Tue, 10 May 2022
Recent years have seen a large number of low-value claims in England and Wales for damages for breach of data protection laws (in particular the GDPR). A small selection of these cases has come before the courts, and recent judicial decisions have highlighted some of the obstacles for claimants. But significant numbers of these cases have been, and continue to be, settled out of court – including in mediated negotiations.
This article examines the use of mediation for the purposes of resolving privacy and data protection claims. It describes the current legal context, situations in which mediation (in its different forms) may be suitable, and some of the potential benefits and challenges of mediation in privacy and data protection disputes.
Legal context
The period immediately following the entry into force of the GDPR in May 2018 saw numerous claims in the High Court based on allegations of data protection breaches and misuse of private information (MPI). These claims often used pro-forma pleadings and sought damages for distress and “loss of control” of personal information, together with legal costs.
In many of these cases the breach of the data protection rules was fairly clear – for example where hard copy files had been misplaced or there had been an inadvertent disclosure of electronic records relating to the claimant. Defendants therefore often chose to settle, sometimes following mediated negotiations.
More recently, developments in the cases that have reached the courts have largely favoured defendants and have complicated the legal landscape for claimants. Most importantly:
- The Supreme Court held in Lloyd v Google [2021] UKSC 50 that damages for “loss of control” of personal data are not available under the Data Protection Act 1998, and the case provides reason to suspect that the same will be true under the retained “UK GDPR” (although this is the subject of further litigation). At present, therefore, claimants must prove they have suffered distress as a result of a data protection breach (and to what degree) in order to receive compensation for “non-material” damage. Different claimants affected by the same breach will normally have different experiences of distress, and thus will not have precisely the “same interest” in proceedings, with the consequence that collective actions for damages under CPR 19.6 will not normally be possible. Lord Legatt in Lloyd v Google appeared to endorse the use of a “bifurcated process” whereby common issues of law can be determined in a representative action under CPR 19.6 and individual issues of quantum are determined subsequently in individual claims, but such a process may be less attractive to litigation funders and thus result in fewer claims in practice.
- The courts have been prepared to contemplate striking out claims for damages for distress which fail to meet a threshold level of seriousness. An argument to this effect was successful in Rolfe v Veale Wasbrough [2021] EWHC 2809 (QB), which involved an accidental disclosure of non-sensitive personal data to a third party with no interest in the information. However a claim for £3,000 in reasonably similar circumstances was permitted to proceed in Johnson v Eastlight [2021] EWHC 3069 (QB).
- While privacy and data protection claims can be brought in the High Court regardless of the amount of damages claimed, the High Court has shown a readiness to transfer these cases to the County Court (PD7A para. 2.9A; e.g. Warren v DSG [2021] EWHC 2168 (QB) at [44]). If a case is transferred to the County Court its allocation to a procedural “track” becomes a live issue with potentially significant consequences.
- Arguments that data protection claims are too legally complex for allocation to the small claims track have been doubted judicially (e.g. Johnson v Eastlight [2021] EWHC 3069 (QB) at [24.5]). Given the relatively low level of financial awards for distress (very often below the £10,000 limit for the small claims track) this creates a genuine prospect of allocation to the small claims track in a large proportion of data protection cases, with the consequence that legal costs will not be recoverable by the successful party in those cases. Claimants may rely on factual complexity in order to attempt to avoid a small claims allocation – for example the potential need for expert evidence as to IT security arrangements in appropriate cases. Furthermore, in relation to incidents affecting more than one claimant, there may be renewed impetus towards the “grouping” of claims, for example by simply bringing different claims together where they can be “conveniently disposed of in the same proceedings” (CPR 7.3). In this situation the court may take “representative” claims to trial for the purposes of resolving common issues – see e.g. Jalla v Shell [2021] EWCA Civ 1389 at [50] – and if the trial will last more than a few hours as a result, this may entail that the small claims track is inappropriate. Alternatively there may be renewed attempts by claimant firms to establish Group Litigation Orders (GLOs) even for relatively minor “group” incidents, as a means of avoiding allocation to the small claims track (PD19B para. 7). Seeking a GLO may previously have been an attractive strategy to defendants following incidents affecting multiple claimants, as a way of guarding against a situation in which significant legal costs were incurred in multiple similar claims at the same time. However now, given the apparent readiness of the courts to resolve data protection claims on the small claims track, GLOs may be more attractive to claimants as a means of increasing the chance that legal costs may be recoverable.
- The courts have emphasised the differences between data protection claims and claims for misuse of private information (MPI). An MPI claim requires that private information have been misused; the court in Warren v DSG (above) held that a defendant which had inadequate security arrangements so that personal data was lost had nonetheless not engaged in any use of the lost data that could found a MPI claim. This adds an important hurdle for data protection claimants, since premiums for “after the event” insurance against adverse costs are recoverable following a successful MPI claim but not following a successful data protection claim.
There is some suggestion that, as a result of these developments, the volume of low-value data protection claims may be reducing. Nonetheless there remains significant scope for claims arising from relatively common events, and significant potential scope for their resolution in mediation – particularly where cases are not allocated to the small claims track.
Suitability of mediation
For the purposes of this article, mediation means negotiations facilitated by a neutral mediator. In principle, any dispute can be the subject of mediation in this way – as can any data protection dispute.
