Emma Louise Johnson v Eastlight Community Homes Ltd
| Jurisdiction | England & Wales |
| Judge | Master Thornett |
| Judgment Date | 16 November 2021 |
| Neutral Citation | [2021] EWHC 3069 (QB) |
| Docket Number | Case No: QB-2021-000923 |
| Court | Queen's Bench Division |
[2021] EWHC 3069 (QB)
IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
MEDIA AND COMMUNICATIONS LIST
Royal Courts of Justice
Strand, London, WC2A 2LL
Master Thornett
Case No: QB-2021-000923
Mr Eric Metcalfe (instructed by Pure Legal Limited) for the Claimant
Mr Ben Hamer (instructed by DAC Beachcroft) for the Defendant
Hearing date: 14 October 2021
On 15 March 2021, the Clamant issued a Part 7 Claim Form in the High Court seeking damages limited to £3,000.
The endorsement on the Claim Form states that she is claiming:
“(Including aggravated damages), damages for Misuse of Private Information, Breach of Confidence and Negligence, together with damages for breach of Article 8 ECHR rights as incorportated [sic] in the HRA 1998 as well as damages pursuant to Article 82 GDPR and damages pursuant to section 169 of the Data Protection Act 2018.”
“Further, the Claimant claims injunctive relief to prevent the recurrence of this type of breach and declaratory relief stating that the Defendant has breached the principles enshrined in the abovementioned legislation.”
Supporting lengthy Particulars of Claim plead matters more widely, additionally seeking damages pursuant to s.169 of the Data Protection Act 2018, declarations that the processing of the Claimant's personal data amounted to (i) a breach of her Article 8 ECHR rights to privacy and/or family life; and (ii) a breach of Article 5(1) General Data Protection Regulation [“GDPR”].
Although the case had not been allocated and so no CCMC had been listed (assuming allocation justified such a hearing), the Claimant's solicitors filed a Precedent H Form confirming over £15,000 has already been incurred in costs and a total figure for costs just in excess of £50,000. Such costs are, as is required in a Precedent H, certified by the Claimant's solicitors as “reasonable and proportionate for my client to incur in this litigation”.
The Claimant's Directions Questionnaire suggests a 2-day trial is appropriate.
Despite these features, the factual background to the claim is very straightforward.
The Defendant is a provider of low-cost social housing and the Claimant is one its tenants. On 1 September 2020, one of the Defendant's other customers [“the Third Party”] requested a rent statement. Around 1.22pm, one of the Defendant's employees replied by e-mail with the information but inadvertently also attached a compilation of rent statements of other customers of the Defendant, including the Claimant. The Attachment included the Claimant's name, email address, and recent rent payments made to the Defendant. The Third Party, as sole recipient of the e-mail, immediately notified the Defendant of the error by phone and was asked by the Defendant to delete the e-mail. At 3.45pm, the Third Party confirmed they had deleted it.
The inadvertent disclosure therefore was to a single person, who took apparently no issue with it, and lasted less than three hours.
The Defendant admits sending the attachment was a mistake, as occurred owing purely to human error. It e-mailed the Claimant on 20 September 2020 to (i) inform her of the error and the fact that the recipient had deleted the information (ii) apologise and (iii) state that the matter had been reported to the Information Commissioner's Office. Whilst the Defendant does not accept reporting to the Commissioner was necessary anyway, it chose to do so. The Information Commissioner's Office confirmed only a few weeks' later that no action was required or would be taken as a result of the inadvertent data breach.
The extent to which the Claimant's personal information was ever considered by the Third Party has to be assessed in the context of the size of the attachment. The Claimant's details appeared at pages 880–882 into a document of almost 6,941 pages long, a point the Defendant says invites inference that it is highly unlikely that the Third Party read the Claimant's information at all.
By 16 November 2020, nonetheless, the Claimant had instructed solicitors and a letter before claim had been sent to the Defendant.
The Defendant applies to strike out the claim under CPR 3.4(2)(a) and/or (b) and/or for summary judgment. As it set out in much fuller detail in its filed Defence, the Defendant denies the Claimant is entitled to any damages at all or any other relief in the circumstances. It describes this a purely a technical breach of Article 5 of the GDPR. The Defendant contends that (a) the Claimant has suffered no loss or damage above the de minimis threshold, and therefore the Claimant has no real prospect of success on the claim such that the court should enter summary judgment for the Defendant; and (b) even if the damage were to be found by the court to be above de minimis, the ‘game is not worth the candle’ and so still ought to be struck out under the Jameel 1 principle.
General observations about the alleged importance and severity of the claim in the context of an admitted breach
The disclosed information plainly was not of an obviously sensitive nature in itself. It did not concern, for example, matters such as health, sexual relationships or bank details. The disclosure could not have given rise to any fraudulent purpose. Indeed, the Claimant confirms that after she was informed of the matter, she checked her online banking and found there was no suspicious or unauthorised activity.
At least in objective terms, the information was simply routine: the Claimant's name, address 2 and postcode, her account reference number, account balance and details of recent rent transactions.
