“- The breach was caused by your [Sussex Police’s] data processor [the Defendant]. You had notified them of the change of addresses and they failed to effectively update their systems. - You have conducted a risk assessment and concluded that the risk of data subjects suffering significant consequences as a result of this incident is unlikely; the data disclosed is limited in nature and each data set has only been sent to one household, who can be identified. - You have a contract with [the Defendant], which specifically states that all their staff should have received data protection training. - You have undertaken to inform the data subjects and… have been provided with a link to the ICO’s advice regarding identity theft. This can be forwarded to those data subjects to help them take any action they regard as necessary to protect their identities…”
“… claim damages for breach of statutory duty pursuant to theGeneral Data Protection Regulation and the Data Protection Act 2018 and/or misuse of private information arising from the Defendant’s failures to keep the Claimants’ personal data and private information (including financial pension information) secure by posting the same to incorrect postal addresses. The Claimants bring claims for financial and non-financial loss and damage in sums to be assessed.”
“(a) The Claimants are 474 serving police officers who are bringing claims following a data protection breach and misuse of their private information relating to sensitive financial information concerning their pension benefits. (b) Some of the Claimants are high ranking officers and others work in sensitive areas of policing.”
“17. The Claimants, being serving police officers are fearful on a number of fronts if their names and/or personal residential addresses are put into the public domain, in the sense that a third party may be able to interrogate the court file and obtain that information. 18. The Claimants are serving police officers who range from the rank of Police Constable through Sergeant, Inspector, Chief Inspector and Superintendent. Some of the Claimants are thus very high ranking officers. Further, some of these officers work in a range of sensitive areas with higher levels of security and vetting. These areas include firearms, counter-terrorism, intelligence, public protection, safeguarding and child protection. 19. As police officers, all Claimants, but particularly those of higher ranks and in these sensitive areas feel that they legitimately need to protect both their identity as having been involved in a data breach concerning their sensitive financial information, and their true address details. 20. The latter point is of obvious relevance and concern to all police officers as their private residential address ought not to be available in the public domain at all having regard to their job and function. Therefore, there is a risk that suspects, associates, victims of crime, witnesses or others involved with the relevant officer may obtain their home address. The Claimants’ knowledge that this may happen adds to their anxiety and fear for their safety. 21. Further, it is likely that when the claim is issued at court, there may be some press interest and that could lead to the Claimants’ names and their addresses being made available to non-parties who conduct a search of the court file. This is likely to lead to reports that certain named officers have been the subject of a data leak. 22. Importantly, bearing in mind that there are certain categories of personal data as set out … above which may be in the hands of third parties already, it is entirely conceivable that much in the same way as wrongdoers may seek to “phish” for information from victims, those wrongdoers may obtain a further piece of the jigsaw by obtaining full names, middle names, initials or true home addresses of the Claimants as contained on the court file.”
“Anonymity orders are derogations from open justice which must be strictly justified. Although, on the evidence available, I consider that the Claimants may well succeed in demonstrating that there remain cogent grounds for withholding their addresses, the Court will want to look again at the justification, and evidence in support, for withholding the Claimants’ names. In this respect, attention is drawn to Various Claimants -v- Independent Parliamentary Standards Authority [2022] EMLR 4. Some Claimants may have a stronger justification for anonymity than others, and the evidence may vary between the Claimants.”
“The Claimant has suffered and continues to suffer distress. The Claimant works in a highly sensitive area of policing… The Claimant has always been rigorous in his measures to ensure that he keeps his work life and private life separate. Only trusted friends and family members know the nature of his employment. The ABS was posted to an address at which the Claimant had not lived for at least 10 years. That address is in the same neighbourhood in which the Claimant continues to life and the Claimant does not disclose the nature of his employment to his neighbours… The Claimant felt compromised and vulnerable knowing that a document containing sensitive information about him, and the nature of his employment, had been sent to an address in his neighbourhood and that there was no knowing who now had that information and what they might do with it… The Claimant was distressed about the potential consequences of the information falling into the hands ot someone on the other side of the law… The Claimant was distressed because his family might be at risk… The Claimant considers these risks to be remote, but it is precisely the type of risk that officers … are trained to identify and mitigate against yet, through no fault of the Claimant, the risks were live and real due to the breach… The Claimant suffered and continues to suffer anxiety for the reasons explained… and with regard to the potential for other misuse of the data that was not protected such as the information being used to open bank accounts, apply for jobs or credit cards in the Claimant’s name… The Claimant can see no end to the annoyance, distress and anxiety that he suffers as the data that was not protected is not going to change and might be misused at any time.”
