Court. [22]

With reference to Toulson & Phipps at §5-011, the court pointed out that an equitable duty of confidentiality requires the defendant not to positively misuse information. In the absence of a contract, any duty of care “''to prevent confidential information or documents from falling into the hands of someone else (…) will arise only if there is a special relationship between the parties giving rise to a duty of care under the law of negligence''." [55] The court concluded that “''there [was] no evidence that the defendant had any actual knowledge of the information.''” In “''passing the Smart TV to a third party the defendant was not making use of the data or information that is the subject of this claim. (…) It follows that there cannot have been any unauthorised use (or misuse) of the information by the defendant.''” [58]

'''On the negligence claim:'''

Under [https://www.bailii.org/ew/cases/EWHC/QB/2021/2168.html ''Warren v DSG Retail Limited''<nowiki> [2021] EWHC 2168 (QB)</nowiki>] a cause of action in tort for recovery of damages for negligence requires some damage, harm or injury suffered by the claimant as a result of the negligent act. The court pointed out that “''a state of anxiety produced by some negligent act or omission but falling short of a clinically recognisable psychiatric illness does not constitute damage sufficient to complete a tortious cause of action.''” Since the claimant was reimbursed for the cost of the film purchased on their account, they had not suffered any recoverable loss.
== Comment ==
This case seemed a relatively straight-forward matter involving a potential one-off data breach with modest financial loss (£3.49) to the data subject, which had already been reimbursed and generously compensated by the controller with a £200 shopping voucher. Nevertheless, the claimant filed the case in the High Court as a Media and Communication Claim under Practice Direction 53B, which requires certain details in the particulars of claim (which the claimant did not complied with). The reasons for allocating the claim to the Multi-Track on the part of the claimant were alleged complex legal issues and the fact that the claimant sought declaratory and injunctive relief.

During pre-action communication the defendant pointed out, with the court’s later approval, “that judges of this court have made clear recently that these sorts of modest value claim are not suitable for the High Court, or indeed the multi-track. It also drew the claimant's attention to the obligation on ensuring cases are justly and proportionately managed in accordance with the overriding objective.” [70]

In its reasoning on striking out the negligence claim, the court pointed out that the claimant had not suffered a recoverable loss [63]. In principle, the same applies to the non-existent material damage in an action for breach of data protection. However, the court considered that Article 82 UK-GDPR, in conjunction with s168 DPA 2018, would also allow compensation for non-material damage, such as distress. The fact that the claimant's alleged disclosure of bank data is not trivial and the admissibility of distress as a ground for compensation under UK-GDPR led the court not to strike out the data protection claim on Jameel grounds. However, the court referred several times to the fact, that it saw no reason why this case should not have been filed directly with the County Court. 

== Further Resources ==
''Share blogs or news articles here!''

== English Machine Translation of the Decision ==
The decision below is a machine translation of the English original. Please refer to the English original for more details.

<pre>
Neutral Citation Number: [2022] EWHC 160 (QB)

                                                              Case No: QB-2021-002102

IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST

                                                                  Royal Courts of Justice
                                                            Strand, London, WC2A 2LL

                                                                  Date: 31 January 2022


                                        Before:

                            HIS HONOUR JUDGE LEWIS
                          (sitting as a Judge of the High Court)
                              - - - - - - - - - - - - - - - - - - - - -
                                       Between:


                                WILLIAM STADLER                               Claimant
                                        - and -
                             CURRYS GROUP LIMITED                            Defendant


                              - - - - - - - - - - - - - - - - - - - - -
                              - - - - - - - - - - - - - - - - - - - - -

                Daniel Glover (instructed by Irvings Law) for the Claimant
   Gemma McNeil-Walsh (instructed by the in-house legal department) for the Defendant

                              Hearing date: 29 October 2021

                   Supplemental written submissions 29 November 2021
                              - - - - - - - - - - - - - - - - - - - - -
                            Approved Judgment

I direct that pursuant to CPR PD 39A para 6.1 no official shorthand note shall be taken of this
    Judgment and that copies of this version as handed down may be treated as authentic.

                                   .............................

                             HIS HONOUR JUDGE LEWIS



Covid-19 Protocol: This judgment was handed down remotely by circulation to the parties'
representatives by email and release to Bailii. The date for hand-down is deemed to be on
31 January 2022., Approved JudgmentLEWIS                                                  Stadler v Currys Group Limited


His Honour Judge Lewis:

   1. This is a consumer dispute about responsibility for the security of data stored on a smart
       television when returned to a retailer for repair.

   2. The defendant applies on notice for an order striking out the claim pursuant to CPR rule

       3.4(2)(a) and (b) and/or for summary judgment pursuant to CPR rule 24.2.

   3. The parties have agreed that if any parts of the claim survive these applications, the
       matter should be transferred to the County Court.

   4. Since the hearing, both parties have filed short supplemental skeletons following the
       Supreme Court’s decision in Lloyd v Google LLC [2021] UKSC 50.

