Under data protection law, you are entitled to take your case to court to:
- enforce your rights under data protection law if you believe they have been breached
- claim compensation for any damage caused by any organisation if they have broken data protection law, including any distress you may have suffered, or
- a combination of the two.
- Do I have to go to court to get compensation for a breach of data protection law?
- What do I need to do before I take a claim to court?
- How do I take my case to court if I cannot reach an agreement?
- How much compensation will the court award me if my claim is successful?
- Can the Information Commissioner help me with my court case?
- Can a media organisation stop any legal proceedings I bring?
- Are there any alternatives to taking my case to court?
- IPSO arbitration scheme
- IMPRESS arbitration scheme
Do I have to go to court to get compensation for a breach of data protection law?
The GDPR gives you a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law. This includes both “material damage” (e.g. you have lost money) or “non-material damage” (e.g. you have suffered distress).
The ICO cannot award compensation, even when we give our opinion that an organisation has broken data protection law.
You do not have to make a court claim to obtain compensation – the organisation may simply agree to pay it to you. However, if it does not agree to pay, your next step would be to make a claim in court. The court would decide your case. If it agreed with you, it would decide whether or not the organisation would have to pay you compensation.
We strongly recommend you take independent legal advice on the strength of your case before taking any claim to court.
What do I need to do before I take a claim to court?
The court will want to know what steps you have taken to try to settle the claim. This means you must write or speak to the media organisation to see if you can reach an agreement.
If you fail to reach an agreement, you should write to the organisation before you start court proceedings, telling them you intend to go to court. You should take into account any court rules about pre-action conduct – for example in England and Wales, claimants must follow the pre-action protocols before starting any legal proceedings.
How do I take my case to court if I cannot reach an agreement?
If you cannot reach an agreement with the media organisation, you can apply to a court with an action to enforce your rights under data protection law. If you wish to claim compensation, you can apply to do this on its own or combine it with an action to enforce your rights.
The individual court systems provide useful guidance on how to bring a claim in England and Wales, Scotland and Northern Ireland.
Citizens Advice provides information on taking legal action in England and Wales, Scotland and Northern Ireland.
Finally, you can find further information at:
- www.justice.gov.uk (England and Wales)
- www.scotcourts.gov.uk (Scotland)
- www.justice-ni.gov.uk (Northern Ireland)
As mentioned above, we strongly recommend that you take independent legal advice before starting any claim in the court system.
How much compensation will the court award me if my claim is successful?
This will be up to the judge hearing the case, who will take into account all the circ*mstances. This will include how serious the infringement was and its impact on you, particularly when assessing the distress you suffered.
If the organisation refuses or is unable to pay, you should ask the court how you can enforce the judgment.
You should also bear in mind that the court can award costs to you or against you in certain circ*mstances. For example, if you fail to demonstrate you have suffered damage or distress, the court will not award you compensation and could order you to pay the other party’s costs. Again, we recommend you seek independent legal advice to allow you to consider the risks of bringing a claim.
Can the Information Commissioner help me with my court case?
If you make a complaint to the ICO, there are a number of potential outcomes. We may provide our view as to whether data protection law has been breached. You can give the court our letter as evidence, but ultimately the court will make its own decision. The court’s decision may not agree with the ICO’s opinion.
Under normal circ*mstances, the ICO cannot give you legal assistance when you are taking a case to court. However, if you are bringing a claim regarding journalism, you can ask the ICO for assistance under section 175 of the DPA 2018.
This assistance might include:
- giving you advice
- paying costs connected with the proceedings, and
- indemnifying you in respect of liability to pay costs, expenses or damages you incur in connection with the proceedings.
However, while we must consider the request, we are only allowed to give you assistance if:
- the proceedings relate to personal data that was used for the special purposes, including journalism. We cannot provide legal help if the personal data was used for other purposes
- the legal proceedings relate to an organisation’s compliance with data protection law. We cannot provide legal help on other laws – for example, a libel claim, and
- we believe the case involves a matter of substantial public importance. This is likely to be where there has been, or there could be, a serious infringement causing substantial damage or distress to an individual, or where the outcome of the case might significantly affect the interpretation of data protection law or other laws.
Even if your case meets these criteria, we are still not obliged to give you legal assistance in taking your case to court. In the end, the decision is at our discretion. We expect only a few cases will be eligible.
Section 175 of the DPA 2018 entitles us to reclaim any expenses we incur in giving you assistance from:
- any costs the court awards to you, or
- any sum payable to you under an out-of-court settlement.
If you ask us for legal assistance, we will tell you our decision as soon as we can. Our response will state the extent of any assistance we can provide. If we refuse legal assistance, we will explain why.
Can a media organisation stop any legal proceedings I bring?
The DPA 2018 includes a way of allowing media organisations to prevent legal proceedings taking place (known as a “stay” on the proceedings). As with the special purposes exemption, this protects freedom of expression by preventing data protection law being used to block publication.
If a media organisation claims, or it appears to the court, that the personal data your case relates to:
- is being used only for journalism, or one of the other special purposes
- is being used with a view to the publication by anyone of any journalistic, artistic or literary material, and
- the personal data itself has not previously been published by the data controller,
then the court must stay the proceedings (or, in Scotland, “sist” the proceedings).
This stay remains in place until:
- the controller withdraws that claim
- a determination issued by the ICO under section 174 of the DPA 2018 takes effect – in other words, the ICO decides the data is not just being used for the special purposes with a view to the publication of previously unpublished material, or
- the personal data is published by the data controller.
Are there any alternatives to taking my case to court?
The Royal Courts of Justice Advice Bureau has produced advice on the alternatives to taking your case to court.
Both IPSO and IMPRESS also offer arbitration schemesas a way of seeking legal redress alongside their main complaints-handling processes. Arbitration is a form of alternative dispute resolution. It offers a quicker, lower-cost route to resolving your legal claim without having to take a case to court.
In an arbitration, an independent person (the “arbitrator”) will consider the arguments and evidence from both sides in a dispute. They will then make a ruling based on that information, and may make you an award. This could include payment of damages and legal costs.
If you are considering taking a newspaper to court over a media law claim, you may wish to consider the arbitration scheme instead, including on alleged breaches of data protection law. As with a court case, you may wish to complain about data protection breaches to the ICO beforehand so that you can use our assessment as evidence in your case. Our decisions are not binding on the arbitrator, and the arbitrator may disagree in your particular case.
IPSO arbitration scheme
IPSO operates two arbitration schemes: a compulsory scheme and a voluntary scheme.
The best-selling national newspapers have signed up to the compulsory scheme. This means if you have a genuine legal claim that can be dealt with through the arbitration scheme, they must agree to arbitration.
Some other IPSO members have signed up to IPSO’s voluntary arbitration scheme. This means you can request arbitration, but they need not agree to it.
IPSO publishes a list of the publishers that are members of its compulsory and voluntary schemes.
You can get more information on IPSO’s arbitration scheme:
- from the Arbitration page on IPSO’s website
- by calling 0300 123 22 20, or
- by emailing [emailprotected].
IMPRESS arbitration scheme
IMPRESS operates an arbitration scheme that is free to the public and that all IMPRESS publishers are required to participate in.This means if you want to make a claim through the arbitration scheme against any IMPRESS member, it must agree to arbitration if IMPRESS rules that it is covered by the scheme.
