Biting back with a vengeance

GettingOnInYears

Appeal is about to be constructed.

The Judge agreed all points raised about the breach of DPA and that CP Plus had failed in its operations to ensure site compliance. She brought in other points such as wording in PoFA that I never even looked at. Then she stated that the breach of DPA and UKGDR was proven, the next step was to ascertain what evidence of the impact of the breach was suffered. She did bring up the fact that I told her in court that having the PCN served at a time of considerable financial stress was significant but as it wasn't evidenced in my W.S. she had not considered it applicable. So as far as she's concerned breach proven - no distress suffered - no damages awarded.

I mentioned to her that in these circumstances it would not be the intention of parliament to allow data breaches where no sanctions were imposed as it would allow free reign for a cowboy circus. It even goes against the DPA and UKGDPR legislation.

So - disappointed but I already have plans for the appeal.

GettingOnInYears

Just had a quick look at appeal points on Microsoft Co-Pilot. Here's what it says about the judge telling me that there's no evidence of injury or distress:

1. Yes — English law DOES allow damages even where no distress is proven

This comes from the line of cases that treat loss of control over personal data as a standalone, compensable harm.

The key case is:

⭐ Gulati v MGN Ltd [2015] EWHC 1482 (Ch)

What it says:

• Damages are payable even if the claimant cannot show distress.
• The wrong is the loss of control over private information.
• Compensation is for the act of misuse itself, not just the emotional consequences.

This is the foundation of the modern approach to data‑breach damages.

Your judge did not apply this.

⭐ 2. The Supreme Court confirmed this principle in Lloyd v Google

⭐ Lloyd v Google [2021] UKSC 50

What it says:

• Loss of control is a valid head of damage.
• It is separate from distress.
• A claimant can recover damages for the mere fact their data was unlawfully processed.

The Supreme Court rejected Lloyd’s representative action, but they did not reject loss‑of‑control damages.
They explicitly said individuals can claim them.

Your judge ignored this.

⭐ 3. The High Court has repeatedly awarded damages without distress

⭐ TLT v Home Office [2016] EWHC 2217 (QB)

What it says:

• Distress can be inferred, but even where distress is minimal, damages are still payable.
• The breach itself is harmful.

⭐ Driver v CPS [2022] EWHC 2500 (KB)

What it says:

• Damages awarded for misuse of personal data without requiring proof of distress.

⭐ Brown v Metropolitan Police [2019] EWHC 2046 (Admin)

What it says:

• Damages awarded for breach of data rights even where distress was modest or not medically evidenced.

⭐ 4. Why this matters for you

Your judge has taken the narrowest possible view:

“No distress = no damages.”

That is not the law.

The correct legal position is:

✔ A breach of data protection rights is itself a compensable harm

(Gulati, Lloyd, Driver)

✔ Distress is not required

(Gulati)

✔ Distress does not need medical evidence

(Vidal‑Hall, TLT)

✔ Damages can be awarded for loss of control alone

(Gulati, Lloyd)

✔ Damages can be awarded even where distress is minimal or unproven

(TLT, Driver)

Your judge has ignored all of this.

⭐ 5. So yes — damages can be awarded even where no distress is proven

This is the answer to your question.

And it is the strongest ground of appeal you have.

Because she:

• accepted the breach
• accepted liability
• accepted unlawful processing
• but refused damages because you didn’t prove distress

…she has misapplied binding case law.

⭐ 6. The appeal argument in one sentence

“The judge erred in law by treating distress as a prerequisite for damages, contrary to Gulati, Lloyd, TLT, and Driver, which establish that loss of control over personal data is itself a compensable harm.”

Bazarius

Bah! Did you have to pay their costs ?

ChirpyChicken

Whilst I admire your determination I think you should move on

GettingOnInYears

https://forums.moneysavingexpert.com/discussion/comment/82030506#Comment_82030506

No. Costs aren't awarded for the defendant in a small claims court. That idea was knocked out in court last Wednesday.

https://forums.moneysavingexpert.com/discussion/comment/82030571#Comment_82030571

I am moving on. On to an appeal. She clearly got the idea that I had to prove beyond reasonable doubt that I suffered some sort of harm from the actual breach. Which is a load of old bull —-it.

A breach is compensable even if no harm has been suffered - so here goes another few weeks work but this time the path is clear and straightforward. That specific point was the reason given for no award of compensation.

