Following the recent Court of Appeal decision in Google Inc v Vidal-Hall  EWCA Civ 311, there has been a change in the manner in which compensation may be decided under the Data Protection Act 1998 (DPA). A further interesting point arising from the decision is that a breach of the DPA was held to be a tort.
Claims for compensation can be brought where a breach of the DPA causes “damage and distress”. Until the latest Google decision, this had been interpreted to mean some form of financial damage or loss is required before a claim for damages can be brought. However, the Court of Appeal has rejected this as contrary to the EU Charter of Fundamental Rights.
In Vidal-Hall, three individuals brought a claim against Google including or compensation under the DPA. Google had allegedly bypassed default privacy settings and collected and recorded internet usage information via tracking cookies without the individuals’ knowledge or consent. The Court held that Google’s misuse of the personal data had caused emotional distress to the individuals which, although non-pecuniary in nature, still constituted “damage” within the wider meaning.