The Claimant's personal version about the significance of this information is set out in a witness statement dated 16 November 2020, and so as prepared very shortly after the event and still four months before the issue of the Claim Form.
As a Witness Statement ordinarily features, the Claimant provides her personal address (which is in Essex) in the opening paragraph. She acknowledges that the data breach admitted by the Defendant was caused by human error but refers to having moved to her current home in around 2017, as let to her by the Defendant, to escape an abusive relationship “and, as such, had avoided making my new address “public” for fear of further contact with my former partner”. Therefore, upon learning that her address had been given to an unknown third party “I was immediately concerned that the information would somehow become known to my former partner. I was aware that the chances of my former partner receiving the information, either first hand or otherwise, were extremely low, however the thought of such an occurrence left me stressed, worried and very anxious”. The Claimant reiterates the comparatively low risk of her ex-partner learning of her address by reason of the Defendant's disclosure at Para 41: “I was aware that the chance of such an occurrence was extremely low”. However, she maintains that this possibility, combined with the general feature of the disclosure, has played upon her pre-existing depression and anxiety.
The statement develops and illustrates this latter assertion but, critically, no personal injury claim was presented at issue and none was suggested at the hearing as might still be contemplated.
As stated, the remoteness of the Claimant's ex-partner locating her as a result of the disclosure is appropriately and realistically acknowledged by the Claimant.
What is not acknowledged by her (and remains so through to the date of the Defendant's Application, despite the point being pleaded in the Defence dated 21 April 2021) is the objective and entirely realistic possibility that the ex-partner had been for the three years prior to the Defendant's disclosure (and indeed has remained since) far more likely and able to locate her whereabouts simply utilising publicly available channels. The Defendant's properties are only in Essex and Suffolk and so, had the ex-partner wished to, a simple search on the BT Phone Book website or 192.com for those locations would have led to her. The Claimant had not elected for her details to be made “ex-directory”, a free and well publicised service offered by BT.
Similarly, despite the asserted aggravation of an existing sensitivity, the Claimant has taken no steps at all to apply to withhold her personal address from the very claim she brings. Her full address, for example, appears on the Claim Form and her original witness statement that has been disclosed, not a redacted or amended version. Accordingly, as the Defendant submits, the Claim Form and Particulars of Claim are currently accessible to the public under CPR 5.4C. As this claim continues, there can be no reasonable expectation of privacy in relation to matters proceeding in open court: Khuja v Times Newspapers Limited [2017] UKSC 49 and HMRC v Banerjee [2009] EMLR 24.
The Claimant's election to issue her claim in a publicly identifiable form far eclipses, in my judgment, somewhat after the event academic submissions on behalf of the Claimant that (i) the probability of her former partner identifying her through of the Court File is lower, not least because inspection of the Court File incurs a fee 3 (ii) there had been no publicity of such information in open court by way of trial process. The point there being that the attended hearing of the Defendant's Application on 14 October 2021 was nonetheless a public hearing and published in advance as such on the Court List.
That election also seems not simply to run contrary but, in my view, to negate any argument that her subjective response to the Defendant's disclosure still continues. Her account, to reiterate, is to be found in a statement prepared very shortly after the event. The notion that it remained a significant state of...
To continue reading
Request your trial
-
Arkadiusz Kaminski -v- Ballymaguire Foods Limited
...have to show has been exceeded before they can seek damages for actual loss or distress. In Johnson v. East light Community Homes Ltd [2021] EWHC 3069 (QB), the English High Court also ruled that the de minimis concept applies to claims taken under the GDPR and the UK Data Protection Act 20......
-
English Courts’ Stance on Low-Value Data Breach Claims Continues to Harden, But There May be Hiccups Along the Way
...and breach of confidence claims as in Warren v DSG Retail Ltd [2021] EWHC 2168 (QB), Johnson v Eastlight Community Homes Ltd [2021] EWHC 3069 (QB) and William Stadler v Currys Group Limited [2022] EWHC 160 (QB); transferring straightforward, low-value data breach claims to the County Court ......
-
English Courts’ Stance on Low-Value Data Breach Claims Continues to Harden, But There May be Hiccups Along the Way
...and breach of confidence claims as in Warren v DSG Retail Ltd [2021] EWHC 2168 (QB), Johnson v Eastlight Community Homes Ltd [2021] EWHC 3069 (QB) and William Stadler v Currys Group Limited [2022] EWHC 160 (QB); transferring straightforward, low-value data breach claims to the County Court ......
-
Modest Data Breach Not A Matter For The High Court
...Eastlight Community Homes Limited [2021] EWHC 3069 (QB) In yet another recent High Court decision dealing with a relatively modest data breach the Court has struck out elements of a claim and transferred it to the County The claimant had issued proceedings in the High Court seeking damages ......
-
Modest Data Breach Not A Matter For The High Court
...Eastlight Community Homes Limited [2021] EWHC 3069 (QB) In yet another recent High Court decision dealing with a relatively modest data breach the Court has struck out elements of a claim and transferred it to the County The claimant had issued proceedings in the High Court seeking damages ......