Stuart Sutton & Ors v Currys Retail Group Limited [2024] EWHC 157 (KB)

[2024] EWHC 157 (KB)Case No KB-2023-003287
IN THE HIGH COURT OF JUSTICE
KING'S BENCH DIVISION
MEDIA & COMMUNICATIONS LIST
Venue Royal Courts of Justice, Strand, London, WC2A 2LLDate 30/01/2024
Before
SUSIE ALEGRESITTING AS A DEPUTY JUDGE OF THE HIGH COURT
Between
STUART SUTTONClaimantsCURRYS RETAIL GROUP LIMITEDDefendant/CURRYS GROUP LIMITED Applicant
Philip Coppel KC (instructed by Barings Limited) for ClaimantsRupert Paines (instructed by Pinsent Masons LLP for DefendantHearing Hearing date: 18 January 2024
Approved JudgmentThis judgment was handed down remotely at 10.30am on 30 th January 2024 by circulation to the parties or their representatives by e-mail and by release to the National Archives.............................

Susie Alegre, sitting as a Deputy Judge of the High Court :

[1]The Claimants are 711 individual claimants, grouped together as an informal “mass claim” issued on a single claim form. The Defendant is Currys, a national retail chain that sells electrical and computer equipment. It is now agreed that the claim is against Currys Group Limited (CGL) although the claim was originally issued against Currys Retail Group Limited (CRGL), I will refer to the defendant as “Currys” for the purposes of this judgment.[2]The claim against Currys, seeks distress damages for alleged breach of the Data Protection Act 1998 (“DPA 1998”) (the civil proceedings). The alleged breaches relate to a cyber-attack on Currys in 2017-18 which allowed criminals to gain access to Currys’ customer data. The claimants bring their claim for breach of data protection principle 7 (“DPP7”) under section 4(4) of the DPA 1998. DPP7 requires a data controller to take “appropriate technical and organisational measures” against (inter alia) unauthorised or unlawful processing of personal data.[3]Currys informed the Information Commissioner’s Office (ICO), the regulator for data protection, about the attack in June 2018 and also took steps to notify customers about it. The ICO investigated and issued a Monetary Penalty Notice (MPN) fining Currys £500,000 for breaches of DPP7. Currys appealed to the First-Tier Tribunal (FTT) which overturned some of the findings of breach but upheld two in a decision of 6 July 2022. The FTT reduced the fine to £250,000. Currys has (with permission) appealed certain conclusions of the FTT to the Upper Tribunal (the “UT Appeal”). The UT Appeal will be heard by a three-judge panel in June 2024. Of particular relevance to this application, the UT Appeal will consider the question of whether the credit card data accessed by the attackers is personal data. The Claimants are not parties to the proceedings in the UT Appeal (the regulatory proceedings).

Application for Stay of Proceedings

[4]Currys applies to stay the civil proceedings, either until the conclusion of the regulatory proceedings, or (at least) until the conclusion of the UT Appeal.

The Law

[5]CPR 3.1(2)(f) provides that the Court may “stay the whole or part of any proceedings or judgment either generally or until a specified event.” The exercise of that power by the Court must give effect to the overriding objective of the CPR of “enabling the court to deal with cases justly and at proportionate cost” (CPR 1.1). CPR 1.1(2) clarifies that giving effect to this objective includes, among other things:
“... (b) saving expense, (c) dealing with the case in ways which are proportionate (i) to the amount of money involved, (ii) to the importance of the case, (iii) to the complexity of the issues, and (iv) to the financial position of each party, (d) ensuring that it is dealt with expeditiously and fairly and allotting to it an appropriate share of the court’s resources, while taking into account the need to allot resources to other cases....”
[6]There was no substantive disagreement on the applicable legal principles. The question for me is how they apply in this particular case. Several cases provide useful guidance on the application of the legal principles. The recent case of Ticketmaster v Information Commissioner [2021] UKFTT 0083 (GRC) addressed the question of a stay of proceedings in a comparable case from the opposite perspective to this case – it was a stay of regulatory proceedings in the FTT pending the conclusion of relevant civil proceedings in the High Court. While not binding on me, it is a helpful summary of relevant judgments, in particular: (a). the judgment of the Inner House of the Court of Session in Revenue and Customs Commissioners v RBS Deutschland Holdings GmbH [2007] STC 814 which said at [22]:
“a tribunal or court might sist proceedings against the wish of a party if it considered that a decision in another court would be of material assistance in resolving the issues before the tribunal or court in question and that it was expedient to do so.” (b). AB (Sudan) v Secretary of State for the Home Department [2013] EWCA Civ 921 at [26]: “… In determining whether proceedings should be stayed, the concerns of the court itself have to be taken into the balance. Decisions as to listing, and decisions as to which cases are to be heard at any particular time are matters for the court itself and no party to a claim can demand that it be heard before or after any other claim. The court will want to deal with claims before it as expeditiously as is consistent with justice. But, on the other hand, it is unlikely to want to waste time and other valuable resources on an exercise that may well be pointless if conducted too soon. If, therefore, the court is shown that there will be, or there is likely to be, some event in the foreseeable future that may have an impact on the way a claim is decided, it may decide to stay proceedings in the claim until after that event. It may be more inclined to grant a stay if there is agreement between the parties. It may not need to grant a stay if the pattern of work shows that the matter will not come on for trial before the event in question. The starting point must, however, be that a claimant seeks expeditious determination of his claim and that delay will be ordered only if good reason is shown.”
[7]The recent Court of Appeal case of Churchill v Merthyr Tydfil Borough Council and ors [2023] EWCA Civ 1416 is also of relevance. In that case the court noted that: “… courts regularly adjourn hearings and trials to allow the parties to discuss settlement. It would be absurd if they could not do so simply because one of several parties, for example, resisted the adjournment.” [51][8]In Athena Capital Fund SICAV-FIS SCA and others v Secretariat of State for the Holy See [2022] EWCA Civ 1051 the Court of Appeal considered an application to stay proceedings pending the conclusion of parallel proceedings in another jurisdiction. The court found that, in exercising its discretion to grant a stay “[t]he test is simply what is required by the interests of justice in the particular case.” [48]. But it also underlined that:
“The usual function of a court is to decide cases and not to decline to do so, and access to justice is a fundamental principle under both the common law and Article 6 ECHR. The court will therefore need a powerful reason to depart from its usual course and such cases will by their nature be exceptional.”
[9]In Smart Choice Metering Ltd & Others v Fagan & Anor [2021] EWHC 2227 (Comm) at [25] the court noted that a stay that does not have a fixed timescale that can be clearly calculated in advance is particularly problematic.

