Claiming compensation for distress under the Data Protection Act


If you have been the victim of a breach of your personal data, the Data Protection Act gives you the right to compensation. You can claim for any money you lose because of a data breach. For example, if a cybercriminal uses your credit card to buy something or steals from your bank account.

But most Data Protection Act breaches don’t actually lead to financial loss. Instead, it is much more common for people to suffer from emotional distress following the misuse of their personal data.

What does the law say?

Until a few years ago, anyone who wanted to claim for distress following a breach of the Data Protection Act first had to prove that they had also suffered financial loss. But this is no longer the case.

And, since a landmark case in 2015[1], there have been many successful claims for distress. So, if you have suffered emotionally after an organisation breached any part of the Data Protection Act (the UK’s interpretation of the GDPR), you have a right to claim compensation.

For example, in 2016, six asylum seekers received awards of between £2,500 and £12,500 after their personal data was inadvertently published on the Home Office website.

What will the court look at when deciding how much compensation to award?

When making a compensation award, the court will look at the specific circumstances of your case. This includes things like the sensitivity of the data compromised and the nature of the disclosure.

However, the court may be prepared to award damages even in cases where your fears about what might happen with your data are not rational. Simply the threat of disclosure, and the loss of trust in authorities resulting from a data breach could result in compensation.

The emotional impact of a Data Protection Act breach should not be underestimated

If a criminal came into your home and stole your private letters and other information, you would be distressed. So why should you feel any less upset at having your online data taken?

The emotional impact of a data breach can be devastating. For some people, the effects can include a lack of sleep, feeling ill, unsettled or confused. Stress can also affect a person’s friends, family and job. We deal with serious cases that put people’s mental health and even their lives at risk. So, downplaying the impact of a data breach claim is extremely disrespectful to the victims.

Who is responsible?

While cybercriminals often target organisations to steal their data, in most cases, data breaches aren’t caused by scammers trying to hack big businesses, but by companies not taking data protection seriously resulting in simple human errors.

However, even where criminals are involved, in most cases organisations have not invested in adequate levels of security. So, the hackers only managed to steal the data because nobody put a “lock on the door”.

Make a Data Protection Act compensation claim with Hayes Connor Solicitors

At Hayes Connor Solicitors, we believe that companies must be held to account for their failure to protect your information.

Some people would have us believe that claiming for distress is an overreaction. That your psychological suffering and anguish doesn’t matter. You might hear friends and family saying that, while it is acceptable to claim compensation for any financial losses, you should put up with any anxiety caused by having your information stolen. But we should all be very worried about what could happen if our data gets into the wrong hands. Why shouldn’t you seek compensation for a failure to look after your information correctly?

Crucially, the law understands the damage that can be caused by worry and upset. So you are 100% within your rights to make a compensation claim.

What’s more, claiming compensation for distress isn’t just in your best interests, it could be the only way to ensure that businesses everywhere implement more secure processes.

If you have been the victim of a data breach or cyber fraud, find out how we can help you to get data breach compensation by completing our enquiry form or give us a call to discuss your case in more depth.

Or, for more advice on how to keep your data safe, follow us on Twitter and Facebook.

[1] Google Inc v Vidal-Hall and others [2015]