EWHC (UK) - Stadler v Currys Group Ltd
From GDPRhub
| EWHC (UK) - QB-2021-002102 | |
|---|---|
 | |
| Court: | EWHC (UK) |
| Jurisdiction: | United Kingdom |
| Relevant Law: | 24.2 CPR Article 82 UK-GDPR CPR 3.4 Practice Direction 53B section 168 DPA 2018 section 169 DPA 2018 |
| Decided: | 31.01.2022 |
| Published: | 31.01.2022 |
| Parties: | William Stadler Currys Group Ltd |
| National Case Number/Name: | QB-2021-002102 |
| European Case Law Identifier: | [2022] EWHC 160 (QB) |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | English |
| Original Source: | BAILII (in English) |
| Initial Contributor: | Florian Wuttke |
The UK High Court rejected a data subject's claim for damages under Article 82 UK-GDPR on the basis that they did not suffer any damage, harm or injury, as the defendant reimbursed them after an unauthorised purchase was made on their user account.
English Summary
Facts
The claimant is a data subject who purchased a Smart TV from the defendant, a consumer electronics chain. After a certain period of use, the device broke down. On the device, the claimant had stored personal data such as names, account details and payment data for several apps. The defendant requested the return of the device for repair but the claimant was not asked to delete and/or remove personal data before sending it in. Although faulty, the device had enough functionality to allow a user to log out from any apps. Notably, the claimant did not log out of their Amazon app before leaving the TV with the defendant.
Later, the parties agreed that any repair of the device would be disproportionately costly and so the TV should be written-off. The claimant’s understanding was that the device would be destroyed. However, the defendant re-sold the unit without performing a factory reset or data wipe. Subsequently, someone used the claimant's Amazon account through the unit to make a small in-app purchase. The claimant became aware of the transaction and, following a complaint, the defendant refunded the cost incurred and provided a shopping voucher as a gesture of goodwill.
The claimant argued that the defendant breached its data protection duties by disposing of the device without first wiping any data stored on it, and brought an action for damages in the High Court for misuse of private information, breach of confidence, negligence, and breach of data protection law under Article 82 UK-GDPR and sections 168 and 169 of the Data Protection Act (DPA) 2018.
The defendant applied for the claim to be struck out under 3.4(2)(a) and (b) CPR or, alternatively, to grant summary judgement under 24.2 CPR since “it did not process the data and was not a data controller because it did not know about the data, had not been made aware of it, and reasonably believed it to be the responsibility of the claimant. Furthermore, it says that it only ever held the television as a physical asset and did not make use of the claimant's accounts”.
Holding
The facts of the case were insufficient to make out claims for either misuse of private information or breach of confidence. The claimant’s negligence claim was also dismissed. On the claimant’s data protection claim, the court dismissed the defendant's applications to strike out the claim or give summary judgement, and transferred the case to the County Court.
On the data protection claims:
First, the court considered the claimant's entitlement to damages. Under Art. 82 UK-GDPR “any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.” In relation to contraventions of the UK-GDPR, section 168 DPA 2018 provides that "non-material damage" in Article 82 GDPR includes distress. In relation to breaches of other data protection legislation, section 169 DPA 2018 defines “damage” as including financial loss and damage not involving financial loss, such as distress.
In assessing whether the claim should be struck out on Jameel grounds, consideration was given to Sullivan v Bristol Film Studios Limited [2012] EMLR 27 and whether “there is a means by which the claim can be adjudicated without disproportionate expenditure”. The court acknowledged that if the Smart TV did indeed store bank details and other sensitive personal data, the defendant's handling of the device with the data on it "[could not] be characterised as a trivial breach" [42] and concluded that, although the claim was of low value and arose out of a single incident, it was inappropriate to strike it out on Jameel grounds. Instead, the claim could “be managed in a way that is proportionate to its value through allocation to the small claims track.” [44]
The court considered it conceivable “that the defendant would or should have been aware that there was personal data on the device. [If] the defendant was a data controller, then it would have been under data protection duties in respect of the disposal of data [and] further factual information is needed to evaluate the extent of the defendant's duties to the claimant under data protection legislation”. As such, the court also refused to grant summary judgement. [31]-[33]
On Misuse of Private Information and Breach of Confidence:
The court found that the claimant did not comply with Practice Direction 53B. They failed to specify the actual information said to be confidential and did not plead the use (or threatened use) of the information. [51] However, the court refused to strike out the claim for failure to comply, inter alia, because the Practice Direction does not apply when the remaining claim is transferred to the County Court. [22]
With reference to Toulson & Phipps at §5-011, the court pointed out that an equitable duty of confidentiality requires the defendant not to positively misuse information. In the absence of a contract, any duty of care “to prevent confidential information or documents from falling into the hands of someone else (…) will arise only if there is a special relationship between the parties giving rise to a duty of care under the law of negligence." [55] The court concluded that “there [was] no evidence that the defendant had any actual knowledge of the information.” In “passing the Smart TV to a third party the defendant was not making use of the data or information that is the subject of this claim. (…) It follows that there cannot have been any unauthorised use (or misuse) of the information by the defendant.” [58]
On the negligence claim:
Under Warren v DSG Retail Limited [2021] EWHC 2168 (QB) a cause of action in tort for recovery of damages for negligence requires some damage, harm or injury suffered by the claimant as a result of the negligent act. The court pointed out that “a state of anxiety produced by some negligent act or omission but falling short of a clinically recognisable psychiatric illness does not constitute damage sufficient to complete a tortious cause of action.” Since the claimant was reimbursed for the cost of the film purchased on their account, they had not suffered any recoverable loss.
