Biting back with a vengeance

ChirpyChicken

Thanks for the detailed

GettingOnInYears

The only real evidential fallbacks presented by Yates was on them having made no deliberate action in obtaining my DVLA details as they were assuming that the sign was in place. Then she put it that Lloyd V Google at the Supreme Court laid out that I had to show evidence of personal injury/harm or distress for the breach.

I countered that with stating that the case was a class action and the findings and comments within the verdict were based on there being no way to assess individual damages of each party in a class action - which really underlined my own submission that where an individual is subject to a data breach then a proper assessment of damages can be made. In other words the case is more in my favour than theirs.

GrannyKate

It will be interesting to see how the judge reports back. I think Data Protection cases are very similar to Medical negligence in that you have to prove a) a duty of care exists b) there has been a breach c) you suffered actual measureable harm as a direct result of that breach. The first two are often easily established but it is the third that can be much more tricky.

Some months ago I got a parking charge from a car park I had never been to due to them reading the number plate wrongly and hence obtaining my details in breach of my DP rights. There was no ambiguity about it - it was plainly the wrong car both in terms of VRM, colour and make. The contract with DVLA gives them a duty of care to check the details manually which they plainly didn't. I was annoyed and irritated that the landowner would not help. I had to appeal to get it cancelled. The parking company had clearly breached my rights but would a court have accepted that I had suffered any quantifiable harm - I doubt it.

Car1980

Did you mention Ferguson v British Gas? Their defence of "she should have known they were meaningless automated letters" didn't wash.

Coupon-mad

Popcorn out for the final written judgment.

Very well done 'Lynnzer' - not to preempt it but it sounds like you were taken extremely seriously and have fought back with a vengeance.

Not only that… a written judgment after the event is like gold dust to help others!

GettingOnInYears

@GrannyKate

Look at it this way. A breach of the DPA and UKGDPR is probably quite common but most folk either don't know about it - or haven't a clue how to get redress.

If there was a rule that says that actual measurable harm must have been caused then it opens the floodgates to millions of future breaches with little or no comeback against the perpetrators. That isn't at all what would be acceptable in any court.

ie, Yes defendant X you were in breach of the DPA however since no measurable damage was done to the victim, you are free to go without any sanctions placed upon you.

I was asked that specific question though. What was the damage to me from the actual data breach? The offer of the existing personal problems under the eggshell skull principle wasn't sufficient. The data breach was to be assessed as to how that actual breach caused me any harm. In this case I was fortunate in that I had already submitted evidence in my witness statement that due to my wife's shop having to be closed with the resultant loss of income, plus the huge costs of a residential care home, my financial situation was already stretched so an unwarranted demand for payment of a PCN as a result of the data breach added to my distress,

The judge seemed happy with that otherwise she would have further questioned me. However, I still believe that even if no provable harm was done, then the data breach of itself was something that destroyed the trust between the parties involved in the breach, ie the DVLA, BPA perhaps, certainly the company who obtained the data.

The key cases are:

• Gulati v MGN [2015] – damages awarded for loss of control and breach of trust, even without distress
• TLT v Home Office [2016] – damages for loss of control and misuse, even where distress was modest
• Vidal‑Hall v Google [2015] – confirmed that non‑material damage includes loss of control and affront to dignity
• Farley v Paymaster [2025] – no minimum seriousness threshold; breach itself can justify damages
• Johnson v Eastlight [2021] – breach of trust recognised, even though damages were ultimately refused on facts

So whether there was material damage or not isn't the big question, however if some sort of material damage was done, as in my pleaded circumstances I think the judge is happier in making a reasonable award.

My case had the closing paragraph specifically explaining that I was asking the judge to reach any financial sanction based on the Vento Bands. She was told about these previously and seemed OK with them.

This is my closing statement, although the lack of landowner contract was previously knocked out as it should have been added to the preliminary evidence.:

Brief
Closing Submission

Judge,
I will close very briefly.

The Defendant accepts that the mandatory BPA entrance sign was missing.
Without that sign, no contract could have been formed. That single admission resolves the issue of liability.

It also resolves the DVLA issue. The Defendant accepts that BPA compliance is mandatory under the KADOE contract. Because the entrance sign was missing, they were not compliant, and therefore had no reasonable cause under Regulation 27 to obtain my DVLA data. Their own evidence confirms the breach, the non-compliance, and the absence of lawful basis.