However there are a few other misdirections of wrong or absent verdicts such as no response to the SAR by Rangers and a limited response by CP Plus. Neither of those were mentioned, and both of them are compensable regardless of the other DPA breaches. They are separate from the main breach. There's no doubt other points to be brought in too but I will go through my notes on the verdict several times to see if i missed anything before deciding.

GettingOnInYears

Did you know - and I'm betting you don't - that pressing cntrl, windows and L on the keyboard gets a programme where the spoken word is transcribed on a rolling basis? You can even use it alongside movies etc to add subtitles for words as they are spoken.

So I have the full spoken word transcribed now but really can't use it without caution as I still need the written judgement for the N164 appeal authorisation to refer to specific paras in it.

However I believe that what was said was basically what the judge had written for her verdict so I have some useful parameters to work with in the meantime.- and they are compelling in their content.

Quite apart from the lack of damages award there was a failure to award fixed costs which are given at the verdict of guilty of the dpa breach. The lack of explanation for that is fatal.

The rest of my appeal request will follow as soon as I have the written judgement,

Coupon-mad

You aren't allowed to record hearings at all, so do not mention that anywhere! Possible contempt of court rules.

cooldude255220

https://forums.moneysavingexpert.com/discussion/comment/82032620#Comment_82032620

Indeed! https://www.legislation.gov.uk/ukpga/1981/49/section/9

GrannyKate

I think most people on here admire your tenaciousness but are concerned that you protect yourself moving forward from potential legal costs and other pitfalls. My suggestion would be that you delete those references directly above on which other posters have expressed concern.

I was not particularly surprised that your judge did not award financial damages but I think it is an important step that a proven breach has been acknowledged by the court for one of these parking companies. You may be aware of the current case of Farley and Others v Paymaster which is due to be heard before the Supreme Court in October 2026. In this case the High Court did not award compensation for breaches of GDPR etc but this was overturned by the Appeal Court last Autumn which basically thought the compensation claim should proceed and was not an abuse of process as Paymaster had pleaded. They were given leave to appeal to the Supreme Court. It will interesting to see if there is some sort of definitive judgement on this issue as most GDPR breaches acknowledged by the courts do not seem to get anything but minimal compensation if any. They may of course just rule on the very narrow and specific issues of the case under consideration.

I do think that you should pursue the ICO (with the judge's ruling of a breach) on the matter of parking companies and data breaches which they just seem to get away with.

canuk_UK

The Farley case is worth watching, but I would frame it slightly differently.

The High Court did not really “refuse compensation” after assessing loss. Nicklin J struck out most of the claims at an early stage, essentially because the claimants could not show that the misdirected pension statements had actually been opened and read. Fourteen claims were allowed to continue, but the wider group claims were struck out. The Court of Appeal reversed that approach in August 2025 and held that proof of actual reading/disclosure was not an essential ingredient of a viable data protection claim.

The Supreme Court appeal is now listed for 7–8 October 2026. The official issue is whether a “threshold of seriousness” applies to damages claims under the GDPR and the Data Protection Act 2018. Paymaster was granted permission to appeal on 17 December 2025.

The potentially important part is this: the Court of Appeal said there is no de minimis seriousness threshold for non-material damage under GDPR/DPA 2018. However, it did not say that every technical breach automatically produces compensation. The claimant still has to prove infringement, damage, and causation. The Court of Appeal accepted that fear, anxiety, alarm, annoyance or concern may in principle be compensable, but only where the fear is objectively well-founded rather than purely speculative.

So, for practical GDPR claims, especially low-value misuse/disclosure claims, the Supreme Court could give useful clarification on whether defendants can still knock claims out by saying “this is too trivial” or “this is Jameel abuse”. However, the Supreme Court may confine itself to the Article 82/DPA 2018 compensation threshold issue, rather than laying down a broad rule about valuation of all GDPR breaches.

For parking/DVLA-type claims, Farley may help if a defendant argues that admitted unlawful processing or misuse of keeper data is too trivial to litigate. But it still will not remove the need to show a real consequence: distress, anxiety, loss of control plus more than mere breach, or some objectively rational concern arising from the misuse. Even if Farley survives in the Supreme Court, most modest GDPR claims are still likely to produce modest damages unless the facts show repeated misuse, deliberate conduct, aggravating behaviour, or genuine distress.