GDPR compensation claims

[AnotherLevel]

I believe a claim for breach of GDPR would need to be heard separately in the county court.

What kind of information do you think your employer holds that they did not provide as part of your SAR? Do you have evidence that this information exists? Why do you think it will impact your ET claim?

[psychojuice]

I believe a claim for breach of GDPR would need to be heard separately in the county court.

What kind of information do you think your employer holds that they did not provide as part of your SAR? Do you have evidence that this information exists? Why do you think it will impact your ET claim?

They are withholding all emails from my manager to other managers (who investigated my grievance) and that's just for starters. I asked for a copy of the log of the email search that was conducted on their deleted and archived servers (using my name)- which they have failed to provide me. I know the data exists because it is obvious that my manager would have emails between himself and the grievance manager (and vice versa).

I'm not entirely sure what impact it will have, however all I know is that they are in breach of the GDPR and I want to sue them.

[AnotherLevel]

How old are these emails? Do you know their email retention policy? What reason have they given for not providing these emails?

[psychojuice]

How old are these emails? Do you know their email retention policy? What reason have they given for not providing these emails?

Emails will be about a year old. The email retention policy would be the same as any multinational company- 6 years? But that doesn't matter as I have received emails from before the said emails. Reasons- they have not given any. They just ignore me!

[AnotherLevel]

I still think your best bet is to pursue the specific disclosure order in the ET by convincing the judge these emails exist and they are of material importance to your claim.

The problem with the GDPR compensation is what would you claim it for exactly? The only thing I can see is distress and inconvenience, which is likely to be a nominal damages award. You cannot claim that their failure to provide these emails resulted in you losing your ET claim because that has not happened yet.

In the meantime, I would still raise a formal complaint with the ICO. You lose absolutely nothing from doing this and it takes no more than 10 mins to complete their form.

[AnotherLevel]

Just to add to this - I have some idea of costings (these are very ball park):

To review existing correspondence/SAR/evidence and to send a strongly worded letter - £1,500

To file a claim, submit all the evidence/trial bundles and attend 1 day hearing - £15,000

If it goes to appeal, you can easily be looking at another £15,000

This is why the legal enforcement of GDPR is reserved for those with deep pockets. A complaint with the ICO costs nothing, they can issue an enforcement notice and a complaint upheld in your favour is a very strong piece of evidence for any future legal proceedings.

[psychojuice]

Unless a data controller is willing to accept a settlement for a GDPR breach, your only option is to pursue them in court for compensation. The ICO does not seek compensation on behalf of data subjects.

There isn't any guidance at the moment on which court track a GDPR claim will take. In my case the High Court is the preferred option because the claim is somewhat technical, the jurisdiction issue and it create more pressure on my former employer.

People have to be realistic in their expectations for compensation. Say a data controller responds to a SAR on day 40, rather than within the one month period for a response. Does this mean the data subject can claim £1,000s in compensation? Of course not and if they wanted to claim a large sum of compensation, they would need to demonstrate to a judge that they suffered this loss as a result of the breach of their rights under GDPR.

There is already quite a bit of case law under the previous DPA about claims for compensation such as distress. However, most of these have come in the past 4 years or so. As GDPR does not explicit define the judicial remedies, it's ultimately at the court's discretion what to award someone.

With your ET claim, if you want to claim compensation for an infringement of your rights, you will need to prove:

1) You need to demonstrate that that the information containing your personal data exists, that your employer should have disclosed it and by not disclosing it, your rights under GDPR/DPA have been infringed.

2) If you're claiming you lost your ET as a result of the infringement, you will need to prove that if they provided this information containing your personal data, it would have resulted in a different outcome in your claim.

This is going to be so difficult for you to achieve, especially number 2. Ultimately if something exists that would have a material affect on your ET claim, it should be disclosed as part of the disclosure stage. If you can prove it exists, then deal with it as a matter of specific disclosure rather than waiting to lose your ET claim and bring a claim for compensation under GDPR/DPA. If a judge does not believe a document exists as part of disclosure under your ET, you stand little to no chance that another judge will believe the document exists for purposes of GDPR/DPA.

Here's one for you.

For my employment tribunal, one of the witnesses has mentioned that I failed a work related course. This has nothing to do with my ET claim for race discrimination, but he is using it as ammo for not giving me the job. Under the DPA/GDPR

Are test scores classed as sensitive data?
Is the witness (who is a manager, but not mine) allowed to disclose such data to the ET without my consent, when it has nothing to do with my claim?
Has the data protection act been breached here?
Should I inform the ET that this has happened?

[AnotherLevel]

Are test scores classed as sensitive data?

I don't believe so. This is what the DPA 2018 defines as sensitive personal data:

(7) In this section, “sensitive processing” means—
(a) the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership;
(b) the processing of genetic data for the purpose of uniquely identifying an individual;
(c) the processing of biometric data for the purpose of uniquely identifying an individual;
(d) the processing of data concerning health;
(e) the processing of data concerning an individual’s sex life or sexual orientation;
(f) the processing of personal data as to—
(i) the commission or alleged commission of an offence by an individual, or
(ii) proceedings for an offence committed or alleged to have been committed by an individual, the disposal of such proceedings or the sentence of a court in such proceedings.