The Arguments

[10]In summary, Mr Paines for the Applicant argues that the issue of classification of credit card data as personal data due to be decided by the UT Appeal will have a significant impact on the levels of quantum in this claim. Therefore, he says that the outcome of that appeal will affect potential early settlement once that issue is resolved. Staying these proceedings pending resolution of that issue would, he says, narrow the issues at trial, increase the chances of early settlement and save expense.[11]Mr Coppel for the Claimants contests the application, arguing, in summary, that a stay undermines the Claimants’ ability to enjoy expeditious justice and that the legal issues in play in these proceedings are separate from the regulatory proceedings although they are related. He also submits that the Defendants have given no indication that they will be bound by the judgment of the UT Appeal and that there is a chance that the regulatory proceedings could continue on to the Supreme Court with no clear timeline that can be calculated in advance.

Analysis

[12]In my view, the outcome of the UT Appeal is relevant for the civil proceedings. Mr Coppel for the Claimants suggested that, in light of the different thresholds applicable in the regulatory proceedings and the civil proceedings among other differences, we are effectively comparing “apples and pears”. It is clear that the regulatory proceedings and this civil claim are quite different in their nature. In particular, the Claimants are not involved in the regulatory proceedings. However, I recognise that the UT Appeal is allowed on the basis of a novel point of law – that is the question of whether the credit card data amounts to “personal data” for the purposes of the DPA – that will be of fundamental relevance to the quantum in this case.[13]The Claimants’ letter of claim dated 18 May 2023 lists an estimate for damages arising from credit card data of this sort as £5000 per claimant as opposed to £1000 for basic personal data or £2000 for basic data plus additional information such as dates of birth or failed credit check details. Whether the credit card data is considered as personal data for the purposes of the claim will have a significant impact on potential quantum and the scope for settlement.[14]There is a date already set for the UT Appeal in June 2024 before a panel of three expert judges. While their judgment would not be binding in these proceedings, it would be persuasive. Any further judgment in either the Court of Appeal or the Supreme Court would be binding on the court in the civil proceedings. Mr Coppel points out that the Defendants have not agreed to be bound by the decision of the UT Appeal in their engagement in the civil proceedings. But the outcome of the UT Appeal will certainly have a bearing on both parties’ approach to the civil proceedings and, in particular, on the potential for settlement and would provide helpful background to the court in the civil proceedings.[15]It is clear that continuing the civil claim in parallel with the UT Appeal will have significant consequences for costs and for court time. The nature of the claim, with 711 individual claimants, each claiming a relatively small sum in damages (between £1000 and £5000 each) means that it is likely to require considerable case management as it progresses. Taking account of the level of costs in the Claimants’ statement of costs for this hearing alone, the costs that are likely to be incurred if the claim continues pending the outcome of the regulatory proceedings will be significant.[16]I have considered the impact of a stay on the Claimants in weighing up the interests of justice in the circumstances. The claim relates to a data protection breach in 2017-18 and is a claim for damages for distress. The claim was issued in 2023, several years after the incident and after the decision of the FTT in the regulatory proceedings. While the principle of expeditious justice is important, staying the case pending the outcome of the UT Appeal will not materially change the situation of the individual Claimants.[17]Taking account of the overriding objective, I find that there are good reasons for a stay in these proceedings pending the outcome of the UT Appeal and that to stay the proceedings to that extent is in the interests of justice in this case. Expeditious justice does not necessarily require the continuation of litigation – it may equally be served by the possibility of early settlement which saves time and costs for both parties.[18]A stay pending the outcome of the UT Appeal should give the parties the opportunity to reconsider their positions in the light of a persuasive judgment from an expert panel of judges. While not binding on the court in the civil proceedings, the UT Appeal will provide useful guidance on a novel point of law which will assist in narrowing the issues in the civil proceedings. The high costs associated with continuing the civil claim in parallel to the regulatory proceedings could undermine the potential for settlement at that stage. It may also use up significant court resources unnecessarily in a complex but relatively low value case, the conduct of which will undoubtedly be affected, in one way or another, by the outcome of the regulatory proceedings.As noted by the court in AB (Sudan) v Secretary of State for the Home Department [2013] EWCA Civ 921 at [26] the court “is unlikely to want to waste time and other valuable resources on an exercise that may well be pointless if conducted too soon.”[19]Taking note of Smart Choice Metering Ltd & Others v Fagan & Anor [2021] EWHC 2227 (Comm)at [25], a stay pending the outcome of the UT Appeal gives a timescale that can be estimated as likely to be within the year. It would not be in the interests of justice at this stage to grant a stay which effectively allows the Defendants to pursue further appeals in proceedings over which the Claimants have no control. That would effectively be a stay, the length of which is impossible to estimate. Once the UT Appeal outcome is known, the parties will be in a better position to review the civil proceedings.[20]For these reasons I grant the application for a stay in these proceedings until the outcome of the UT Appeal.

