Data breach compensation and claims

Organisations often hold a huge amount of data about their customers - from confidential information such as names and addresses to financial data like credit card and bank details.

Under the GDPR, a company is obligated to inform both you and the I.C.O. without delay if there is a serious data breach affecting your personal information. They should explain:

• The likely consequences of the data breach
• Measures taken or in place to tackle the breach and any adverse effects
• Who their data protection officer is and their contact details

If you think your personal data may have been disclosed as a result of a data breach but have not been informed by the organisation from whom information was taken, contact them directly. They should then tell you whether your personal data has been disclosed as a result of a data breach.

Contact Leigh Day if you believe a breach has involved your personal data, but the company in question have not notified you. Leigh Day's data breach solicitors can investigate your concerns and assess whether you have a viable claim for compensation.

Get in touch with our specialist data protection solicitors to start your compensation claim for financial loss and/or emotional distress caused by a data breach.

• Call 020 8038 9412 for a free initial consultation
• Email infobreach@leighday.co.uk and someone will respond soon

One of our specialist data protection, privacy and information law experts will listen to your case. If we believe you have a claim, the first step may be to complain directly to the company responsible. This can be the quickest way to settle a data breach claim, should the organisation accept they were at fault.

Reporting the data breach to the I.C.O.

If you have been a victim of a data breach, you may also wish to complain to the I.C.O. who, as the UK's independent body set up to uphold the public’s information rights, are able to investigate the matter and fine the organisation . They can’t award compensation to those affected, but their actions, including any reports they produce as part of their investigations and findings that the organisation has not complied with the law, may help support your case.

There are many different types of data breach. Some can be deliberate. For example, a disgruntled member of staff at a company can leak personal information to others without the individual’s knowledge or consent.

In other cases, the breach can happen unintentionally. For example, a business may suffer a successful cyber-attack of its customers’ personal information as a result of inadequate security, or a hospital may send a letter containing confidential medical information to the wrong address.

The loss of personal information as a result of a data breach can have a significant emotional and financial impact on the victim. In some cases, especially where financial information is stolen in a breach, it can lead to fraud, identity theft and loss of money. 

Two important examples of serious data breaches are:

• Carphone Warehouse: Over three million mobile phone customers’ personal details were hacked as a result of a successful cyber-attack of Carphone Warehouse’s IT system in 2015. The firm were fined £400,000 by the I.C.O. for the breach.
• TalkTalk: Over a hundred TalkTalk customers had their personal information hacked in a series of data breaches suffered by TalkTalk in 2014 and 2015.

The amount of compensation you will receive if you are the victim of a data breach depends on the exact circumstances relating to the breach, including:

• Sensitivity of the data stolen;
• How many people accessed your data;
• Length of time between the breach occurring and being informed;
• How long unauthorised access to the data was / is available;
• Anxiety and emotional distress encountered;
• Any financial losses experienced.

You could receive compensation for the loss of control over the information even if you suffered no financial loss. The I.C.O. can issue fines to organisations for breaching the GDPR and / or Data Protection Act 2018. However, the fines are distinct from any that can be claimed by victims of data breaches. Their findings that an organisation has not complied with the law, usually after a lengthy investigation, can be helpful in support of a claim for compensation too.

Organisations must report a data breach to the I.C.O., as the relevant authority, without undue delay and no later than 72 hours after being made aware of it. Any longer than this and they must give reasons for the delay.