   5. Based on the witness evidence filed, the following facts do not appear to be disputed to
       any material extent:

           a. The claimant purchased a smart television from the defendant in September
               2016 (“the Smart TV”). The Smart TV allowed the user to access third party

               “apps”, one of which was for Amazon Prime.

            b. In September 2020, the claimant returned the Smart TV to the defendant for
               repair. Although faulty, the Smart TV had enough functionality to allow a
               user to log out from any apps.

            c. The claimant was not asked by the defendant to clear and/or remove any of the
               apps on the Smart TV and was told to pass the device to the defendant’s

               employees, together with the remote and power cable (witness statement of the
               claimant’s solicitor dated 20.10.2021 at [8]).

            d. The claimant did not log out of his Amazon app (or any other apps) before
               leaving the Smart TV with the defendant.

            e. The defendant’s technical staff determined that any repair of the Smart TV
               would be disproportionately costly and so offered to write-off the unit and
               compensate the claimant with a voucher. The claimant accepted this offer and

               used the voucher to purchase a new television. His understanding was that the
               Smart TV would be destroyed.

            f. The defendant then sold the Smart TV to a third-party company, without
               performing a factory reset or data wipe.

            g. On or around 31 December 2020, a movie was purchased for £3.49 by
               someone using the claimant’s Amazon account through the Smart TV.

            h. The claimant telephoned the defendant. On 2 January 2021, the defendant
               reimbursed the claimant for the cost of the Amazon purchase (£5). On 4

               January 2021, the defendant contacted the claimant again to make sure that he
               had changed his passwords for Amazon and any other apps, and the claimant
               confirmed that he had. On 11 January 2021, the defendant provided the
               claimant with a £200 shopping voucher as a gesture of goodwill., Approved JudgmentLEWIS                                                   Stadler v Currys Group Limited


   6. The claimant has now brought proceedings seeking the following:

            a. Damages (including aggravated and exemplary damages) up to £5,000 for (i)
                misuse of private information (“MOPI”); (ii) breach of confidence (“BoC”);
                (iii) negligence; and (iv) breach of data protection law, in particular pursuant

                to Article 82 UK-GDPR and sections 168 and 169 of the Data Protection Act
                2018.

            b. An injunction requiring the defendant, if it continues to process the claimant’s
                personal data, to act in accordance with the requirements of the UK-GDPR
                and the Data Protection Act 2018.

            c. A declaration that by processing the claimant’s personal data the defendant

                has breached Article 5(1) of UK-GDPR.

   7. The claim for negligence is pleaded in the particulars of claim, but not in the claim
       form. Whilst the defendant has taken issue with this, I have proceeded on the basis
       that if such a claim were viable, permission to amend the claim form would be granted.

   8. This application is being considered at the start of proceedings. The defendant has not
       yet filed its defence, nor has either party served its substantive evidence.


The defendant’s application
   9. The defendant challenges the claimant’s case on three grounds, namely that: (i) the

       pleading discloses no reasonable grounds for bringing a claim in any of the causes of
       action pleaded and the claim falls to be struck out pursuant to 3.4(2)(a); (ii) given the
       compensation already provided, all that remains is the “distress” purportedly caused to

       the claimant during the short period in which he realised his accounts had not been
       logged out, and such a claim is “not worth the candle” and falls to be struck out
       pursuant to 3.4(2)(b); and/or (iii) the claim has no reasonable prospects of success such
       that summary judgment ought to be granted pursuant to CPR 24.2.


   10. CPR rule 24.2 provides that the court may give summary judgment against a claimant
       or defendant on the whole of a claim or on a particular issue if:
                “(a) it considers that—
                       (i) that claimant has no real prospect of succeeding on the claim or

                       issue; or
                       (ii) that defendant has no real prospect of successfully defending the
                       claim or issue; and
                (b) there is no other compelling reason why the case or issue should be
                disposed of at a trial”.


   11. The approach to be taken when considering a defendant’s application for summary
       judgment applications was summarised by Lewison J in Easyair Limited (Trading As
       Openair) v Opal Telecom Limited [2009] EWHC 339 (Ch) at [15] (citations
       removed):


       “i) The court must consider whether the claimant has a “realistic” as opposed to a
       “fanciful” prospect of success.,Approved JudgmentLEWIS                                                     Stadler v Currys Group Limited



      ii) A “realistic” claim is one that carries some degree of conviction. This means a
      claim that is more than merely arguable.


      iii) In reaching its conclusion the court must not conduct a “mini-trial”.

      iv) This does not mean that the court must take at face value and without analysis
      everything that a claimant says in his statements before the court. In some cases it may
      be clear that there is no real substance in factual assertions made, particularly if
      contradicted by contemporaneous documents.


      v) However, in reaching its conclusion the court must take into account not only the
      evidence actually placed before it on the application for summary judgment, but also
      the evidence that can reasonably be expected to be available at trial.

      vi) Although a case may turn out at trial not to be really complicated, it does not

      follow that it should be decided without the fuller investigation into the facts at trial
      than is possible or permissible on summary judgment. Thus the court should hesitate
      about making a final decision without a trial, even where there is no obvious conflict
      of fact at the time of the application, where reasonable grounds exist for believing that
      a fuller investigation into the facts of the case would add to or alter the evidence
      available to a trial judge and so affect the outcome of the case.


