data breach appeal
, ,

Morrisons loses data breach appeal

Supermarket Morrisons has lost its appeal following a breach at the company which resulted in thousands of its employees’ details being posted online. The case is the first data leak group action in the UK.

In December 2017, in a landmark ruling, the High Court found Morrisons supermarket group liable for a mass data breach caused by the criminal actions of a rogue employee. However, Morrisons went on to challenge this decision.

The employee stole data from nearly 100,000 staff. This included names, addresses, salary and bank details. The information was then posted online and sent to newspapers. The media did not publish the data and Morrisons was informed of the breach. The employee was subsequently jailed for eight years.

The Court of Appeal upheld the original decision against the supermarket with three judges saying they agreed with the High Court’s earlier decision.


Where Next

Over the last 18 months, we have seen numerous examples of significant personal data loss. Many of these violations have been able to occur due to weaknesses contained in companies’ IT software.

As the trend towards a cashless society accelerates, this will only continue as retailers and other businesses seek quicker and slicker interfaces with their consumers. Both at the point of sale and throughout their customer journey.

In the case of Morrisons, significant steps were taken to protect data, but those steps failed. In this instance, the data was lost at the hands of an employee turned hacker. However, data is also at threat simply due to careless employees going about their day-to-day business.

The latest ruling is the tip of a very large iceberg. Mass data breach actions are also being made against Ticketmaster and British Airways among others. Such actions, when properly prepared and investigated, will have significant financial consequences in terms of damages and costs.

Data breaches on a large scale are a real and pressing threat. In response, the clear and overwhelming view of the Court of Appeal is that such events must be foreseen by companies, and insured against.

The reaction of the insurers to such events, their provision of cyber cover and premium costs is now under the spotlight. Indeed, we predict a situation where the volume of exclusions to policies will increase.

Companies must now protect themselves better from data loss. But they also need to be extremely vigilant as to the activities and errors of their employees to be afforded the cover they pay for, or think they pay for.


If you have been affected by this or any other data breach then you can get in touch with our experts today


Data protection complaints increase leading to possible rise of GDPR breach compensation

According to the Information Commissioner’s Office (ICO) – the watchdog responsible for regulating data protection laws in the UK – the number of reported data protection complaints has almost doubled since April this year. If the regulator upholds these complaints, there could be a corresponding rise in GDPR breach compensation claims.

Common causes for these data violations include:

  • Data sent to the wrong recipient
  • Loss of theft of paperwork
  • Failure to redact data
  • Failure to use bcc when sending an email.

The increase in data breach complaints has happened since the introduction of the GDPR on May 25th.  This saw more robust data protection laws come into force. GDPR is the most significant change to data privacy regulations in over two decades. The new rules are designed to:

  • Boost the rights of individuals by giving them more control over their information
  • Put more limitations and responsibilities on how organisations can handle personal data
  • Make data protection (including data breaches) more transparent.

The GDPR also saw the introduction of tough penalties for data breaches. In fact, companies who fail to put adequate data protection processes in place and subsequently suffer a breach could face fines of up to €20,000,000 or 4% of their total global annual turnover for the last financial year.

While the ICO does not award GDPR breach compensation to victims, if a company is found guilty of a data violation this can strengthen an individual’s claim.

According to the ICO:

  • 4,214 data protection complaints were made in July
  • 3,098 data protection complaints were made in June
  • 2,310 data protection complaints made in May
  • 2,165 complaints were made in April.

The stats exclude the health sector.