Comment
This case seemed a relatively straight-forward matter involving a potential one-off data breach with modest financial loss (£3.49) to the data subject, which had already been reimbursed and generously compensated by the controller with a £200 shopping voucher. Nevertheless, the claimant filed the case in the High Court as a Media and Communication Claim under Practice Direction 53B, which requires certain details in the particulars of claim (which the claimant did not complied with). The reasons for allocating the claim to the Multi-Track on the part of the claimant were alleged complex legal issues and the fact that the claimant sought declaratory and injunctive relief.
During pre-action communication the defendant pointed out, with the court’s later approval, “that judges of this court have made clear recently that these sorts of modest value claim are not suitable for the High Court, or indeed the multi-track. It also drew the claimant's attention to the obligation on ensuring cases are justly and proportionately managed in accordance with the overriding objective.” [70]
In its reasoning on striking out the negligence claim, the court pointed out that the claimant has not suffered a recoverable loss [63]. In principle, the same applies to the non-existent material damage in an action for breach of data protection. However, the court considered that Article 82 UK-GDPR, in conjunction with s168 DPA 2018, would also allow compensation for non-material damage, such as distress. The fact that the claimant's alleged disclosure of bank data is not trivial and the admissibility of distress as a ground for compensation under UK-GDPR led the court not to strike out the data protection claim on Jameel grounds. However, the court referred several times to the fact, that it saw no reason why this case should not have been filed directly with the County Court.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the English original. Please refer to the English original for more details.
Neutral Citation Number: [2022] EWHC 160 (QB)
Case No: QB-2021-002102
IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
Royal Courts of Justice
Strand, London, WC2A 2LL
Date: 31 January 2022
Before:
HIS HONOUR JUDGE LEWIS
(sitting as a Judge of the High Court)
- - - - - - - - - - - - - - - - - - - - -
Between:
WILLIAM STADLER Claimant
- and -
CURRYS GROUP LIMITED Defendant
- - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - - - -
Daniel Glover (instructed by Irvings Law) for the Claimant
Gemma McNeil-Walsh (instructed by the in-house legal department) for the Defendant
Hearing date: 29 October 2021
Supplemental written submissions 29 November 2021
- - - - - - - - - - - - - - - - - - - - -
Approved Judgment
I direct that pursuant to CPR PD 39A para 6.1 no official shorthand note shall be taken of this
Judgment and that copies of this version as handed down may be treated as authentic.
.............................
HIS HONOUR JUDGE LEWIS
Covid-19 Protocol: This judgment was handed down remotely by circulation to the parties'
representatives by email and release to Bailii. The date for hand-down is deemed to be on
31 January 2022., Approved JudgmentLEWIS Stadler v Currys Group Limited
His Honour Judge Lewis:
1. This is a consumer dispute about responsibility for the security of data stored on a smart
television when returned to a retailer for repair.
2. The defendant applies on notice for an order striking out the claim pursuant to CPR rule
3.4(2)(a) and (b) and/or for summary judgment pursuant to CPR rule 24.2.
3. The parties have agreed that if any parts of the claim survive these applications, the
matter should be transferred to the County Court.
4. Since the hearing, both parties have filed short supplemental skeletons following the
Supreme Court’s decision in Lloyd v Google LLC [2021] UKSC 50.
5. Based on the witness evidence filed, the following facts do not appear to be disputed to
any material extent:
a. The claimant purchased a smart television from the defendant in September
2016 (“the Smart TV”). The Smart TV allowed the user to access third party
“apps”, one of which was for Amazon Prime.
b. In September 2020, the claimant returned the Smart TV to the defendant for
repair. Although faulty, the Smart TV had enough functionality to allow a
user to log out from any apps.
c. The claimant was not asked by the defendant to clear and/or remove any of the
apps on the Smart TV and was told to pass the device to the defendant’s
employees, together with the remote and power cable (witness statement of the
claimant’s solicitor dated 20.10.2021 at [8]).
d. The claimant did not log out of his Amazon app (or any other apps) before
leaving the Smart TV with the defendant.
e. The defendant’s technical staff determined that any repair of the Smart TV
would be disproportionately costly and so offered to write-off the unit and
compensate the claimant with a voucher. The claimant accepted this offer and
used the voucher to purchase a new television. His understanding was that the
Smart TV would be destroyed.
f. The defendant then sold the Smart TV to a third-party company, without
performing a factory reset or data wipe.
g. On or around 31 December 2020, a movie was purchased for £3.49 by
someone using the claimant’s Amazon account through the Smart TV.
h. The claimant telephoned the defendant. On 2 January 2021, the defendant
reimbursed the claimant for the cost of the Amazon purchase (£5). On 4
January 2021, the defendant contacted the claimant again to make sure that he
had changed his passwords for Amazon and any other apps, and the claimant
confirmed that he had. On 11 January 2021, the defendant provided the
claimant with a £200 shopping voucher as a gesture of goodwill., Approved JudgmentLEWIS Stadler v Currys Group Limited
6. The claimant has now brought proceedings seeking the following:
a. Damages (including aggravated and exemplary damages) up to £5,000 for (i)
misuse of private information (“MOPI”); (ii) breach of confidence (“BoC”);
(iii) negligence; and (iv) breach of data protection law, in particular pursuant
to Article 82 UK-GDPR and sections 168 and 169 of the Data Protection Act
2018.
b. An injunction requiring the defendant, if it continues to process the claimant’s
personal data, to act in accordance with the requirements of the UK-GDPR
and the Data Protection Act 2018.
c. A declaration that by processing the claimant’s personal data the defendant
has breached Article 5(1) of UK-GDPR.
