Data breach?

Ca64

Hello all. 

For some unfortunate reason, I keep ending up in data breaches. First easy jet, they specifically took my flight details and address only so I was extremely worried my home would be targeted when I was away, I am involved in a group action for this (no win no fee). 

However, I have since had a notification from both timberland shoes and now Moonpig. 

It’s getting really frustrating that companies say they can keep my data safe. 

My question is should I be perusing compensation for these and if so, does anyone have any experience in this? 

I’ve tried to check the citizens advice website but I can’t find anything relevant.  

Thanks, 

la531983

What are your quantifiable losses?

Brie

la531983 said:

What are your quantifiable losses?

other than peace of mind?  well then it's all future possibilities and potentially ones you don't spot as you're on holiday or whatever.

Browntoa

So zero losses 

Ca64

la531983 said:

What are your quantifiable losses?

Hello. Nothing financial thankfully. Although I am getting a lot of spam emails which are very annoying. I have also been told in an email by timberland shoes “the incident may result in attempts of identity theft, phishing and possibly fraud in general” - so I guess I have that to look forward to potentially. 

Okell

My understanding is that with data breaches it is not necessary for the data subject to have suffered any quantifiable or material losses to pursue a claim against a data processor in breach

The GDPR allows people who have suffered data breaches to claim damages in court for non-material damage such as "distress".

Taking your case to court and claiming compensation | ICO

But that's not the same as saying that the OP actually has a valid claim.  How do they prove their level of distress...?

Aylesbury_Duck

You can pursue (not peruse) compensation, but normally you'd have to demonstrate incurred costs.  What might be a reasonable approach is to ask the latest breached business to pay for things like security products for a period, to help protect you.  I can't recall the company but there was a thread on here a while ago where a breached company did just that.  No harm in asking.

PHK

Okell said:

My understanding is that with data breaches it is not necessary for the data subject to have suffered any quantifiable or material losses to pursue a claim against a data processor in breach

The GDPR allows people who have suffered data breaches to claim damages in court for non-material damage such as "distress".

Taking your case to court and claiming compensation | ICO

But that's not the same as saying that the OP actually has a valid claim.  How do they prove their level of distress...?

That’s a page about taking media organisations to court ?

RefluentBeans

Agreed with above - normally for compensation you need to show your losses. This is hard when your losses are speculative or in the future. The joint actions from solicitors may be the way to go (assuming they are NWNF) as you don’t lose anything but outside of that, I don’t think it really worth advancing it in court, unless you suffer material losses that you can link to the breach. 

It’s worth mentioning though, for example, if say Moonpig suffers a data breach and lose login information (passwords, email addresses etc) and then someone logins to your bank and steals all your money because you used the same password for all your accounts then I think Moonpig would have a valid claim that you were negligent by not following advised security practices such as using a strong different password for each account. 

Ultimately - I think you’d need to show not only that you’ve experience quantifiable losses but that they acted negligently. There’s a difference between them storing information in a plain text database where anyone can access it without a password, compared to a database where secure information is hashed first, and the database itself is encrypted, and different databases store different information so loss of one database wouldn’t be lose all information about someone. A breach doesn’t mean that they were inherently negligent, just as your insurance company can’t say you were negligent if someone breaks into your house! 

Okell

PHK said:

Okell said:

My understanding is that with data breaches it is not necessary for the data subject to have suffered any quantifiable or material losses to pursue a claim against a data processor in breach

The GDPR allows people who have suffered data breaches to claim damages in court for non-material damage such as "distress".

Taking your case to court and claiming compensation | ICO

But that's not the same as saying that the OP actually has a valid claim.  How do they prove their level of distress...?

That’s a page about taking media organisations to court ?

Hmmm.  That page on the ICO site certainly refers to "media organisations", but I was under the impression that the right to compensation for "distress" applied to any organisation* that held and/or processed personal data.

Maybe I'm mistaken but I thought it was covered by s168(1) of the Data Protection Act 2018 (legislation.gov.uk) and Art. 82 GDPR – Right to compensation and liability - General Data Protection Regulation (GDPR) (gdpr-info.eu)

Neither of those seem to be limited to "media orgnanisations" and both clearly state that victims of a data breach can sue in court for "distress" and do not need to demonstrate any material or financial or otherwise quantifiable loss.

That's not to say that proving distress is easy, but I thought that courts had awarded relatively nominal damages to "punish" organisations in breach eg in the range of £100 - £500.

But maybe I've got that wrong(?).


*I can't imagine why the right to compensation would be restricted to media organisations...

user1977

Surely it depends on the type of data which has gone astray - most websites which have any details for me aren't going to know more than my name, email address and a (generally unique) password, so no real scope for distress (unless the nature of the website itself may cause embarrassment!). Obviously a bigger deal if there is financial, medical etc info at stake.