The figures indicate that more and more people are becoming aware of their data protection rights. This makes sense as there have been many high-profile data protection scandals over the last few months. For example, at Hayes Connor Solicitors we are currently pursuing cases against:

  • Emma’s Diary. Emma’s Diary sold its users’ information to Experian’s marketing division. This data was then used to create a database which the Labour Party manipulated to profile new mums in the run-up to the 2017 General Election. Find out more about the Emma’s Diary data breach
  • Dixons Carphone. The Dixons Carphone or Carphone Warehouse data breach took place in 2017. It resulted in 10 million customer records being accessed from Currys PC World and Dixons Travel stores. The details stolen by cyber criminals include names, addresses, phone numbers, dates of birth, and email addresses. All of which can be used by cybercriminals to commit further crimes. Find out more about the Carphone Warehouse data breach
  • Ticketmaster has admitted that thousands of UK customers have been put at risk due to third-party software on their website. This has since been removed but not before the software accessed a number of customers’ personal and financial details. Find out more about the Ticketmaster data breach
  • Last year, Equifax warned that up to 400,000 UK consumers might have had their personal details stolen. The data included names, address, dates of birth, and credit card numbers. Find out more about the Equifax data breach.

If you have been affected by any of these cases, or if you want to make a GDPR breach compensation claim against another organisation, let us know.

Making a GDPR breach compensation claim

If you have suffered damage or distress caused by an organisation breaching any part of the Data Protection Act (the UK’s interpretation of the GDPR), you have a right to claim compensation.

You can make a GDPR breach compensation claim if you have struggled emotionally following a data breach, even if you have not experienced any financial loss.

With enough information, cybercriminals can steal your identity, apply for credit in your name, set up fraudulent bank accounts and access your existing accounts. And just the thought of this happening can cause emotional distress. So why shouldn’t you seek compensation for this failure to look after your information correctly?

At Hayes Connor Solicitors our initial assessment is always free of charge. If we believe you have a substantial, complex case, we’ll go through your options with you and may be able to act for you on a NO WIN, NO FEE basis. For smaller claims, our quick assessment form will help you to start your GDPR breach compensation claim, quickly and easily.

Our expert data breach compensation solicitors make sure you receive the maximum compensation possible in the shortest possible time. However, with strict time limits in place for making data breach claims (currently all breaches going back six years could be subject to a claim) it’s essential to act now.


data breach compensation

Can you afford to use a solicitor for your data breach claim?

When it became clear that people across the UK were mis-sold PPI, often to the tune of thousands of pounds, there was a surge of new claims management companies on the scene. All promising to help consumers get back what they were due.

But, all too often, these companies were more concerned about making fast cash than helping victims. With assurances of no up-front fees turning into extortionate commission rates that left people short-changed.

Fast forward to today, and it seems like its data breach claims that are now rarely out of the news. But, as we start to talk about holding companies to account for any breach of trust when it comes to our valuable information, so do comparisons with PPI claims.

And, it is not hard to see why. It is possible that high-profile data breaches could be seen as a way to make a profit by unscrupulous claims management “factories”.  So it’s vital that you are aware of what is at stake and the options available to you.

Don’t let them get away with it!

Organisations must be held to account for their failure to protect our personal data. The sheer scale of the information we share on online is enough to leave victims open to the threat of fraud.

For example, with enough data, cybercriminals can apply for credit in your name, set up fraudulent bank accounts and access your existing accounts. And we should all be very worried about what could happen if this gets into the wrong hands.

With large-scale, high-profile hacks and breaches happening more and more often, something has to be done to make companies accountable for these losses. So, claiming compensation isn’t just in your best interests – it could be the only way to ensure that they implement more secure processes.

Should you do it yourself?

You can make a data breach claim on your own. What’s more, if you go ahead and no settlement is reached, you can even represent yourself in court. In fact, the number of people doing this over recent years has increased.

The legal term for representing yourself this way is called ‘litigating in person’ (LiP). However, while there has been a rise in the number of people doing this, this is often because they don’t think they have any choice due to a lack of alternative funding options.

The benefits of using an expert data protection lawyer

At Hayes Connor, we believe that the best way to make big companies pay for their failures is to use a specialist lawyer. Of course you would expect us to say that – but let us explain why.

Firstly we have the legal expertise needed to take on big players such as Ticketmaster and Equifax. And, where enough people come forward, we might even launch a group action against a company.

