Halliday v Creation Consumer Finance Ltd (CCF)

Once the statutory gateway in section 13(2) is met, compensation is available only for an individual’s distress caused by a contravention of data-processing requirements. It does not compensate distress at large, distress caused solely by disobedience of a court order, or distress suffered only by relatives.

An award under the Data Protection Act 1998 is compensatory, not punitive, and is fact-sensitive. A limited, single episode of inaccurate processing, with no proven financial or reputational loss and little contemporary evidence of distress, justified a modest award. Article 24 of Directive 95/46/EC did not entitle an individual in private civil proceedings to require a court to impose a sanction.

In earlier proceedings, CCF had agreed to delete data relating to Mr Halliday. During later recovery proceedings, it maintained and supplied to Equifax incorrect data showing that he owed CCF £1,500. Mr Halliday counterclaimed for breaches of the Data Protection Act 1998. CCF did not defend the counterclaim, and judgment was entered with damages to be assessed.

District Judge Pelly awarded only nominal damages for the asserted injury to reputation and credit. He did not assess distress because he considered that substantial damage had first to be established. HHJ Moloney QC dismissed Mr Halliday’s appeal on 30 April 2012.

On the appeal to the Court of Appeal, CCF conceded that nominal damage satisfied the relevant requirement. The central remaining issue was the appropriate compensation for distress under section 13(2).

Appeal allowed. Arden LJ gave the judgment, with which Lloyd LJ and Ryder J agreed. CCF’s concession meant that the court did not decide whether proof of ascertainable pecuniary loss was required before compensation for distress could be recovered. The proven contravention, coupled with the absence of identifiable financial loss, warranted nominal damages of £1.

1. Section 13(2) of the Data Protection Act 1998 compensates distress suffered by the individual because of a data controller’s contravention of the Act’s requirements. It is not a remedy for distress at large. Distress arising solely from non-compliance with a court order, rather than from a data-protection contravention, lies outside the provision. The claimant’s evidence was nevertheless capable of being treated as distress arising from the underlying unlawful processing.
2. The court assessed the distress claim itself rather than remit it. The assessment was necessarily fact-sensitive. The inaccurate entries arose from one error, persisted for a limited period, caused no proved loss of reputation, credit or opportunity, and were not shown to have been fraudulent or malicious. There was no substantial contemporary evidence of injury to feelings beyond understandable frustration.
3. Compensation under the Act was intended to compensate, neither more nor less. The discrimination injury-to-feelings bands in Vento were not a useful guide because discrimination commonly involves loss of equality of opportunity and distinct forms of distress. Accepting that a breach of an important European data-protection measure should attract a remedy, the court awarded £750 for distress.
4. Article 24 of Directive 95/46/EC required Member States to adopt suitable implementation measures. It was not unconditional and precise enough for individual enforcement in private proceedings, and a civil court had no function of imposing a sanction unless legislation so provided. The available measures were not confined to compensatory damages.
5. The availability of nominal and other domestic remedies meant that the remedy was not ineffective merely because Mr Halliday failed to prove substantial loss. Article 8 of the Convention was not directly relevant to the statutory assessment. No reference to the Court of Justice was necessary.

• Court of Appeal (Civil Division) — allowed the appeal and awarded £1 nominal damages and £750 damages for distress.
• Cambridge County Court (HHJ Moloney QC) — dismissed Mr Halliday’s appeal on 30 April 2012 from the assessment of damages.
• Cambridge County Court (District Judge Pelly) — awarded nominal damages only and declined to assess damages for distress.
• Cambridge County Court — entered judgment in default against CCF for breaches of the Data Protection Act 1998, with damages to be assessed.