      vii) On the other hand it is not uncommon for an application under Part 24 to give rise
      to a short point of law or construction and, if the court is satisfied that it has before it
      all the evidence necessary for the proper determination of the question and that the
      parties have had an adequate opportunity to address it in argument, it should grasp the
      nettle and decide it. The reason is quite simple: if the respondent's case is bad in law,

      he will in truth have no real prospect of succeeding on his claim or successfully
      defending the claim against him, as the case may be. Similarly, if the applicant's case
      is bad in law, the sooner that is determined, the better. If it is possible to show by
      evidence that although material in the form of documents or oral evidence that would
      put the documents in another light is not currently before the court, such material is
      likely to exist and can be expected to be available at trial, it would be wrong to give

      summary judgment because there would be a real, as opposed to a fanciful, prospect of
      success. However, it is not enough simply to argue that the case should be allowed to
      go to trial because something may turn up which would have a bearing on the question
      of construction.”

  12. CPR rule 3.4 makes provision for the court to strike out a statement of case or part of a

      statement of case if it appears that it discloses no reasonable grounds for bringing or
      defending a claim. The court may do so if it appears to the court:
               (a) that the statement of case discloses no reasonable grounds for bringing or
               defending the claim;

               (b) that the statement of case is an abuse of the court’s process or is otherwise
               likely to obstruct the just disposal of the proceedings; or
               (c) that there has been a failure to comply with a rule, practice direction or
               court order, Approved JudgmentLEWIS                                                 Stadler v Currys Group Limited


   13. The approach to strike out applications under the first limb was summarised in
       Duchess of Sussex v Associated Newspapers Limited [2020] EWHC 1058 (Ch) at

       [33]:

               “(2) An application under CPR 3.4(2)(a) calls for analysis of
               the statement of case, without reference to evidence. The
               primary facts alleged are assumed to be true. The Court should
               not be deterred from deciding a point of law; if it has all the
               necessary materials it should “grasp the nettle”: ICI Chemicals

               & Polymers Ltd v TTE Training Ltd [2007] EWCA Civ 725,
               But it should not strike out under this sub-rule unless it is
               “certain” that the statement of case, or the part under attack
               discloses no reasonable grounds of claim: Richards (t/a Colin
               Richards & Co) v Hughes [2004] EWCA Civ 266 [2004]
               PNLR 35 [22]. Even then, the Court has a discretion; it should

               consider whether the defect might be cured by amendment; if
               so, it may refrain from striking out and give an opportunity to
               make such an amendment.”


The claimant’s case

   14. The claimant says that the facts in the present action remain disputed and controversial
       and need to be determined at trial.


   15. The main areas of factual uncertainty and/or dispute in the case appear to be:

           a. What information about the claimant was, in fact, stored on the Smart TV, or

               accessible through apps on the device that were logged in.

           b. Whether the claimant told the defendant at the outset that he had undertaken a
               reset of his Smart TV, which would have meant that he was not logged into his

               apps.

           c. Whether the repairs undertaken were subject to terms and conditions of the
               defendant, and what those terms said about data.


           d. The basis upon which the claimant agreed that the defendant could dispose of
               the Smart TV, and the terms on which matters were concluded.


   16. In respect of sub-paragraph (a), namely what data was stored on or accessible from the
       television, the claimant’s position has been as follows:

           a. The claimant’s detailed letter of claim stated that the claimant was logged into

               Amazon, Sky, Disney Plus, BT Sport and BBC iPlayer, and that these
               applications “would have contained all of the claimant’s personal and financial
               details”. It was also said that the claimant used the television to access his
               bank accounts, and YouTube: “clearly, the TV contained vast amounts of

               personal/financial and or sensitive information which belonged to the, Approved JudgmentLEWIS                                                    Stadler v Currys Group Limited


                claimant. The TV (with all of this information) was subsequently passed on to
                a third party”.


            b. The claimant’s solicitor subsequently signed a witness statement, with
                statement of truth, confirming as a fact that “the television in question
                contained a vast amount of personal, financial and sensitive information”
                (witness statement at [13]).


            c. The claimant’s pleaded case is much narrower, namely that the personal data
                (and private information) of the claimant that was compromised included inter
                alia the following: (i) name; (ii) account details for several apps and or

                accounts including Amazon Prime, Sky, Netflix, Disney Plus and BT; and (iii)
                payment details in respect of the above accounts.

            d. The claimant’s pleaded case remains unclear about what is meant by “account

                details”, and to what extent any of this information (in particular, payment
                details) would have been available to someone in possession of the television
                without the account password.


   17. The claimant’s case in relation to damages has also been inconsistent:

            a. In his letter before claim, the claimant’s solicitors said: “The claimant has
                suffered psychological injury/ discomfort/ distress/ inconvenience/ damage.
                In this regard, the claimant will seek to rely upon the case of TLU & Others v

                SOS Home Department as support for the assertion that psychological/
                psychiatric injury can form part of “distress”. Further by reason of the
                claimant having endured additional humiliation and suffering as a result of
                your wrong-doing he also claims aggravated damages.”


            b. The claimant’s solicitor subsequently signed a witness statement, with
                statement of truth, simply confirming that when the claimant discovered a
                movie had been purchased on his account he was “surprised and concerned”

                (witness statement at [12]).

            c. The particulars of claim state that as a result of the defendant’s actions, he
                “suffered psychological distress, anxiety, loss and damage. The distress and

                anxiety have been exacerbated due to the sensitive personal and financial
                nature of the data that was unlawfully processed by the Defendant and
                accessed by a third party”.