7. The claim for negligence is pleaded in the particulars of claim, but not in the claim
form. Whilst the defendant has taken issue with this, I have proceeded on the basis
that if such a claim were viable, permission to amend the claim form would be granted.
8. This application is being considered at the start of proceedings. The defendant has not
yet filed its defence, nor has either party served its substantive evidence.
The defendant’s application
9. The defendant challenges the claimant’s case on three grounds, namely that: (i) the
pleading discloses no reasonable grounds for bringing a claim in any of the causes of
action pleaded and the claim falls to be struck out pursuant to 3.4(2)(a); (ii) given the
compensation already provided, all that remains is the “distress” purportedly caused to
the claimant during the short period in which he realised his accounts had not been
logged out, and such a claim is “not worth the candle” and falls to be struck out
pursuant to 3.4(2)(b); and/or (iii) the claim has no reasonable prospects of success such
that summary judgment ought to be granted pursuant to CPR 24.2.
10. CPR rule 24.2 provides that the court may give summary judgment against a claimant
or defendant on the whole of a claim or on a particular issue if:
“(a) it considers that—
(i) that claimant has no real prospect of succeeding on the claim or
issue; or
(ii) that defendant has no real prospect of successfully defending the
claim or issue; and
(b) there is no other compelling reason why the case or issue should be
disposed of at a trial”.
11. The approach to be taken when considering a defendant’s application for summary
judgment applications was summarised by Lewison J in Easyair Limited (Trading As
Openair) v Opal Telecom Limited [2009] EWHC 339 (Ch) at [15] (citations
removed):
“i) The court must consider whether the claimant has a “realistic” as opposed to a
“fanciful” prospect of success.,Approved JudgmentLEWIS Stadler v Currys Group Limited
ii) A “realistic” claim is one that carries some degree of conviction. This means a
claim that is more than merely arguable.
iii) In reaching its conclusion the court must not conduct a “mini-trial”.
iv) This does not mean that the court must take at face value and without analysis
everything that a claimant says in his statements before the court. In some cases it may
be clear that there is no real substance in factual assertions made, particularly if
contradicted by contemporaneous documents.
v) However, in reaching its conclusion the court must take into account not only the
evidence actually placed before it on the application for summary judgment, but also
the evidence that can reasonably be expected to be available at trial.
vi) Although a case may turn out at trial not to be really complicated, it does not
follow that it should be decided without the fuller investigation into the facts at trial
than is possible or permissible on summary judgment. Thus the court should hesitate
about making a final decision without a trial, even where there is no obvious conflict
of fact at the time of the application, where reasonable grounds exist for believing that
a fuller investigation into the facts of the case would add to or alter the evidence
available to a trial judge and so affect the outcome of the case.
vii) On the other hand it is not uncommon for an application under Part 24 to give rise
to a short point of law or construction and, if the court is satisfied that it has before it
all the evidence necessary for the proper determination of the question and that the
parties have had an adequate opportunity to address it in argument, it should grasp the
nettle and decide it. The reason is quite simple: if the respondent's case is bad in law,
he will in truth have no real prospect of succeeding on his claim or successfully
defending the claim against him, as the case may be. Similarly, if the applicant's case
is bad in law, the sooner that is determined, the better. If it is possible to show by
evidence that although material in the form of documents or oral evidence that would
put the documents in another light is not currently before the court, such material is
likely to exist and can be expected to be available at trial, it would be wrong to give
summary judgment because there would be a real, as opposed to a fanciful, prospect of
success. However, it is not enough simply to argue that the case should be allowed to
go to trial because something may turn up which would have a bearing on the question
of construction.”
12. CPR rule 3.4 makes provision for the court to strike out a statement of case or part of a
statement of case if it appears that it discloses no reasonable grounds for bringing or
defending a claim. The court may do so if it appears to the court:
(a) that the statement of case discloses no reasonable grounds for bringing or
defending the claim;
(b) that the statement of case is an abuse of the court’s process or is otherwise
likely to obstruct the just disposal of the proceedings; or
(c) that there has been a failure to comply with a rule, practice direction or
court order, Approved JudgmentLEWIS Stadler v Currys Group Limited
13. The approach to strike out applications under the first limb was summarised in
Duchess of Sussex v Associated Newspapers Limited [2020] EWHC 1058 (Ch) at
[33]:
“(2) An application under CPR 3.4(2)(a) calls for analysis of
the statement of case, without reference to evidence. The
primary facts alleged are assumed to be true. The Court should
not be deterred from deciding a point of law; if it has all the
necessary materials it should “grasp the nettle”: ICI Chemicals
& Polymers Ltd v TTE Training Ltd [2007] EWCA Civ 725,
But it should not strike out under this sub-rule unless it is
“certain” that the statement of case, or the part under attack
discloses no reasonable grounds of claim: Richards (t/a Colin
Richards & Co) v Hughes [2004] EWCA Civ 266 [2004]
PNLR 35 [22]. Even then, the Court has a discretion; it should
consider whether the defect might be cured by amendment; if
so, it may refrain from striking out and give an opportunity to
make such an amendment.”
