Market researchers risk compensation claims over data breaches

Previously, the rules under the Data Protection Act 1998 surrounding data protection breaches had been interpreted as only allowing compensation claims if a breach caused a financial loss.

But following the ruling in last month’s Google Inc v Vidal-Hall case, Clause 13 of the Act will now be interpreted so that it is no longer necessary to show financial loss for a compensation claim to be made. Emotional impact, such as anxiety or distress, are now grounds for a claim.

“Market research providers, or indeed anyone in control of customer or client data, will now have an even stronger incentive to comply with data protection rules,” said John Warchus, partner at commercial and technology law firm, Moore Blatch.

“The decision by the Court of Appeal is also consistent with the likely future trend of data protection legislation – the draft EU Data Protection Regulation will mean that someone can seek damages regardless of a financial loss. Market research providers should urgently review their data protection procedures and strengthen where necessary as more compensation claims are likely and the amount of damages awarded is also likely to increase.”