Pleadings in media and communications claims
   18. As these proceedings were issued in the High Court, they were allocated to the Media

       and Communications List of the Queen’s Bench Division (“MAC List”), see CPR rule
       53.

   19. Claims proceeding in the MAC List must be conducted in accordance with PD53B,

       which prescribes the matters that parties are required to address in their pleadings., Approved JudgmentLEWIS                                                    Stadler v Currys Group Limited



   20. PD53B only applies to cases in the MAC List. It does not apply to cases in the County

       Court, even if they include causes of action that would be allocated to the MAC List if
       in the High Court. That said, parties to County Court actions still need to plead their
       cases properly and so they would be well advised to follow PD53B, regardless of
       whether they are required to do so.


   21. The defendant takes issue in this case with the adequacy of the claimant’s pleadings,
       which in many respects do not comply with CPR PD 53B.


   22. I have considered whether to strike out all or part of the particulars of claim as a result
       of the failure to comply with PD53B. I have decided not to do so, for three reasons.
       Firstly, if any part of the case appears meritorious, the proper course would likely be to
       provide the claimant with an opportunity to apply to amend the pleading. Secondly,

       there is enough information about the substance of the claimant’s case for me to be
       able to deal with the applications before me, avoiding the cost of re-hearing the
       application after pleadings have been amended. Thirdly, it is agreed that if the claim
       survives then it will be transferred to the County Court, where PD53B technically does

       not apply.

Data Protection

   23. The claimant relies on Article 82, as supplemented by s.168 of the Data Protection Act
       2018. Article 82 of the UK-GDPR provides data subjects with a right to civil

       compensation for data breaches by a controller. The relevant parts read as follows:

       “1. Any person who has suffered material or non-material damage as a result of an
       infringement of this Regulation shall have the right to receive compensation from the
       controller or processor for the damage suffered.


       2. Any controller involved in processing shall be liable for the damage caused by
       processing which infringes this Regulation. A processor shall be liable for the damage
       caused by processing only where it has not complied with obligations of this
       Regulation specifically directed to processors or where it has acted outside or contrary

       to lawful instructions of the controller.

       3. A controller or processor shall be exempt from liability under paragraph 2 if it
       proves that it is not in any way responsible for the event giving rise to the damage…”

   24. Section 168 of the DPA provides that “In Article 82 of the GDPR (right to

       compensation for material or non-material damage), "non-material damage" includes
       distress.”

   25. Section 169 of the DPA provides for compensation for damage contravention of other

       data protection legislation, “damage” being defined as including financial loss and
       damage not involving financial loss, such as distress.,Approved JudgmentLEWIS                                                    Stadler v Currys Group Limited


  26. The claimant says he was a data subject, and the defendant was the data controller. He
      says that the defendant breached its data protection duties in disposing of the television

      without first wiping any data stored on it. In support of his case, the claimant refers to
      the following:

           a. The Information Commissioner’s Office guidance on “IT asset disposal for
               organisations” which explains to data controllers what they need to consider

               when disposing of electronic equipment that may contain personal data,
               including the deletion of such data before devices are recycled or disposal.

           b. The defendant’s own trade-in website which provides that: “keeping your data

               and sensitive information secure is our top priority. When we receive a device
               for trade-in we (or an approved third party) wipe the data stored on it – this is
               done to Infosec Standard 5 (the same standard as the UK government data
               destruction)”. I note that this was not a trade-in and that the defendant says

               that it does not operate a data erasure solution in respect of returned/faulty
               items which are then re-sold onto other consumers.

  27. Whilst not of direct application, the claimant has also referred to a decision in a local

      court in Germany on 5 October 2020 which concluded that resale of a laptop which
      contained personal information constituted a violation of the data protection law and
      compensation of Euro 800 was payable pursuant to art 82 GDPR: Hildesheim (file
      number 43 C145/19).


  28. The defendant firstly takes issue with the adequacy of the pleading of the data
      protection claim. CPR PD 53B paragraph 9 provides that in any claim for breach of
      any data protection legislation the claimant must specify in the particulars of claim (1)

      the legislation and the provision that the claimant alleges the defendant has breached;
      (2) any specific data or acts of processing to which the claim relates; (3) the specific
      acts or omissions said to amount to such a breach, and the claimant’s grounds for that
      allegation; and (4) the remedies which the claimant seeks.”


  29. The defendant says that the claimant has not pleaded with sufficient particularity the
      acts of processing relied upon, merely stating that the defendant “failed to safeguard
      the data protection rights of the claimant” and that the information was not “processed

      fairly or lawfully” and processed “in a manner that was incompatible with the
      specified, explicit and legitimate purpose for which it was collected”.