The claimant’s case
14. The claimant says that the facts in the present action remain disputed and controversial
and need to be determined at trial.
15. The main areas of factual uncertainty and/or dispute in the case appear to be:
a. What information about the claimant was, in fact, stored on the Smart TV, or
accessible through apps on the device that were logged in.
b. Whether the claimant told the defendant at the outset that he had undertaken a
reset of his Smart TV, which would have meant that he was not logged into his
apps.
c. Whether the repairs undertaken were subject to terms and conditions of the
defendant, and what those terms said about data.
d. The basis upon which the claimant agreed that the defendant could dispose of
the Smart TV, and the terms on which matters were concluded.
16. In respect of sub-paragraph (a), namely what data was stored on or accessible from the
television, the claimant’s position has been as follows:
a. The claimant’s detailed letter of claim stated that the claimant was logged into
Amazon, Sky, Disney Plus, BT Sport and BBC iPlayer, and that these
applications “would have contained all of the claimant’s personal and financial
details”. It was also said that the claimant used the television to access his
bank accounts, and YouTube: “clearly, the TV contained vast amounts of
personal/financial and or sensitive information which belonged to the, Approved JudgmentLEWIS Stadler v Currys Group Limited
claimant. The TV (with all of this information) was subsequently passed on to
a third party”.
b. The claimant’s solicitor subsequently signed a witness statement, with
statement of truth, confirming as a fact that “the television in question
contained a vast amount of personal, financial and sensitive information”
(witness statement at [13]).
c. The claimant’s pleaded case is much narrower, namely that the personal data
(and private information) of the claimant that was compromised included inter
alia the following: (i) name; (ii) account details for several apps and or
accounts including Amazon Prime, Sky, Netflix, Disney Plus and BT; and (iii)
payment details in respect of the above accounts.
d. The claimant’s pleaded case remains unclear about what is meant by “account
details”, and to what extent any of this information (in particular, payment
details) would have been available to someone in possession of the television
without the account password.
17. The claimant’s case in relation to damages has also been inconsistent:
a. In his letter before claim, the claimant’s solicitors said: “The claimant has
suffered psychological injury/ discomfort/ distress/ inconvenience/ damage.
In this regard, the claimant will seek to rely upon the case of TLU & Others v
SOS Home Department as support for the assertion that psychological/
psychiatric injury can form part of “distress”. Further by reason of the
claimant having endured additional humiliation and suffering as a result of
your wrong-doing he also claims aggravated damages.”
b. The claimant’s solicitor subsequently signed a witness statement, with
statement of truth, simply confirming that when the claimant discovered a
movie had been purchased on his account he was “surprised and concerned”
(witness statement at [12]).
c. The particulars of claim state that as a result of the defendant’s actions, he
“suffered psychological distress, anxiety, loss and damage. The distress and
anxiety have been exacerbated due to the sensitive personal and financial
nature of the data that was unlawfully processed by the Defendant and
accessed by a third party”.
Pleadings in media and communications claims
18. As these proceedings were issued in the High Court, they were allocated to the Media
and Communications List of the Queen’s Bench Division (“MAC List”), see CPR rule
53.
19. Claims proceeding in the MAC List must be conducted in accordance with PD53B,
which prescribes the matters that parties are required to address in their pleadings., Approved JudgmentLEWIS Stadler v Currys Group Limited
20. PD53B only applies to cases in the MAC List. It does not apply to cases in the County
Court, even if they include causes of action that would be allocated to the MAC List if
in the High Court. That said, parties to County Court actions still need to plead their
cases properly and so they would be well advised to follow PD53B, regardless of
whether they are required to do so.
21. The defendant takes issue in this case with the adequacy of the claimant’s pleadings,
which in many respects do not comply with CPR PD 53B.
22. I have considered whether to strike out all or part of the particulars of claim as a result
of the failure to comply with PD53B. I have decided not to do so, for three reasons.
Firstly, if any part of the case appears meritorious, the proper course would likely be to
provide the claimant with an opportunity to apply to amend the pleading. Secondly,
there is enough information about the substance of the claimant’s case for me to be
able to deal with the applications before me, avoiding the cost of re-hearing the
application after pleadings have been amended. Thirdly, it is agreed that if the claim
survives then it will be transferred to the County Court, where PD53B technically does
not apply.
Data Protection
23. The claimant relies on Article 82, as supplemented by s.168 of the Data Protection Act
2018. Article 82 of the UK-GDPR provides data subjects with a right to civil
compensation for data breaches by a controller. The relevant parts read as follows:
“1. Any person who has suffered material or non-material damage as a result of an
infringement of this Regulation shall have the right to receive compensation from the
controller or processor for the damage suffered.
2. Any controller involved in processing shall be liable for the damage caused by
processing which infringes this Regulation. A processor shall be liable for the damage
caused by processing only where it has not complied with obligations of this
Regulation specifically directed to processors or where it has acted outside or contrary
to lawful instructions of the controller.
3. A controller or processor shall be exempt from liability under paragraph 2 if it
proves that it is not in any way responsible for the event giving rise to the damage…”
24. Section 168 of the DPA provides that “In Article 82 of the GDPR (right to
compensation for material or non-material damage), "non-material damage" includes
distress.”