We believe that a group action is undoubtedly the best way forward for data breach claims of this nature. It allows people with the same type of claim to bring it together on a collective basis to strengthen their overall position and increase their chances of settlement or success in litigation.

In addition to our own legal expertise, we also work with expert barristers to help us win our cases. So we are confident that our team will get the results you deserve.

Can you afford to use a data breach claims lawyer?

We deal with all breach claims on a no-win, no-fee basis. This means that, if your claim is not successful, you won’t have to pay a penny.

To cover our costs, if we win your claim, we will charge a success fee. This is capped at 25% of any compensation you receive. We have to charge this to cover our costs in smaller/individual cases. There are no hidden charges or other administration fees.

In some group actions, we expect to be paid by the offending party and might even be able to work at no charge to you. This means, when you win, unlike with a claims management company, you could receive 100% of the compensation awarded to you.

Crucially, when it comes to making a compensation claim, a lack of care can leave data breach victims open to advice and representation below the standard expected by the profession, and this could ultimately see you lose out financially as a result.

Why appoint Hayes Connor Solicitors?

Leading our field when it comes to understanding this often complex area of law, we provide clear and comprehensive advice and legal support to ensure the best possible result for you.

Unlike those unscrupulous claims management companies we only ever get in touch with people who have asked us to, which means we NEVER cold call, send spam texts, spam emails, or engage in any other form of nuisance marketing.

What’s more, at Hayes Connor we understand that making a compensation claim can be stressful; especially where your sensitive information has already been breached. So, our process is fully compliant with the latest guidance, and we never put your details at risk.


data breach lawyers

Ticketmaster to close resale site Get Me In. Can you still make a data breach claim?

The Ticketmaster data breach saw cybercriminals get away with the personal and financial information of thousands of people in the UK. As well as the main Ticketmaster site, the data hack also affected, TicketWeb and the resale website Get Me In.

Following the breach, Ticketmaster is now closing its secondary ticketing websites Seatwave and Get Me In, in a bid to combat touts. However, if you used Get Me In and were affected by the data breach, you can still make a compensation claim against the company.

The Information Commissioners Office (ICO) has already made it clear that it does not approve of companies closing to evade data breach inquiries. Earlier this year, and following the announcement that controversial data analytics firm Cambridge Analytica was to shut down, the ICO said that: “investigations cannot be impeded by the closure of these companies.”

In this case, there is no evidence that this is why Get Me In is closing. In fact, according to Ticketmaster: “We know that fans are tired of seeing others snap up tickets just to resell for a profit on secondary websites, so we have taken action”.

However, it is vital that Get Me In customers affected by the Ticketmaster data breach know their rights and are not put off making a claim.

What happened in the Ticketmaster data breach case?

Ticketmaster was affected by a substantial data protection breach after cybercriminals hacked the company’s websites. Different customers had different data stolen including financial information (some of which was fraudulently used), email addresses and other personally identifiable information (PII).

Find out more about the different types of data breaches in this case.

Make a Ticketmaster data breach claim

The only way for you to hold Ticketmaster to account is to make a data breach compensation claim.

Crucially, the law recognises the potential damage that is caused by physiological suffering. So, you can make a compensation claim if you have struggled emotionally following a data breach, even if you have not experienced any financial loss.

At Hayes Connor Solicitors, we have already been contacted by lots of Ticketmaster customers who are worried that their data was not looked after as carefully as it should have been.

In response, we have now submitted a letter before action (LBA) to Ticketmaster. This LBA lets Ticketmaster know that we plan to start proceedings against them, and that we are very serious about getting our clients the compensation they deserve.

If you want to join our action against Ticketmaster, it is not too late!

To start your compensation claim, you will need you to register with us. To date, our action against Ticketmaster has more than 500 clients, and it is clear that the data breach is extensive. As such, we expect Ticketmaster to take our claim very seriously.

Data breaches often have severe consequences for those affected so you could be entitled to up to £5,000.