Claiming compensation for a data breach: the court route the ICO cannot give you

What the ICO can do – and the one thing it cannot

The Information Commissioner’s Office is a regulator, not a compensation scheme. It can investigate complaints, and for the gravest infringements of the UK GDPR it can impose administrative fines of up to £17.5 million or four per cent of an undertaking’s worldwide annual turnover, whichever is higher. Those are serious powers, and an ICO investigation can produce a documented, independent view of whether the organisation broke the law.

What the ICO cannot do is order the organisation to pay you anything. The ICO says so in terms: it cannot award compensation, even where it has given its opinion that an organisation has broken data protection law. An ICO decision letter is not money in your pocket. It is, at most, evidence: the ICO’s guidance notes that you can give its letter to a court, but the court will make its own decision, which may not agree with the ICO’s view.

That distinction matters, because an upheld ICO complaint is easy to mistake for a judgment. It is not. The complaint route produces accountability; the compensation route produces money; and only the second is a court claim.

The court route: Article 82 and section 168

Article 82(1) of the UK GDPR gives any person who has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation from the controller or processor for the damage suffered. The controller is liable for damage caused by processing that infringes the Regulation; a controller or processor escapes liability only if it proves it was not in any way responsible for the event giving rise to the damage. The right, in other words, is statutory, direct and enforceable against the organisation itself – not mediated through any regulator.

The scope of “damage” was deliberately widened by Parliament. Section 168(1) of the Data Protection Act 2018 provides that, in Article 82, “non-material damage” includes distress. A claimant does not need to show lost money. Distress – anxiety, upset, worry about what has been done with the data – is a recognised head of damage in its own right. That is the express legislative answer to the assumption that data breach claims are only for people who have been defrauded.

What a claimant must prove

The Supreme Court has defined the proof burden precisely. In Lloyd v Google LLC, Lord Leggatt held that compensation under the data protection legislation requires proof, in each individual case, both that there was unlawful processing of that person’s data and that the person suffered damage – financial loss or distress – as a result. The infringement itself is not compensable: “loss of control” over personal data, without proof of damage caused by it, does not found a claim. Three elements must therefore line up: an infringement, real damage, and a causal connection between the two.

There is also a floor beneath the whole regime. The courts apply a de minimis threshold: a claim below the level of seriousness that the law recognises can be struck out or met with summary judgment, and Rolfe v Veale Wasbrough Vizards LLP – a claim over a single email about school fees sent to the wrong person, who confirmed they had deleted it unread – is treated in the later case law as the example of a claim beneath that threshold. In Stadler v Currys Group Ltd the High Court confirmed that this non-trivial threshold applies to Article 82 claims, while refusing to strike out a claim about an unwiped smart television precisely because the pleaded facts, if true, were not trivial. The practical consequence is that the breach must be worth suing over: a one-off administrative slip, quickly remedied, will struggle.

Lloyd v Google and the mass-claim dead end

Lloyd v Google was an attempt to recover compensation for more than four million iPhone users whose browsing data had allegedly been collected without consent, through a single representative claimant, without any of them having to prove individual damage. The Supreme Court rejected it. Damages under the data protection legislation compensate an individual for damage that individual has suffered, and that assessment cannot be made on a common, “lowest common denominator” basis across a class; where each person’s entitlement turns on their own circumstances, an opt-out representative action cannot recover compensation for them.

The judgment did not abolish collective redress – a representative claim can still decide common issues, and group litigation remains available – but it destroyed the economics of the no-proof mass claim. Every person who wants compensation must be able to prove their own damage. For the individual litigant, that is actually the useful lesson: your claim stands or falls on your own evidence, not on the scale of the breach in the news.

Realistic quantum and the costs risk

How much is distress worth? The honest answer is: far less than the internet suggests, and it depends on the facts. The ICO’s guidance is that the judge will take into account all the circumstances, including how serious the infringement was and its impact on you, particularly when assessing distress. On that approach there is no fixed tariff: everything turns on the facts of the case.

The large numbers that circulate come from a different world. The highest privacy awards yet made by the English courts – between £72,500 and £260,250 in Gulati v MGN Ltd – compensated victims of years of repeated voicemail interception by national newspapers, an aggravating scale of intrusion no ordinary data breach resembles. At the other end, in Stadler the High Court observed that a single-incident breach claim might end up being worth “just a few hundred pounds”. Most distress-only data breach claims live much closer to Stadler than to Gulati.

There is a costs discipline attached. If a claimant fails to demonstrate damage or distress, the court will not award compensation and can order the claimant to pay the other side’s costs. A weak claim is not a free shot. On the small claims track that exposure is limited, but issuing a claim you cannot prove still costs the issue fee, the time, and the risk of a judicial finding that the claim was trivial.

Where to issue: small claims and the privacy-tort alternative

For an individual claim of realistic value, the forum is the County Court. The Civil Procedure Rules make the small claims track the normal track for any claim valued at not more than £10,000. That is where a distress-only data breach claim of realistic value belongs: informal, and designed to be used without legal representation. Issuing in the High Court is not a way to add gravitas – in Stadler the judge could see no reason the claim had been issued there and transferred it to the County Court, by which point the two sides had run up combined costs in five figures on a claim the judge said might be worth just a few hundred pounds.

Some breaches also support a claim for misuse of private information, the common-law privacy tort. The tort differs from the statutory route in two ways that matter. First, it can compensate the misuse itself, without separate proof of distress – that is how the Gulati awards were built. Second, it requires a positive misuse of private information: in Warren v DSG Retail Ltd the High Court held that a negligent failure to keep data secure, without any use of the information by the defendant, does not amount to misuse of private information or breach of confidence. A hacker breaking in, or an employer losing files, is a data protection claim; an organisation deliberately exploiting or exposing your private information may be both.

Court claim, ICO complaint, or both

The sensible sequence starts outside the courts. The ICO’s guidance is to raise the matter with the organisation first: compensation can be agreed and paid without any claim at all, and the court will want to know what steps you took to settle before proceedings – in England and Wales, the rules on pre-action conduct apply. A letter before claim that sets out the infringement, the damage and the amount sought can resolve the dispute without any proceedings at all.

An ICO complaint remains worth making in parallel where the breach is systemic, where other people are affected, or where you want the regulator’s independent view on record – that view can later be put before the court. But it should be made in the knowledge of what it is: an accountability measure, not a payment mechanism. If what you want is compensation, the claim is the route; if what you want is the organisation stopped, the complaint is the route; most serious breaches justify both, run in the right order and on a realistic view of what each can deliver.