25. Section 169 of the DPA provides for compensation for damage contravention of other
data protection legislation, “damage” being defined as including financial loss and
damage not involving financial loss, such as distress.,Approved JudgmentLEWIS Stadler v Currys Group Limited
26. The claimant says he was a data subject, and the defendant was the data controller. He
says that the defendant breached its data protection duties in disposing of the television
without first wiping any data stored on it. In support of his case, the claimant refers to
the following:
a. The Information Commissioner’s Office guidance on “IT asset disposal for
organisations” which explains to data controllers what they need to consider
when disposing of electronic equipment that may contain personal data,
including the deletion of such data before devices are recycled or disposal.
b. The defendant’s own trade-in website which provides that: “keeping your data
and sensitive information secure is our top priority. When we receive a device
for trade-in we (or an approved third party) wipe the data stored on it – this is
done to Infosec Standard 5 (the same standard as the UK government data
destruction)”. I note that this was not a trade-in and that the defendant says
that it does not operate a data erasure solution in respect of returned/faulty
items which are then re-sold onto other consumers.
27. Whilst not of direct application, the claimant has also referred to a decision in a local
court in Germany on 5 October 2020 which concluded that resale of a laptop which
contained personal information constituted a violation of the data protection law and
compensation of Euro 800 was payable pursuant to art 82 GDPR: Hildesheim (file
number 43 C145/19).
28. The defendant firstly takes issue with the adequacy of the pleading of the data
protection claim. CPR PD 53B paragraph 9 provides that in any claim for breach of
any data protection legislation the claimant must specify in the particulars of claim (1)
the legislation and the provision that the claimant alleges the defendant has breached;
(2) any specific data or acts of processing to which the claim relates; (3) the specific
acts or omissions said to amount to such a breach, and the claimant’s grounds for that
allegation; and (4) the remedies which the claimant seeks.”
29. The defendant says that the claimant has not pleaded with sufficient particularity the
acts of processing relied upon, merely stating that the defendant “failed to safeguard
the data protection rights of the claimant” and that the information was not “processed
fairly or lawfully” and processed “in a manner that was incompatible with the
specified, explicit and legitimate purpose for which it was collected”.
30. The defendant accepts that the data stored on the television would constitute “personal
data”, but it does not accept that it was necessarily private or confidential. The
defendant says that it did not process the data and was not a data controller because it
did not know about the data, had not been made aware of it, and reasonably believed it
to be the responsibility of the claimant. Furthermore, it says that it only ever held the
television as a physical asset and did not make use of the claimant’s accounts, and it
was the third party who was responsible for the event giving rise to the damage, ie
purchasing the film. The defendant also says that the claimant’s complaint appears to,Approved JudgmentLEWIS Stadler v Currys Group Limited
be about the defendant’s failure to log out of the apps (or wipe the device), which is an
omission which cannot amount to data processing.
31. I am not satisfied that it is appropriate to grant the defendant summary judgment on the
data protection claim for two reasons.
32. Firstly, further factual information is needed to evaluate the extent of the defendant’s
duties to the claimant under data protection legislation, in particular in respect of what
was said between the parties when the device was handed over, and when it was
agreed it would be scrapped, and what terms and conditions applied to the repair and
subsequent disposal.
33. Secondly, I consider that the data protection claim has a reasonable prospect of
success. On the basis of the claimant’s account of events, it seems that the defendant
would or should have been aware that there was personal data on the device, and it is
certainly arguable that it had duties as a data controller, particularly if at any point it
became the owner of the Smart TV. If the defendant was a data controller, then it
would have been under data protection duties in respect of the disposal of data, which
is a form of processing, Article 7(2) GDPR. These are matters to be considered at a
final hearing, and not determined on a summary basis.
34. The defendant also seeks to strike out the data protection claim on the basis that it is
trivial and below a threshold of seriousness, or alternatively that it is an abuse to allow
the claim to proceed, following the principles identified in Jameel (below).
35. A threshold of seriousness applies to claims under section 13 Data Protection Act
1998. In Lloyd v Google [2020] QB 747 the Chancellor said “I understood it to be
common ground that the threshold of seriousness applied to section 13 as much as to
misuse of private information. That threshold would undoubtedly exclude, for
example, a claim for damages for an accidental one-off data breach that was remedied
quickly” at [55]. The Supreme Court in Lloyd (supra) proceeded on the basis that
there is a threshold that applies to data protection claims: Lord Leggatt (with whom the
other judges all agreed) referred on a number of occasions to the fact that the potential
for damages applies to non-trivial claims: see [88], [115], [128], [137] and [138].
36. The parties agree that in the context of DPA 1998, claims under s.13, damages for
‘non-trivial’ breaches are not recoverable unless there is proof of damage or distress.
This position would appear to apply equally to claims under Article 82 UK-GDPR.
37. An example of the application of the de minimis principle can be found in the decision
of Master McCloud in Rolfe & others v Veale Wasbrough Vizards LLP [2021]
EWHC 2809 (QB), which was a claim in respect of a single email about late payment
of school fees that was sent to the wrong person, who confirmed they had deleted it
without reading.,Approved JudgmentLEWIS Stadler v Currys Group Limited
38. The question of Jameel abuse in data protection claims was considered by Nicklin J in
Harlow Higinbotham (formerly BWK) v Teekhungam & another [2018] EWHC
1880 (QB):
“Jameel.