  30. The defendant accepts that the data stored on the television would constitute “personal

      data”, but it does not accept that it was necessarily private or confidential. The
      defendant says that it did not process the data and was not a data controller because it
      did not know about the data, had not been made aware of it, and reasonably believed it
      to be the responsibility of the claimant. Furthermore, it says that it only ever held the

      television as a physical asset and did not make use of the claimant’s accounts, and it
      was the third party who was responsible for the event giving rise to the damage, ie
      purchasing the film. The defendant also says that the claimant’s complaint appears to,Approved JudgmentLEWIS                                                    Stadler v Currys Group Limited


      be about the defendant’s failure to log out of the apps (or wipe the device), which is an
      omission which cannot amount to data processing.


  31. I am not satisfied that it is appropriate to grant the defendant summary judgment on the
      data protection claim for two reasons.

  32. Firstly, further factual information is needed to evaluate the extent of the defendant’s

      duties to the claimant under data protection legislation, in particular in respect of what
      was said between the parties when the device was handed over, and when it was
      agreed it would be scrapped, and what terms and conditions applied to the repair and
      subsequent disposal.


  33. Secondly, I consider that the data protection claim has a reasonable prospect of
      success. On the basis of the claimant’s account of events, it seems that the defendant
      would or should have been aware that there was personal data on the device, and it is

      certainly arguable that it had duties as a data controller, particularly if at any point it
      became the owner of the Smart TV. If the defendant was a data controller, then it
      would have been under data protection duties in respect of the disposal of data, which
      is a form of processing, Article 7(2) GDPR. These are matters to be considered at a

      final hearing, and not determined on a summary basis.

  34. The defendant also seeks to strike out the data protection claim on the basis that it is
      trivial and below a threshold of seriousness, or alternatively that it is an abuse to allow

      the claim to proceed, following the principles identified in Jameel (below).

  35. A threshold of seriousness applies to claims under section 13 Data Protection Act
      1998. In Lloyd v Google [2020] QB 747 the Chancellor said “I understood it to be

      common ground that the threshold of seriousness applied to section 13 as much as to
      misuse of private information. That threshold would undoubtedly exclude, for
      example, a claim for damages for an accidental one-off data breach that was remedied
      quickly” at [55]. The Supreme Court in Lloyd (supra) proceeded on the basis that

      there is a threshold that applies to data protection claims: Lord Leggatt (with whom the
      other judges all agreed) referred on a number of occasions to the fact that the potential
      for damages applies to non-trivial claims: see [88], [115], [128], [137] and [138].


  36. The parties agree that in the context of DPA 1998, claims under s.13, damages for
      ‘non-trivial’ breaches are not recoverable unless there is proof of damage or distress.
      This position would appear to apply equally to claims under Article 82 UK-GDPR.

  37. An example of the application of the de minimis principle can be found in the decision

      of Master McCloud in Rolfe & others v Veale Wasbrough Vizards LLP [2021]
      EWHC 2809 (QB), which was a claim in respect of a single email about late payment
      of school fees that was sent to the wrong person, who confirmed they had deleted it
      without reading.,Approved JudgmentLEWIS                                                Stadler v Currys Group Limited


  38. The question of Jameel abuse in data protection claims was considered by Nicklin J in
      Harlow Higinbotham (formerly BWK) v Teekhungam & another [2018] EWHC

      1880 (QB):
              “Jameel.


              44. Again, there is not much dispute as to the legal principles
              to be applied:

              i) The Court has jurisdiction to stay or strike out a claim where
              no real or substantial wrong has been committed and litigating
              the claim will yield no tangible or legitimate benefit to the
              claimant proportionate to the likely costs and use of court

              procedures: in other words, " the game is not worth the candle
              ": Jameel [69]-[70] per Lord Phillips MR and Schellenberg –v-
              BBC [2000] EMLR 296 , 319 per Eady J. The jurisdiction is
              useful where a claim " is obviously pointless or wasteful ":
              Vidal-Hall –v- Google Inc [2016] QB 1003 [136] per Lord
              Dyson MR.


              ii) Nevertheless, striking out is a draconian power and it should
              only be used in exceptional cases: Stelios Haji-Ioannou –v-
              Dixon [2009] EWHC 178 (QB) [30] per Sharp J.

              iii) It is not appropriate to carry out a detailed assessment of
              the merits of the claim. Unless obvious that it has very little
              prospect of success, the claim should be taken at face value:

              Ansari –v- Knowles [2014] EWCA Civ 1448 [17] per Moore-
              Bick LJ and [27] per Vos LJ.

              iv) The Court should only conclude that continued litigation of
              the claim would be disproportionate to what could legitimately
              be achieved where it is impossible " to fashion any procedure
              by which that claim can be adjudicated in a proportionate way

              ": Ames –v- Spamhaus Project Ltd [2015] 1 WLR 3409 [33]-
              [36] per Warby J citing Sullivan –v- Bristol Film Studios Ltd
              [2012] EMLR 27 [29]-[32] per Lewison LJ.

              45. By ground 3, the Claimant contends that the Master was
              wrong to extend the Jameel abuse jurisdiction to Data
              Protection Act claims. No authority has been cited for that

              proposition and I am satisfied that it is not correct: see Vidal-
              Hall [134]-[136] (itself a data protection claim) and Sullivan -
              v- Bristol Films , supra .”

