Osbornes Instructed After Local Authority Data Breach

Osbornes Law have recently negotiated a settlement on behalf of two clients who had their personal information inadvertently released to the birth parents of their adoptive child during adoption proceedings by the Local Authority. The birth parents had opposed the adoption from the outset and both had recent and serious criminal convictions, and had both been sent bundles in which our clients’ confidential and sensitive personal information was contained. The information which was disclosed included our clients’ names, addresses, dates of birth, photographs, signatures and other sensitive personal information, including references which had been given by their friends.

The data breach occurred in February 2022 and Nicholas Leahy was instructed the following month to investigate the claim. A Letter of Claim was sent to the Defendant Local Authority in April 2022 seeking damages under s82 of the GDPR and s.169 of the Data Protection Act 2018. It is widely accepted that damages can be recovered for breaches of data protection legislation even absent specific pecuniary loss (Vidal-Hall v Google [2016] QB 1003). Surprisingly, in June 2022 the Local Authority replied to say that liability was denied, on the basis that our clients were unable to prove that either of the birth parents had seen the data which was disclosed to them, and on the basis that any loss or damage which had been suffered failed to cross the ‘De Minimis’ threshold (as per TLT and others v The Home Office [2016] 2217 (QB)).

It was obvious that a data breach had occurred, and that our clients were entitled to damages for the distress and financial loss which they had suffered. The courts have recently heard a number of claims in which the distress which has been suffered has been held to be trivial (see for example Rolfe and others v Veale Wasbrough Vizards LLP [2021] EWHC 2809 (QB)), however this case was distinguishable. The distress caused to our clients was evidently extremely serious, in that the Local Authority in this case had been unable to retrieve one of the bundles which had been disclosed. The adoption process only concluded during the life of the data protection claim and the birth parents had made clear their opposition throughout.

Nick instructed Daniel Clarke, of Outer Temple Chambers, to advise our clients in relation to the prospects of success in their case and quantum. A schedule of loss was prepared and our clients were advised that if the Local Authority were unwilling to change their stance then court proceedings would need to be commenced.

Osbornes wrote a letter of challenge to the Local Authority outlining the reasons why our clients were entitled to damages and making a Part 36 offer of settlement, however liability remained denied until early 2023. In January 2023 the Defendant made a very low offer of settlement however our clients were advised to reject this. After exchange of further offers of settlement, eventually in March 2023 settlement was reached. Our clients accepted a five figure sum which reflects the distress and financial loss which was caused to them by the data breach, plus payment of their reasonable legal costs.

It is important that where there has been a data breach, careful consideration is given to the precise nature of the breach, and the damage/distress which it is alleged has been suffered. It is often necessary to ask the Defendant to specifically advise what data has been disclosed and to whom, as this can often be unclear. Whilst it is correct that many individual data breaches will not meet the ‘de minimis’ threshold, where that is not the case there is an entitlement to damages.

To speak to Nicholas about your case please contact us by filling in the form below.

Contact

Nicholas Leahy Solicitor
Medical Negligence

View profile

View profile

• LinkedIn