44. Again, there is not much dispute as to the legal principles
to be applied:
i) The Court has jurisdiction to stay or strike out a claim where
no real or substantial wrong has been committed and litigating
the claim will yield no tangible or legitimate benefit to the
claimant proportionate to the likely costs and use of court
procedures: in other words, " the game is not worth the candle
": Jameel [69]-[70] per Lord Phillips MR and Schellenberg –v-
BBC [2000] EMLR 296 , 319 per Eady J. The jurisdiction is
useful where a claim " is obviously pointless or wasteful ":
Vidal-Hall –v- Google Inc [2016] QB 1003 [136] per Lord
Dyson MR.
ii) Nevertheless, striking out is a draconian power and it should
only be used in exceptional cases: Stelios Haji-Ioannou –v-
Dixon [2009] EWHC 178 (QB) [30] per Sharp J.
iii) It is not appropriate to carry out a detailed assessment of
the merits of the claim. Unless obvious that it has very little
prospect of success, the claim should be taken at face value:
Ansari –v- Knowles [2014] EWCA Civ 1448 [17] per Moore-
Bick LJ and [27] per Vos LJ.
iv) The Court should only conclude that continued litigation of
the claim would be disproportionate to what could legitimately
be achieved where it is impossible " to fashion any procedure
by which that claim can be adjudicated in a proportionate way
": Ames –v- Spamhaus Project Ltd [2015] 1 WLR 3409 [33]-
[36] per Warby J citing Sullivan –v- Bristol Film Studios Ltd
[2012] EMLR 27 [29]-[32] per Lewison LJ.
45. By ground 3, the Claimant contends that the Master was
wrong to extend the Jameel abuse jurisdiction to Data
Protection Act claims. No authority has been cited for that
proposition and I am satisfied that it is not correct: see Vidal-
Hall [134]-[136] (itself a data protection claim) and Sullivan -
v- Bristol Films , supra .”
39. The fact that a claim is of low value does not mean that the court should necessarily
refuse to hear it. This was considered in Sullivan v Bristol Film Studios Limited
[2012] EMLR 27 in which it was said that: “when… a judge is confronted by an
application to strike out a claim on the ground that the game is not worth the candle he
or she should consider carefully whether there is a means by which the claim can be
adjudicated without disproportionate expenditure” per Lewison LJ at [32]. A similar, Approved JudgmentLEWIS Stadler v Currys Group Limited
point was made in that case by Etherton LJ at [44] “consideration could have been
given to transfer to… an appropriate county court for (re-)allocation on the small
claims track”.
40. In this case, the claim is unquestionably of low value. It arises out of a single incident
– namely the disposal of the Smart TV without wiping the claimant’s personal data -
and matters were remedied promptly.
41. Whilst the defendant is sceptical that the Smart TV will have held all the information
identified by the claimant - in particular bank details and other significant personal
information in respect of each app - I acknowledge that this is the claimant’s pleaded
case. A statement of truth has been signed on the claimant’s behalf. This can only
have been signed by the claimant’s solicitor on the express instructions of the
claimant, confirming the claimant’s belief that the factual matters set out in the
pleading are true.
42. If what the pleading says is correct, then in my view this cannot be characterised as a
trivial breach given the nature of the information disclosed, and the fact that it appears
at least one of the apps has been used by a stranger since the Smart TV was re-sold.
43. I am, however, concerned that it would be disproportionate to allow such a low value
claim to be litigated in the way that it is, with all the costs that arise out of High Court
litigation. If this was a type of claim that would not be transferred to the County Court
and the small claims track, for example for defamation, then it seems there would be
good reasons for striking it out on Jameel grounds – the claim would simply not be
worth the candle.
44. In my judgment, this claim can, however, be managed in a way that is proportionate to
its value through allocation to the small claims track. This would allow for it to be
dealt with under what was intended to be an informal process, with limited additional
work needed to prepare for a two or three-hour final hearing. Given this, applying
Sullivan (supra), it is not appropriate for the claim to be struck out on Jameel grounds.
45. I dismiss the defendant’s applications in respect of the data protection claims.
Privacy and Confidence
46. I will consider next the claims for MOPI and BOC.
47. Warren v DSG Retail Limited [2021] EWHC 2168 (QB) was a case in which
damages were sought against Currys for distress arising out of the loss of personal data
on basis of breach of confidence, misuse of private information, breach of the Data
Protection Act 1998 and common law negligence. The data loss occurred after
Currys’ systems had been infected by malware following a cyber-attack, resulting in
the disclosure to the hackers of the claimant’s name, address, phone number, date of
birth and email address. The parties accepted in Warren that the data protection claim
should be transferred to the County Court for determination. Saini J dismissed and/or
struck out all the remaining causes of action. Whilst the facts of Warren are different,Approved JudgmentLEWIS Stadler v Currys Group Limited
to those in this case, much of Saini J’s analysis of the claims is of application in this
case.
48. Where privacy and confidence claims are brought in the High Court, CPR PD53B
paragraph 8 sets out the information that the claimant is required to specify in the
particulars of claim.
49. For privacy claims, the claimant must specify:
(1) the information as to which the claimant claims to have (or to have had) a
reasonable expectation of privacy;
(2) the facts and matters upon which the claimant relies in support of the
contention that they had (or have) such a reasonable expectation;
(3) the use (or threatened use) of the information by the defendant which the
claimant claims was (or would be) a misuse; and
(4) any facts and matters upon which the claimant relies in support of their
contention that their rights not to have the specified information used by the
defendant in the way alleged outweighed (or outweigh) any rights of the
defendant to use the information in that manner.