  39. The fact that a claim is of low value does not mean that the court should necessarily
      refuse to hear it. This was considered in Sullivan v Bristol Film Studios Limited

      [2012] EMLR 27 in which it was said that: “when… a judge is confronted by an
      application to strike out a claim on the ground that the game is not worth the candle he
      or she should consider carefully whether there is a means by which the claim can be
      adjudicated without disproportionate expenditure” per Lewison LJ at [32]. A similar, Approved JudgmentLEWIS                                                    Stadler v Currys Group Limited


       point was made in that case by Etherton LJ at [44] “consideration could have been
       given to transfer to… an appropriate county court for (re-)allocation on the small

       claims track”.

   40. In this case, the claim is unquestionably of low value. It arises out of a single incident
       – namely the disposal of the Smart TV without wiping the claimant’s personal data -

       and matters were remedied promptly.

   41. Whilst the defendant is sceptical that the Smart TV will have held all the information
       identified by the claimant - in particular bank details and other significant personal

       information in respect of each app - I acknowledge that this is the claimant’s pleaded
       case. A statement of truth has been signed on the claimant’s behalf. This can only
       have been signed by the claimant’s solicitor on the express instructions of the
       claimant, confirming the claimant’s belief that the factual matters set out in the

       pleading are true.

   42. If what the pleading says is correct, then in my view this cannot be characterised as a
       trivial breach given the nature of the information disclosed, and the fact that it appears

       at least one of the apps has been used by a stranger since the Smart TV was re-sold.

   43. I am, however, concerned that it would be disproportionate to allow such a low value
       claim to be litigated in the way that it is, with all the costs that arise out of High Court

       litigation. If this was a type of claim that would not be transferred to the County Court
       and the small claims track, for example for defamation, then it seems there would be
       good reasons for striking it out on Jameel grounds – the claim would simply not be

       worth the candle.

   44. In my judgment, this claim can, however, be managed in a way that is proportionate to
       its value through allocation to the small claims track. This would allow for it to be

       dealt with under what was intended to be an informal process, with limited additional
       work needed to prepare for a two or three-hour final hearing. Given this, applying
       Sullivan (supra), it is not appropriate for the claim to be struck out on Jameel grounds.


   45. I dismiss the defendant’s applications in respect of the data protection claims.

Privacy and Confidence

   46. I will consider next the claims for MOPI and BOC.

   47. Warren v DSG Retail Limited [2021] EWHC 2168 (QB) was a case in which

       damages were sought against Currys for distress arising out of the loss of personal data
       on basis of breach of confidence, misuse of private information, breach of the Data
       Protection Act 1998 and common law negligence. The data loss occurred after
       Currys’ systems had been infected by malware following a cyber-attack, resulting in

       the disclosure to the hackers of the claimant’s name, address, phone number, date of
       birth and email address. The parties accepted in Warren that the data protection claim
       should be transferred to the County Court for determination. Saini J dismissed and/or

       struck out all the remaining causes of action. Whilst the facts of Warren are different,Approved JudgmentLEWIS                                                     Stadler v Currys Group Limited


      to those in this case, much of Saini J’s analysis of the claims is of application in this
      case.


  48. Where privacy and confidence claims are brought in the High Court, CPR PD53B
      paragraph 8 sets out the information that the claimant is required to specify in the
      particulars of claim.


  49. For privacy claims, the claimant must specify:
               (1) the information as to which the claimant claims to have (or to have had) a
               reasonable expectation of privacy;

               (2) the facts and matters upon which the claimant relies in support of the
               contention that they had (or have) such a reasonable expectation;

               (3) the use (or threatened use) of the information by the defendant which the
               claimant claims was (or would be) a misuse; and

               (4) any facts and matters upon which the claimant relies in support of their
               contention that their rights not to have the specified information used by the
               defendant in the way alleged outweighed (or outweigh) any rights of the
               defendant to use the information in that manner.


  50. For claims for misuse of confidential information or breach of confidence, the claimant

      must specify in the particulars of claim:
               (1) the information said to be confidential;

               (2) the facts and matters upon which the claimant relies in support of the
               contention that it was (or is) confidential information that the defendant held
               (or holds) under a duty or obligation of confidence;

               (3) the use (or threatened use) of the information by the defendant which the
               claimant claims was (or would be) a misuse of the information or breach of
               that obligation.

  51. The claimant has not pleaded his privacy claim adequately, merely asserting that the
      information that I have already identified – including his name – was information in

      relation to which he had a reasonable expectation of privacy, without setting out the
      facts and matters upon which he relies to support such a contention. Nor does the
      claimant plead the use (or threatened use) of the information, simply stating that “the
      acts of the defendant in disclosing the private information to a third party” was a

      wrongful infringement of the claimant’s privacy rights.

  52. The claimant has not pleaded his confidence claim adequately, failing to identify the
      actual information said to be confidential, why it is said it was confidential information

      held under an obligation of confidence, and the use of the information that is said to
      constitute misuse.

