WILLIAM STADLER v CURRYS GROUP LIMITED

A low-value data-protection claim should not be struck out as an abuse merely because the likely damages are modest, where the pleaded facts disclose a non-trivial breach and the claim can be managed proportionately, including by transfer to the County Court and allocation to the small claims track.

Data protection duties may arise where a retailer disposes of a device containing personal data. Misuse of private information and breach of confidence require unauthorised use or misuse of the information itself; failure to take data-security measures does not, without more, establish either cause of action. A negligence claim requires recoverable damage, and distress or anxiety falling short of recognised psychiatric injury is insufficient.

The claimant returned a smart television to the defendant for repair. The television remained logged into applications, including Amazon. The defendant later resold it without a factory reset or data wipe, after which a film was purchased through the claimant’s Amazon account.

The claimant brought claims for misuse of private information, breach of confidence, negligence and breaches of the UK-GDPR and the Data Protection Act 2018. He also sought damages for distress, aggravated and exemplary damages, an injunction and a declaration.

The defendant applied to strike out the claims and/or obtain summary judgment. The central issues were whether the data-protection claim had a reasonable prospect of success, whether the claim was abusive because of its low value, and whether the privacy, confidence and negligence claims disclosed viable causes of action.

1. Data protection. The applications concerning the data-protection claims were dismissed. Further facts were required concerning the parties’ communications, the terms governing the repair and disposal, and the defendant’s potential status and duties as controller. Disposal of data was capable of amounting to processing. On the pleaded facts, the defendant arguably knew or ought to have known that the television contained personal data and the claim had a reasonable prospect of success.
2. Seriousness and abuse. A threshold of seriousness applies to data-protection claims, and non-trivial breaches may found compensation for distress. This was not properly characterised as trivial if the pleaded information included financial and sensitive account data and an application had been used by a stranger. Nevertheless, the claim was of low value. Applying the principles concerning proportionate adjudication, it was not appropriate to strike out the claim because it could be transferred to the County Court and managed on the small claims track.
3. Privacy and confidence. The claims for misuse of private information and breach of confidence were defective. The defendant’s conduct was a failure to wipe the device, rather than use of the information itself. Passing the television to a third party did not establish that the defendant had used or misused the claimant’s information. A possible breach of data security was insufficient, without unauthorised use or disclosure by the defendant, to establish either cause of action.
4. Negligence. The negligence claim was dismissed and/or struck out. The only financial loss, the cost of the film, had been refunded. The claimant sought compensation for distress and anxiety, but had not claimed personal injury or pleaded clinically recognisable psychiatric illness. No recoverable damage had therefore been established.
5. The claims for aggravated and exemplary damages and an injunction were struck out and/or summarily determined because they were no longer pursued and appeared misconceived. The matter was transferred to the County Court, with the likely allocation to the small claims track left to the district judge.