50. For claims for misuse of confidential information or breach of confidence, the claimant
must specify in the particulars of claim:
(1) the information said to be confidential;
(2) the facts and matters upon which the claimant relies in support of the
contention that it was (or is) confidential information that the defendant held
(or holds) under a duty or obligation of confidence;
(3) the use (or threatened use) of the information by the defendant which the
claimant claims was (or would be) a misuse of the information or breach of
that obligation.
51. The claimant has not pleaded his privacy claim adequately, merely asserting that the
information that I have already identified – including his name – was information in
relation to which he had a reasonable expectation of privacy, without setting out the
facts and matters upon which he relies to support such a contention. Nor does the
claimant plead the use (or threatened use) of the information, simply stating that “the
acts of the defendant in disclosing the private information to a third party” was a
wrongful infringement of the claimant’s privacy rights.
52. The claimant has not pleaded his confidence claim adequately, failing to identify the
actual information said to be confidential, why it is said it was confidential information
held under an obligation of confidence, and the use of the information that is said to
constitute misuse.
53. The defendant puts forward a number of different arguments in support of its
application. I am not going to set them all out. The gist of the defendant’s position is
that on the facts of this case the claimant could not have had a reasonable expectation,Approved JudgmentLEWIS Stadler v Currys Group Limited
of privacy in the data, and that any possible privacy rights that were engaged were
outweighed by the rights of the defendant to access the television for repair. The
defendant further relies on the fact that the claimant voluntarily furnished the Smart
TV to the defendant, and it remained within his power to protect and keep private his
personal information.
54. The defendant also highlights what is described as a fundamental defect with the
claim, namely that complaint is made of a failure by the defendant to take protective
measures, rather than in respect of some form of positive action by the defendant or
use of the data.
55. This last point was considered in some detail in Warren, where Saini J considered that
neither BoC nor MPI impose a data security duty on the holders of information (even
if private or confidential). In support of this view, Sani J considered a number of
authorities, and also quoted from two leading textbooks at [28] and [29], which are
pertinent to the present case:
a. Toulson & Phipps at §5-011: "There is a distinction between an equitable duty
of confidentiality and a duty to take care to prevent confidential information or
documents from falling into the hands of someone else. The former is an
obligation of conscience, which requires the recipient not to misuse the
information or documents. The latter is a duty of a different character and is
not an automatic concomitant of the former. In the absence of a relevant
contract, it will arise only if there is a special relationship between the parties
giving rise to a duty of care under the law of negligence."
b. Gurry on Breach of Confidence, 2nd ed., §15.41: "Strict liability for misuse of
information by a defendant also serves to distinguish the duty of confidence
from a duty of care. Negligence on the part of a defendant is relevant in
determining whether a duty of confidence has been broken only if the
negligence results in an unauthorised use or disclosure of the confidential
information. Care on the part of the defendant is not the measure by which it is
assessed whether a duty of confidence has been discharged."
56. In Warren, Saini J also noted that an important part of any claim for MOPI or BOC is
the need for there to be a “use” made of the information in the form of a positive
action on the part of the defendant.
57. The claimant says in his pleading that the wrong was the “disclosure” of private
information to a third party, but counsel for the claimant confirmed during the hearing
that the positive step complained of is the resale of the Smart TV without having
erased the claimant’s personal information.
58. I accept the defendant’s argument that there is a fundamental defect with the claims for
MOPI and BOC. In passing the Smart TV to a third party the defendant was not
making use of the data or information that is the subject of this claim. In fact, there is
no evidence that the defendant had any actual knowledge of the information in, Approved JudgmentLEWIS Stadler v Currys Group Limited
question or made use of it. It follows that there cannot have been any unauthorised use
(or misuse) of the information by the defendant. It would be artificial to characterise
the disposal of the Smart TV as a misuse of the information itself. At best, it could be
said that in failing to wipe the device, the defendant was responsible for breaching a
duty of data security, but this is insufficient on the facts of this case to make out claims
for either BOC or MOPI.
59. Given this, I do not need to consider the other arguments put forward by the Defendant
in respect of these claims.
Negligence
60. The negligence claim is pleaded as an alternative cause of action to the claim for
breach of data protection rights, the claimant noting that the defendant says that the
DPA and UK-GDPR do not apply to this claim.
61. The defendant challenges the claim for negligence on two bases.
62. The first is that it is said that the Court of Appeal has held that there is neither need nor
warrant to impose a duty of care where the statutory duties under the data protection
legislation operate. In Warren, Saini J decided that on the facts of that case there was
no room for the court to construct a concurrent duty in negligence where there existed
a bespoke statutory regime for determining the liability of data controllers, such
regime providing for relief of precisely the same nature as is claimed in negligence in
the claim before him [35]. He found that accordingly there was no duty of care in the
circumstances of that case.
63. The second is that there is not a complete cause of action because the claimant has not
suffered a recoverable loss. Saini J at [40] in Warren noted that “A cause of action in
tort for recovery of damages for negligence is not complete unless and until damage
has been suffered by the claimant. Some damage, some harm, or some injury must
have been caused by the negligence in order to complete the claimant’s cause of
action. However, a state of anxiety produced by some negligent act or omission but
falling short of a clinically recognisable psychiatric illness does not constitute damage
sufficient to complete a tortious cause of action. Compare s.13 of the DPA which, as
interpreted by the courts, allows compensation for “distress” by reason of
contravention by a data controller of requirements under the Act”.
