Data Protection Act 2018, section 169

Compensation for contravention of other data protection legislation

PART 6 Enforcement

(1)A person who suffers damage by reason of a contravention of a requirement of the data protection legislation, other than the [F719UK GDPRF719] , is entitled to compensation for that damage from the controller or the processor, subject to subsections (2) and (3).

(2)Under subsection (1)—

(a)a controller involved in processing of personal data is liable for any damage caused by the processing, and

(b)a processor involved in processing of personal data is liable for damage caused by the processing only if the processor—

(i)has not complied with an obligation under the data protection legislation specifically directed at processors, or

(ii)has acted outside, or contrary to, the controller's lawful instructions.

(3)A controller or processor is not liable as described in subsection (2) if the controller or processor proves that the controller or processor is not in any way responsible for the event giving rise to the damage.

(4)A joint controller in respect of the processing of personal data to which Part 3 or 4 applies whose responsibilities are determined in an arrangement under section 58 or 104 is only liable as described in subsection (2) if the controller is responsible for compliance with the provision of the data protection legislation that is contravened.

(5) In this section, “damage” includes financial loss and damage not involving financial loss, such as distress.

Cases considering section 169 6

Geoffrey Driver v Crown Prosecution Service

[2022] EWHC 2500 (KB) · 10 October 2022

Section 169(5) was applied to confirm that damage includes non-financial loss such as distress. The court awarded £250 for the modest distress caused by the low-level breach. (see paras [164]-[169])

Lloyd v Google LLC

[2019] EWCA Civ 1599 · 2 October 2019

Confirms: the later statute’s non-exclusive inclusion of financial loss and distress illustrated that damage may be non-financial. It supported but did not determine the interpretation of former section 13 (see para [65]).

Martin Hibbert & Anor v Richard D Hall

[2024] EWHC 2677 (KB) · 22 October 2024

Identified as a possible basis for compensation, without final determination of liability or remedy. (see paras [253]-[261])

What each judgment says about section 169 is in the case-law panel in the full Act.

Amendments and notes

2 notes from legislation.gov.uk

Amendments

  1. F719Words in s. 169(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 2 para. 70 (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)

Commencement

  1. I176S. 169 in force at 25.5.2018 by S.I. 2018/625, reg. 2(1)(f)