TLT & Ors v The Secretary of State for the Home Department & Anor

Family members may have claims for misuse of private information and breach of data-protection duties where personal data is collected and disclosed under the name of a lead applicant, if the other family members are identifiable from the disclosed data and information likely to be available to the data controller or others.

The de minimis principle is the only threshold limiting recovery for distress. Damages may also reflect loss of control of private and confidential information. Assessment should be informed by awards for psychiatric or psychological injury, rather than awards for deliberate commercial exploitation of private information. The assessment is governed by English domestic law.

The Home Office accidentally published a spreadsheet containing personal details of 1,598 lead applicants in family returns cases. The spreadsheet was available on the Home Office website for approximately thirteen days and was subsequently uploaded to another website.

The defendants admitted misuse of private and confidential information and breaches of the first, second and seventh data-protection principles in respect of the named claimants. The issues included whether unnamed family members could sue, whether a threshold limited damages for distress, whether media-publication awards provided useful guidance, and whether loss of control of information was compensable.

1. Claims by family members. TLU and TLV could sue for misuse of private information and breach of the Data Protection Act 1998, even though they were not named in the spreadsheet. The information was collected under TLT’s name but related to the whole family. Their identities could readily be inferred from TLT’s name, the disclosed information and the surrounding information. The processing and disclosure therefore involved their personal data as well as TLT’s personal data. [2016] EWHC 2217 (QB), paras 12–14.
2. Threshold for distress. Damages for distress were subject only to the de minimis principle. No additional threshold applied, and the principle was not engaged on the facts. [2016] EWHC 2217 (QB), para 15.
3. Assessment of damages. Awards in cases involving deliberate exploitation of private information by media publishers were not useful comparators. The appropriate comparison was with awards for psychiatric or psychological injury caused by an actionable wrong. Loss of control of personal and confidential information was compensable in principle, but no separate award was necessary or desirable in these cases. It was to be reflected in the overall assessment. The approach in Gulati v MGN Ltd was adopted with the substitution of disclosure for exploitation, and damages were assessed under English domestic law rather than the Strasbourg approach. [2016] EWHC 2217 (QB), paras 16–20.
4. Orders. Damages were awarded in the sums of £12,500 each to TLT and TLU, £2,500 to TLV, £3,000 to PNA, £6,000 to PNB and £3,000 to PNC.

not stated in the judgment.