64. In the present case, the only pecuniary loss suffered by the claimant was the cost of the
film purchased on his account, but this was refunded to him by the defendant. The
claimant has not brought a claim for personal injury, and simply seeks to recover
damages for distress and anxiety. He has not therefore suffered any recoverable loss,
and as a result he has not pleaded a complete cause of action in common law
negligence. Given this, the negligence claim falls to be dismissed and/or struck out., Approved JudgmentLEWIS Stadler v Currys Group Limited
65. In the circumstances, I do not need to consider the defendant’s first ground of
objection to the negligence claim.
Claims not pursued
66. The claims for aggravated and exemplary damages and for an injunction are no longer
pursued, although they have not yet been formally withdrawn by way of pleading
amendment.
67. It is difficult to understand on what basis the claimant could have sought to recover
aggravated and exemplary damages, nor the purpose of an injunction in circumstances
where it was known that the defendant did not have the Smart TV in its possession.
These claims appear wholly misconceived and without merit, and I strike them out
and/or grant the defendant summary judgment in respect of them.
Other matters
68. The letter before action in this case informed the defendant that proceedings would be
issued in the High Court and representations made that it be allocated to the Multi-
Track due to the “complexity of the legal issues” and because the claimant will be
seeking declaratory and injunctive relief.
69. The letter before action also placed the defendant on notice that the claimant is funded
by a post-April 2019 conditional fee agreement. The solicitors informed the defendant
that their client “will be fully protected by ATE insurance all the way to trial with a
staged policy premium. As this matter is a privacy claim, such premium will be
recovered from you at the successful conclusion of this said case. The longer that this
case is defended/not resolved, the more the said premium will increase”.
70. In its reply, the defendant explained to the claimant’s solicitor that judges of this court
have made clear recently that these sorts of modest value claim are not suitable for the
High Court, or indeed the multi-track. It also drew the claimant’s attention to the
obligation on ensuring cases are justly and proportionately managed in accordance
with the overriding objective. It is regrettable that the claimant did not take on board
this sound advice.
71. There does not appear to be any reason for this claim to have been issued in the High
Court. Whilst defamation claims must be issued in the High Court (with limited
exceptions), the same is not true in respect of the causes of action pursued in this case.
72. CPR PD7A para 2.9A provides:
(1) […]a claim relating to media and communications work (which includes any work
which would fall within the jurisdiction of the Media and Communications List if
issued in the High Court) may be started in the County Court or High Court; and
paragraph 2.1 [the £100,000 minimum threshold] shall not apply to such a claim., Approved JudgmentLEWIS Stadler v Currys Group Limited
(2) Such a claim should be started in the High Court if, by reason of the factors set out
in paragraph 2.4(1) to (3), the claimant believes that the claim ought to be dealt
with by a High Court judge.
(3) If a claimant starts such a claim in the High Court and the court decides that it
should have been started in the County Court, the court will normally transfer it to
the County Court on its own initiative. This is likely to result in delay.
73. CPR PD7A paragraph 2.4 provides that a claim should be started in the High Court if
by reason of:
(1) the financial value of the claim and the amount in dispute, and/or
(2) the complexity of the facts, legal issues, remedies or procedures involved, and/or
(3) the importance of the outcome of the claim to the public in general,
the claimant believes that the claim ought to be dealt with by a High Court judge.
74. Parties to civil claims are under a duty to ensure that proceedings are conducted in
accordance with the overriding objective.
75. This is a very low-value claim. Consumer disputes of equivalent complexity are heard
every day in the County Court on the small claims track and do not need to be dealt
with by a High Court judge.
76. Whilst there will often be good reasons for including more than one cause of action in
a claim, especially where there are differences between them in respect of proof of
damage, or heads of loss, parties must always conduct litigation proportionately and in
accordance with the overriding objective. By including multiple causes of action in
respect of this low value claim, the claimant has increased the complexity of the
proceedings unnecessarily.
77. There has also been tactical skirmishing by both sides. The claimant has made more
than one attempt to obtain default judgment despite an acknowledgement having been
filed. The defendant issued a formal application seeking to take technical issues on
service that were unmeritorious.
78. This has resulted in the parties having already incurred significant levels of costs. The
claimant’s costs in respect of these applications are close to £11,000, in addition to
which there will be his costs of the substantive action. The defendant’s costs for the
applications are around £5,500. This needs to be considered in the context of a claim
that might end up being worth just a few hundred pounds, depending on the evidence.
Next steps
79. The defendant’s initial response to this claim was to seek a declaration pursuant to
CPR rule 11 that the court has no jurisdiction to try the claim or should not exercise
any jurisdiction which it may have. The defendant’s challenge on jurisdiction was
withdrawn at the start of the present hearing. As a result, the acknowledgement of
service filed by the defendant ceases to have effect: CPR rule 11(7)(a).,HIS HONOUR JUDGE LEWIS Stadler v Currys Group Limited
Approved Judgment
80. I will provide the defendant with a further period of 14 days in which to file a further
acknowledgement if so advised, namely by 11 February 2022. If an acknowledgement
is lodged, any defence shall be filed and served by 4pm on 25 February 2022.
Directions questionnaires in form N180 shall be lodged by 4pm on 11 March 2022.
81. It is agreed that I should now transfer this matter to the County Court. The claimant’s
local court centre is Hastings. As noted at the start of this judgment, it appears to me
that the matter should be allocated to the small claims track, although that will be a
decision for the district judge upon receipt of the defence and directions
questionnaires.