Costs

[21]The parties have submitted written submissions on costs. In summary, Mr Coppel submits that the costs associated with the application to stay should be decided by comparing what the Defendant secured against what the Defendant sought. He submits that the costs of the Defendant’s unitary position should be borne by the Defendant. Mr Paines submits that there is no good reason to deprive the Defendant, as the successful party of their costs.[22]Having considered the submissions of both parties, I am satisfied that the Defendant did offer, as an alternative, the possibility of a stay pending the outcome of the UT Appeal which is the outcome they secured. This was explicitly set out in the first witness statement of Ms. Henzell dated 6 October 2023 at §41:
“Currys accordingly applies for a stay pending the outcome of the Regulatory Proceedings (ie., covering the Upper Tribunal Appeal, and any further appeal). An alternative option would be for the Court to order a stay until the conclusion of the Upper Tribunal Appeal, with the position to be reassessed at that point, if an appeal to the Court of Appeal was pursued. That approach would mean a shorter duration of the stay in the first instance, but in Currys’ view it may also lead to an unnecessary additional hearing following the hand-down of the Upper Tribunal Appeal, at a stage when it might not be known whether the Court of Appeal will grant permission to the disappointed party before the Upper Tribunal to lodge a further appeal. It is also likely that, if permission to appeal from the Upper Tribunal were obtained, the decision of the Court of Appeal would be of equal or greater salience to the issues before the Court.”
But this option was explicitly rejected by the Claimants in the witness statement of Mr Cooper dated 9 January 2024 at §16. Had the Claimants engaged with this possibility, the hearing and associated costs could have been avoided.[23]The caselaw indicates that, the fact that a party won on some issues and lost on others, is not usually a reason for depriving that party of part of their costs such as Fox v Foundation Piling Ltd [2011] C.P. Rep. 41 at [48], Oldcorn v Southern Water Services Ltd[2017] 2 Costs L.O. 227 at [12]-[13]. In the circumstances, I can see no reason to depart from the principle set out in CPR 44.2(2)(a) that “the general rule is that the unsuccessful party will be ordered to pay the costs of the successful party.” The Defendant is clearly the successful party in this application. Therefore, the Claimants are to pay the costs of the Defendant in relation to the application to stay proceedings.[24]Both parties agree that summary assessment is appropriate in this case in accordance with CPR PD44 §9.2(b). There is also little dispute in their submissions as to appropriate quantum despite the disparate statements of costs submitted (the Claimants’ statement of costs totalled £89,550 while the Defendant’s statement of costs totalled £35,724.94). Taking account of the submissions and the statements of costs, I find that the costs claimed by the Defendant are proportionate and were reasonably incurred. Costs are assessed summarily at £35,724.94.

Application for Substitution

[25]Finally, I am asked to grant an application to substitute the Second Applicant “CGL” for the Defendant “CRGL”. This application arises because the Claimants issued a claim form naming the wrong party. The application is agreed, but I am asked to decide on the issue of costs.[26]Having considered submissions from counsel for the Claimants and the Defendant, I find that the costs for the application to substitute should be borne by the claimants as the reasons for the application are based in the Claimants’ error although the Defendant is making the application formally as an add-on to its more substantive application to stay the proceedings. The correspondence between the parties on this issue prior to the application does not demonstrate a practical effort on behalf of the Claimants to take the necessary procedural steps to avoid the additional costs of the application. In particular, I note that the Claimants, while suggesting that service on CGL should be dispensed with, did not issue an application to that effect.