Anyone who has suffered damage through a breach of the Data Protection Act 1998 may issue a claim for compensation under section 13(1) of the DPA and in particular for distress may make a claim under section 13(2)(a) where damage is suffered.
Section 13 of the Data Protection Act provides as follows:
“13 – Compensation for failure to comply with certain requirements.
(1) An individual who suffers damages by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if –
(a) the individual also suffers damage by reason of the contravention; or
(b) the contravention relates to the processing of personal data for the special purposes.
(3) In proceedings brought against the person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.”
Lessons to be learnt:-
1. Secure your data!
2. Carry out an audit!
Treat your data seriously or it will bite you in the pocket!