Is the witness (who is a manager, but not mine) allowed to disclose such data to the ET without my consent, when it has nothing to do with my claim

They are allowed to disclose anything that is relevant to your ET case and the determination of this is going to be made by the judge. If it is mudslinging, then the panel is going to take a very dim view of this.

Has the data protection act been breached here?

In what way? If the judge believes this information is relevant to your ET case, then your employer will be able to use the legitimate interest argument for processing this data.

Did your employer provide this information as part of your GDPR request?

Should I inform the ET that this has happened?

I am not sure on what basis you could inform the ET. If these test scores are completely irrelevant to your claim, then it's probably going to be in your interest from a tactical viewpoint to let your employer run with them because all that will happen is they will damage their defence to your claim.

[psychojuice]

AnotherLevel have you managed to get any further with your gdpr claim?

[AnotherLevel]

We decided to wait for the ICO and have put together a fairly lengthy complaint file for them to review.

The problem with the legal route is:

1) The cost of litigation in inherently expensive and you are easily talking £10,000s to go through the process if you are fully represented throughout.

2) I doubt I will ever get the personal data I am really after because it will be extremely damaging to my employer.

[psychojuice]

We decided to wait for the ICO and have put together a fairly lengthy complaint file for them to review.

The problem with the legal route is:

1) The cost of litigation in inherently expensive and you are easily talking £10,000s to go through the process if you are fully represented throughout.

2) I doubt I will ever get the personal data I am really after because it will be extremely damaging to my employer.

I'm clearly missing something here. The law says that a company must provide all data held on a person within a month of the request.

So if such a company fails to provide all the data (or no data) within 1 month, they are in breach- yes?

Why is it anymore complicated than that? Surely you would ask a magistrate to decide. Show the SAR, show what you got/ did not get, and ask the magistrate to decide on whether the company has breached the GDPR. If they have, then ask for compensation to be awarded.

Surely, there is no more to it than that? Isn't that the whole point of the GDPR, to allow the little people to have the same power as a multinational?!

[AnotherLevel]

I'm clearly missing something here. The law says that a company must provide all data held on a person within a month of the request.

So if such a company fails to provide all the data (or no data) within 1 month, they are in breach- yes?

Laws state many things, but it's ultimately up to a court to uphold the laws.

If you buy a TV and it blows up after 2 years, you should be protected under the Consumer Rights Act. However, what if the retailer says your 1 year warranty has expired and the manufacturer will only repair the TV if someone pays for it? If you reach a situation where the retailer/manufacturer won't do anything, your only option is for the courts to intervene.

Why is it anymore complicated than that? Surely you would ask a magistrate to decide. Show the SAR, show what you got/ did not get, and ask the magistrate to decide on whether the company has breached the GDPR. If they have, then ask for compensation to be awarded.

Magistrates are lay people with no legal qualifications who have very little involvement in civil issues. They would have no involvement in data protection disputes like this.

If you bring an action for failing to comply with a SAR, the onus is going to be on you to demonstrate several things:

1) The defendant is a data controller
2) The defendant processes and stores your personal data
3) The defendant has not provided your personal data within the statutory time limit

In a case where someone does not respond to a SAR, then this is usually straightforward. You obviously need to be careful that you have issued the SAR to the right organisation and you have proof of delivery.

In a case where someone does respond to a SAR but you believe they have not provided all personal data, then it is certainly not straightforward. This one is often going to be very difficult to prove because you are not in control of the data yourself.

I'll give you a very simple example - I made a SAR to a company recently. They responded to the SAR with really minimal personal data (just my name/email address). I replied to them, mentioning all the emails I sent to them etc., and they provided another response stating that one week before the enforcement of GDPR came into effect, they deleted all my personal data. Where do I go with that? I cannot prove whether what they said was true or not, but it's certainly strange and this is one I am raising with the ICO.

[psychojuice]

Does anyone know the answer to this?

Am I entitled to get a copy of the written notes, produced by the counsel for the respondent, at an employment tribunal? The respondent says it is privileged information. But I disagree.

I know that there is a stated case which says that the Judge's notes should be released to the claimant. Given that I can get a copy of the judge's notes, why should I not get the notes from the respondent's counsel.

[R0b]

You can't have the other side's notes because it will fall under litigation privilege. They will be considered notes created and prepared specifically for the purpose of litigation. It enables the party's legal representative to assess and prepare a party's case, including the merits of a case without the need to worry about disclosing the contents to the other side. If documents such as these were disclosable then no legal representative wold want to put anything in writing for fear that it would show the other side their tactic or strategy. It is simply not practicable and the documents are confidential to the client the legal representative is representing.

Judges notes on the other hand, are not covered by privilege because for starters, a judge is deemed impartial.

Litigation privilege has been around for centuries and isn't going to change any time soon. If you want to know more about it then I would suggest you do some googling.