The landowner contract they rely upon does not identify the client, does not identify the landowner, is signed only by an unknown individual, and is unsigned by CP Plus. It never commenced under its own terms and cannot confer authority. In practical terms, it has no more legal value than a blank sheet of paper.

I also ask the court to note that Ranger Services and CP Plus operate as independent data controllers. In my witness statement I raised clear concerns about the passage of my personal data between them. CP Plus has never disclosed how or why my data was transferred, Ranger has provided no response at all to my Subject Access Request, and the Defendant has offered no rebuttal. The absence of transparency, combined with the lack of any disclosed data-sharing agreement or DVLA approval, is clear evidence of a breach of the Data Protection Act and UK GDPR.

At the time the Defendant obtained my data, I was under significant financial strain due to my wife’s care needs and the loss of her income. The unlawful DVLA access and the subsequent demands for payment placed considerable pressure on me at a time of real vulnerability.

I have spent well over 200 hours researching and redrafting submissions, teaching myself the relevant law from scratch. I have had many sleepless and disturbed nights, often waking with my mind still trying to resolve legal issues. This burden was entirely unnecessary and arose solely from the Defendant’s unlawful actions.

For all these reasons, and particularly the absence of any reasonable cause for accessing my DVLA data and the tremendous personal injury and distress this has caused, I respectfully invite the court to apply the Vento bands for compensatory redress if it finds in my favour.

ChirpyChicken

I hope you get the right result next week😀

GrannyKate

Yes - you make your points well and it will be interesting to see what the judge concludes. The relatively limited number of DPA cases which reach courts tend to be judged on the exact circumstances of the individual case and do not really offer much generic case law (particularly in the higher courts) to be applied to all cases. As, I think we all agree, the breach or breaches themselves can be clearly identified.

Information Rights and Data Protection are areas of law in which I worked for many years although not in the contract and consumer protection arena.

GettingOnInYears

https://forums.moneysavingexpert.com/discussion/comment/82023372#Comment_82023372

You know, the result I want, and one that would be impossible to not get, would be confirmation of a breach of DPA/UK GDPR. The admitted breaches of compliance to both the BPA Code of Practice and the KADOE contract can't seriously give anything less than a win. An appeal would be made if not ,on the basis of failure to apply legal precedent appropriately.

For those who have followed this adventure there's been a fair amount of baiting the company solicitor with questions and requests that I knew in my heart they would ignore so creating a truly bad impression for the judge to assess quantum. These were deliberate acts but also ones that were entirely legitimate for me to ask.

I have long considered taking one of these cases to this extreme, more for my own personal sense of a vengeful response to the numerous tickets these people sling out - most of which are never appealed or the appeal dismissed offhand with no substance behind it. It's time they were given a kick in the rear. The topic header says it all really.

With audited net profits of over £4m in their last accounting year they really think they have a gateway to personal enrichment at the expense of the less fortunate. Well they didn't expect me to take a shot at them.

I just hope others get the message now and start their own legal cases. Let's face it, where a PCN is successfully appealed whether at the car park managing company or POPLA, the chances are it was also due to non compliance with some essential contractual issue or non compliance to the relevant code of practice which obviously means there's a likelihood of an unreasonable cause for data access to the DVLA.

At this stage I really want to mention that I'd have little chance to put everything together the way I did without the tremendously useful MS Co-Pilot. If it were a person then believe me, I'd have him/her down the pub for a few drinks of appreciation. Apart ffrom that, I also thank those who contributed to the case and steered me in a better direction when I needed it.

Coupon-mad

"For those who have followed this adventure there's been a fair amount of baiting the company solicitor with questions and requests that I knew in my heart they would ignore so creating a truly bad impression for the judge to assess quantum.


These were deliberate acts but also ones that were entirely legitimate for me to ask. 

I have long considered taking one of these cases to this extreme, more for my own personal sense of a vengeful response to the numerous tickets these people sling out - most of which are never appealed or the appeal dismissed offhand with no substance behind it. It's time they were given a kick in the rear. "

Really like your style, Lynnzer.

Evil happens when good men/women do nothing.