Where a case proceeds on the small claims track, there is an optional free “Small Claims Mediation Service” offered by the court. This provides a 1-hour telephone mediation, which (given its duration) is likely to afford a fairly simple opportunity for securing some kind of financial “meeting in the middle”. The availability of this free mediation service, and the fact that legal costs are not normally recoverable on the small claims track, is likely to limit the use of more in-depth mediations in these cases.
Outside the small claims track, the successful party in the claim will in principle be entitled to recover a significant portion of its legal costs. In individual claims for damages for distress (and/or for modest financial losses), the legal costs of trial are likely to outweigh significantly the amounts in dispute.
This is a situation in which mediation can be particularly useful, since a mediated settlement is likely to save significant cost when compared with proceeding to trial. Furthermore data protection claims will very often involve an element of non-financial motivation – often including grievance at the revelation of private information – and mediation can provide a better forum than the courts for resolution of these matters. This is addressed in more detail in the following section (under the heading “Non-financial factors”).
It is also possible for mediated negotiations to address groups of claims, in cases involving multiple proceedings – whether the claims are “consolidated” under CPR 7.3 or fall within a GLO or “bifurcated” representative action under CPR 19.6. In these situations there will likely be points as to the process and scope of the mediation that should be agreed in advance. The final section of this article makes some suggestions.
Non-financial factors
Grievance and worry can play a significant role in privacy and data protection claims. There is a good chance that the claimant’s personal and private information will have been revealed more widely than he or she would have wished. This can cause embarrassment and anger at what has happened, whether the case involved a stray letter sent by a school to other parents or publication in a national newspaper. It can also cause worry as to whether and/or how the revealed information may be used in the future – for example if passwords or credit card details have made their way onto the internet.
Some claimants in this situation will feel a desire for their grievance to be aired in public, and even for a sense of retribution that may come from a court judgment criticising the other party. But mediation can provide a forum for a claimant’s non-financial concerns to be satisfied in other, different and potentially more fulfilling ways.
First, with appropriate agreed “ground rules” in place, parties can say what is most important to them directly to the other side in a “protected space”. This can feel more powerful, and more fulfilling, than making submissions in court, through lawyers, about the issues that are important for legal purposes.
Second, in a mediation the parties can agree on resolutions that are not subject to the same legal constraints limiting what the court can order them to do. This can include remedial actions other than compensation (such as donations to charities) and detailed discussion of the terms of apologies. It might also include a process for dealing with future adverse consequences that are not yet certain (or known).
Mediations involving multiple claims
If a case involves multiple claims, participants in mediated negotiations may wish to seek specific agreement, in advance of the mediation meeting, on which claims will be addressed, how the mediation will proceed and how any resolution will be formalised.
Which claims will be addressed?
If multiple claims have been “consolidated” in the same action, reaching agreement in advance on which of the claims will be the subject of the mediated negotiations should not normally be challenging.
However both GLOs and “representative actions” under CPR19.6 can cover claims which are within the “scope” of the proceedings but have not yet been individually issued. Furthermore, following Lloyd v Google (above), the amount of damages is likely to be different in each individual claim, depending on the circumstances of the claimant. This means that specific claims will probably have to be identified and addressed individually in the context of the mediation, which in turn is likely to place practical limits on the number of claims that can be covered in a single mediation exercise.
Participants in the mediation may wish to seek agreement on these points in advance. Depending on the circumstances defendants may also wish to have scrutinised the losses asserted in individual claims (and particularly allegations of distress), and some sharing of relevant evidence may be necessary in advance.
Process points
In GLO situations there may be more than one law firm representing different claimants. Mediated negotiations may proceed with individual claimant firms representing their own clients, or with multiple parties present. In multiple-party situations it may be appropriate to use two (or more) co-mediators, for example if there are multiple issues (or separate common and individual issues) to address, or simply to reduce waiting times when issues or proposals have to be discussed with a number of parties.
When there are multiple claims to be discussed, participants in a mediation will likely wish to consider in advance whether the claims should be addressed consecutively (i.e. one after another) or whether there may be sufficient commonality to enable the negotiations to address claims in a group. The mediator will often hold preliminary confidential discussions with participants in advance of the mediation meeting, and this issue might usefully be explored in those discussions if it has not previously been agreed between the parties.
Formalising any settlement
If a law firm participates in a mediation on behalf of a large number of individual claimants, the parties may wish to discuss in advance how any negotiated resolution will be approved by that firm’s various clients. The firm may have a general authorisation to settle within certain undisclosed bounds, in which case formalising any agreed resolution within those bounds may be straightforward. But in other situations approval may need to be sought from multiple claimants following the mediation meeting – or as part of an iterative mediation process on more than one date. In practice, any settlement process is likely to have better chances of success if these matters are aired in advance between the participants and can be made the subject of agreed “ground rules”, or an agreed process, for the mediation.
Conclusion
Mediation can be useful for the resolution of privacy and data protection claims, particularly outside the small claims track where recoverable legal costs will often greatly exceed the sums in dispute. What proportion of claims will proceed outside the small claims track remains uncertain, and will continue to be influenced by developments in the case law. Decisions of the EU Court of Justice are also likely to remain influential at least for so long as the “UK GDPR” remains in force, particularly in the event that the EU Court addresses the forms of “non-material” damage that claimants can recover and the evidence that may be required.
Jorren Knibbe acts a barrister and mediator in privacy and data protection cases.
