Osbornes Instructed After Local Authority Data Breach

Nicholas Leahy

Osbornes Law has recently negotiated a settlement on behalf of two clients who had their personal information inadvertently released to the birth parents of their adoptive child during adoption proceedings by the Local Authority. The birth parents had opposed the adoption from the outset, and both had recent and serious criminal convictions and had both been sent bundles in which our clients’ confidential and sensitive personal information was contained. The disclosed information included our clients’ names, addresses, dates of birth, photographs, signatures and other sensitive personal information, including references their friends had given.

The data breach occurred in February 2022, and Nicholas Leahy was instructed to investigate the claim the following month. A Letter of Claim was sent to the Defendant’s Local Authority in April 2022, seeking damages under s82 of the GDPR and s.169 of the Data Protection Act 2018. It is widely accepted that damages can be recovered for breaches of data protection legislation, even absent specific pecuniary loss (Vidal-Hall v Google [2016] QB 1003). Surprisingly, in June 2022, the Local Authority replied to say that liability was denied on the basis that our clients were unable to prove that either of the birth parents had seen the data which was disclosed to them and on the basis that any loss or damage which had been suffered failed to cross the ‘De Minimis’ threshold (as per TLT and others v The Home Office [2016] 2217 (QB)).

It was obvious that a data breach had occurred and that our clients were entitled to damages for their distress and financial loss. The courts have recently heard a number of claims in which the distress which has been suffered has been held to be trivial (see, for example, Rolfe and others v Veale Wasbrough Vizards LLP [2021] EWHC 2809 (QB)). However, this case was distinguishable. The distress caused to our clients was extremely serious in that the Local Authority, in this case, had been unable to retrieve one of the bundles which had been disclosed. The adoption process only concluded during the life of the data protection claim, and the birth parents had made clear their opposition throughout.

Nick instructed Daniel Clarke of Outer Temple Chambers to advise our clients in relation to the prospects of success in their case and quantum. A loss schedule was prepared, and our clients were advised that if the Local Authority were unwilling to change their stance, court proceedings would need to be commenced.

Osbornes wrote a letter of challenge to the Local Authority outlining the reasons why our clients were entitled to damages and making a Part 36 offer of settlement. However, liability remained denied until early 2023. In January 2023, the Defendant made a very low offer of settlement. However, our clients were advised to reject this. After the exchange of further settlement offers, eventually, in March 2023, the settlement was reached. Our clients accepted a five-figure sum reflecting the distress and financial loss caused to them by the data breach, plus payment of their reasonable legal costs.

It is important that where there has been a data breach, careful consideration is given to the precise nature of the breach and the damage/distress it is alleged has been suffered. It is often necessary to ask the Defendant to advise what data has been disclosed and to whom, as this can often be unclear. Whilst it is correct that many individual data breaches will not meet the ‘de minimis’ threshold, where that is not the case, there is an entitlement to damages.

To speak to Nicholas about your case, please fill in the form below.