  53. The defendant puts forward a number of different arguments in support of its
      application. I am not going to set them all out. The gist of the defendant’s position is

      that on the facts of this case the claimant could not have had a reasonable expectation,Approved JudgmentLEWIS                                                     Stadler v Currys Group Limited


      of privacy in the data, and that any possible privacy rights that were engaged were
      outweighed by the rights of the defendant to access the television for repair. The

      defendant further relies on the fact that the claimant voluntarily furnished the Smart
      TV to the defendant, and it remained within his power to protect and keep private his
      personal information.

  54. The defendant also highlights what is described as a fundamental defect with the

      claim, namely that complaint is made of a failure by the defendant to take protective
      measures, rather than in respect of some form of positive action by the defendant or
      use of the data.


  55. This last point was considered in some detail in Warren, where Saini J considered that
      neither BoC nor MPI impose a data security duty on the holders of information (even
      if private or confidential). In support of this view, Sani J considered a number of
      authorities, and also quoted from two leading textbooks at [28] and [29], which are

      pertinent to the present case:

           a. Toulson & Phipps at §5-011: "There is a distinction between an equitable duty
               of confidentiality and a duty to take care to prevent confidential information or

               documents from falling into the hands of someone else. The former is an
               obligation of conscience, which requires the recipient not to misuse the
               information or documents. The latter is a duty of a different character and is
               not an automatic concomitant of the former. In the absence of a relevant

               contract, it will arise only if there is a special relationship between the parties
               giving rise to a duty of care under the law of negligence."

           b. Gurry on Breach of Confidence, 2nd ed., §15.41: "Strict liability for misuse of

               information by a defendant also serves to distinguish the duty of confidence
               from a duty of care. Negligence on the part of a defendant is relevant in
               determining whether a duty of confidence has been broken only if the
               negligence results in an unauthorised use or disclosure of the confidential

               information. Care on the part of the defendant is not the measure by which it is
               assessed whether a duty of confidence has been discharged."

  56. In Warren, Saini J also noted that an important part of any claim for MOPI or BOC is

      the need for there to be a “use” made of the information in the form of a positive
      action on the part of the defendant.

  57. The claimant says in his pleading that the wrong was the “disclosure” of private
      information to a third party, but counsel for the claimant confirmed during the hearing

      that the positive step complained of is the resale of the Smart TV without having
      erased the claimant’s personal information.

  58. I accept the defendant’s argument that there is a fundamental defect with the claims for

      MOPI and BOC. In passing the Smart TV to a third party the defendant was not
      making use of the data or information that is the subject of this claim. In fact, there is
      no evidence that the defendant had any actual knowledge of the information in, Approved JudgmentLEWIS                                                    Stadler v Currys Group Limited


       question or made use of it. It follows that there cannot have been any unauthorised use
       (or misuse) of the information by the defendant. It would be artificial to characterise

       the disposal of the Smart TV as a misuse of the information itself. At best, it could be
       said that in failing to wipe the device, the defendant was responsible for breaching a
       duty of data security, but this is insufficient on the facts of this case to make out claims
       for either BOC or MOPI.


   59. Given this, I do not need to consider the other arguments put forward by the Defendant
       in respect of these claims.




Negligence
   60. The negligence claim is pleaded as an alternative cause of action to the claim for

       breach of data protection rights, the claimant noting that the defendant says that the
       DPA and UK-GDPR do not apply to this claim.

   61. The defendant challenges the claim for negligence on two bases.


   62. The first is that it is said that the Court of Appeal has held that there is neither need nor
       warrant to impose a duty of care where the statutory duties under the data protection
       legislation operate. In Warren, Saini J decided that on the facts of that case there was

       no room for the court to construct a concurrent duty in negligence where there existed
       a bespoke statutory regime for determining the liability of data controllers, such
       regime providing for relief of precisely the same nature as is claimed in negligence in
       the claim before him [35]. He found that accordingly there was no duty of care in the

       circumstances of that case.

   63. The second is that there is not a complete cause of action because the claimant has not
       suffered a recoverable loss. Saini J at [40] in Warren noted that “A cause of action in

       tort for recovery of damages for negligence is not complete unless and until damage
       has been suffered by the claimant. Some damage, some harm, or some injury must
       have been caused by the negligence in order to complete the claimant’s cause of

       action. However, a state of anxiety produced by some negligent act or omission but
       falling short of a clinically recognisable psychiatric illness does not constitute damage
       sufficient to complete a tortious cause of action. Compare s.13 of the DPA which, as
       interpreted by the courts, allows compensation for “distress” by reason of

       contravention by a data controller of requirements under the Act”.

   64. In the present case, the only pecuniary loss suffered by the claimant was the cost of the
       film purchased on his account, but this was refunded to him by the defendant. The

       claimant has not brought a claim for personal injury, and simply seeks to recover
       damages for distress and anxiety. He has not therefore suffered any recoverable loss,
       and as a result he has not pleaded a complete cause of action in common law

       negligence. Given this, the negligence claim falls to be dismissed and/or struck out., Approved JudgmentLEWIS                                                   Stadler v Currys Group Limited


   65. In the circumstances, I do not need to consider the defendant’s first ground of
       objection to the negligence claim.



Claims not pursued
   66. The claims for aggravated and exemplary damages and for an injunction are no longer

       pursued, although they have not yet been formally withdrawn by way of pleading
       amendment.

   67. It is difficult to understand on what basis the claimant could have sought to recover
       aggravated and exemplary damages, nor the purpose of an injunction in circumstances
       where it was known that the defendant did not have the Smart TV in its possession.

       These claims appear wholly misconceived and without merit, and I strike them out
       and/or grant the defendant summary judgment in respect of them.

Other matters

   68. The letter before action in this case informed the defendant that proceedings would be
       issued in the High Court and representations made that it be allocated to the Multi-
       Track due to the “complexity of the legal issues” and because the claimant will be

       seeking declaratory and injunctive relief.

   69. The letter before action also placed the defendant on notice that the claimant is funded
       by a post-April 2019 conditional fee agreement. The solicitors informed the defendant

       that their client “will be fully protected by ATE insurance all the way to trial with a
       staged policy premium. As this matter is a privacy claim, such premium will be
       recovered from you at the successful conclusion of this said case. The longer that this
       case is defended/not resolved, the more the said premium will increase”.


   70. In its reply, the defendant explained to the claimant’s solicitor that judges of this court
       have made clear recently that these sorts of modest value claim are not suitable for the
       High Court, or indeed the multi-track. It also drew the claimant’s attention to the

       obligation on ensuring cases are justly and proportionately managed in accordance
       with the overriding objective. It is regrettable that the claimant did not take on board
       this sound advice.


   71. There does not appear to be any reason for this claim to have been issued in the High
       Court. Whilst defamation claims must be issued in the High Court (with limited
       exceptions), the same is not true in respect of the causes of action pursued in this case.


   72. CPR PD7A para 2.9A provides:

       (1) […]a claim relating to media and communications work (which includes any work

           which would fall within the jurisdiction of the Media and Communications List if
           issued in the High Court) may be started in the County Court or High Court; and
           paragraph 2.1 [the £100,000 minimum threshold] shall not apply to such a claim., Approved JudgmentLEWIS                                                    Stadler v Currys Group Limited


       (2) Such a claim should be started in the High Court if, by reason of the factors set out
           in paragraph 2.4(1) to (3), the claimant believes that the claim ought to be dealt

           with by a High Court judge.
       (3) If a claimant starts such a claim in the High Court and the court decides that it
           should have been started in the County Court, the court will normally transfer it to
           the County Court on its own initiative. This is likely to result in delay.


   73. CPR PD7A paragraph 2.4 provides that a claim should be started in the High Court if
       by reason of:
       (1) the financial value of the claim and the amount in dispute, and/or

       (2) the complexity of the facts, legal issues, remedies or procedures involved, and/or
       (3) the importance of the outcome of the claim to the public in general,
       the claimant believes that the claim ought to be dealt with by a High Court judge.


   74. Parties to civil claims are under a duty to ensure that proceedings are conducted in
       accordance with the overriding objective.

   75. This is a very low-value claim. Consumer disputes of equivalent complexity are heard

       every day in the County Court on the small claims track and do not need to be dealt
       with by a High Court judge.

   76. Whilst there will often be good reasons for including more than one cause of action in

       a claim, especially where there are differences between them in respect of proof of
       damage, or heads of loss, parties must always conduct litigation proportionately and in
       accordance with the overriding objective. By including multiple causes of action in

       respect of this low value claim, the claimant has increased the complexity of the
       proceedings unnecessarily.

   77. There has also been tactical skirmishing by both sides. The claimant has made more

       than one attempt to obtain default judgment despite an acknowledgement having been
       filed. The defendant issued a formal application seeking to take technical issues on
       service that were unmeritorious.


   78. This has resulted in the parties having already incurred significant levels of costs. The
       claimant’s costs in respect of these applications are close to £11,000, in addition to
       which there will be his costs of the substantive action. The defendant’s costs for the
       applications are around £5,500. This needs to be considered in the context of a claim

       that might end up being worth just a few hundred pounds, depending on the evidence.


Next steps

   79. The defendant’s initial response to this claim was to seek a declaration pursuant to
       CPR rule 11 that the court has no jurisdiction to try the claim or should not exercise
       any jurisdiction which it may have. The defendant’s challenge on jurisdiction was

       withdrawn at the start of the present hearing. As a result, the acknowledgement of
       service filed by the defendant ceases to have effect: CPR rule 11(7)(a).,HIS HONOUR JUDGE LEWIS                                                      Stadler v Currys Group Limited
Approved Judgment


  80. I will provide the defendant with a further period of 14 days in which to file a further
      acknowledgement if so advised, namely by 11 February 2022. If an acknowledgement
      is lodged, any defence shall be filed and served by 4pm on 25 February 2022.

      Directions questionnaires in form N180 shall be lodged by 4pm on 11 March 2022.

  81. It is agreed that I should now transfer this matter to the County Court. The claimant’s
      local court centre is Hastings. As noted at the start of this judgment, it appears to me
      that the matter should be allocated to the small claims track, although that will be a

      decision for the district judge upon receipt of the defence and directions
      questionnaires.
</pre>