“… during the course of [the] exercise [to provided the Individual Schedules], it has become apparent that approximately 75 Claimants (“the Medical Claimants”) require a medical examination by a psychologist. The data breach has caused the Medical Claimants to suffer to the extent that warrants the referral to a medical expert. We are in the process of making the necessary referral to experts for the Medical Claimants and will be in receipt ofCPR Part 35 compliant medical reports in due course.”
“You are no doubt aware that the Claimants have sought to manage this claim at proportionate cost throughout. The Claimants’ stated intention throughout has been to have these claims managed by way of a mechanism akin to group litigation. We have maintained this to be the most proportionate way of managing the claim as a whole. To that end elements of individual work were deliberately restricted so as to keep costs to a minimum and to provide you with the necessary claim information in the form of Schedule of Information (“SOI”). This wouldn’t have required a deep dive, and the associated cost, into detailed distress and medical information for each Claimant. However, your client has disagreed with the Claimants’ proposed mechanism throughout this claim. You sought individually particularised statements of case for each and every Claimant in this action and that is what the Master ordered. As part of that costly exercise, we have had to take full and complete instructions in order to answer the questions set by the Master, at your behest. Full and complete instructions from every Claimant have been taken. As a result of that exercise, it is clear that there is (sic) significant levels of aggravation amongst the Claimant cohort and must now be investigated. The exercise that you have requested throughout this litigation has been completed and it has escalated costs and potentially damages significantly. You cannot reasonably now complain that these instructions should have been taken at the start of the claim when you do not like the results of your client’s own submissions. Essentially, your client has made its bed and now it must lie in it. Contrary to your point that we are only now asserting personal injury claims, we would ask you to re-read the Claimants’ letter of claim dated28 February 2020 in which it was stated... that ‘… it may be appropriate in certain individuals’ cases to consider the psychological and psychiatric impact of the personal data breach’. Further, in … the Master Particulars of Claim it was stated that ‘Further, certain of the Claimants have suffered an aggravation of pre-existing medical conditions and seek general damages as a result.’ Arguably, those Claimants now advancing ‘medical claims’ fall under that paragraph. However, it is only out of an abundance of caution and in circumstances where you may seek to argue otherwise and take a limitation point that we had hoped that the parties could co-operate in agreeing a standstill agreement. Such a course would further the parties’ obligations to co-operate with each other, save costs and be in accordance with the overriding objective. However if, as it seems, you wish to take the point, we will have to act accordingly in order to protect the Claimants’ position… We will now start work to prepare to issue a further claim form for the medical Claimants with the associated cost of the Court fee…”
“SUSSEX POLICE PENSION ANNUAL BENEFIT STATEMENT A Benefit Statement is attached showing the details that we hold about you and the pension benefits you are accruing under the Police Pension as at [date]. If the information we hold about you is wrong, this could affect the way we calculate your pension when you come to claim it. Action for You Please read the enclosed notes and check carefully that the details on the Benefit Statement are correct as far as you can tell. You need to: • tell us of any mistakes; please send an email to us at the above address. Revised Benefit Statements will not be issued to reflect amendments to address, National Insurance number, title, marital status or spelling errors. These amendments will be reflected in your next Annual Benefit Statement. Where it is necessary to re-issue a statement we will endeavour to send this to you within 8 weeks of your email. • ask us if you are unsure about any of the details; experience has shown that it is better to put things right now rather than waiting until retirement. If you have any queries or are not sure about what some of the details contained on the Benefit Statement mean, please contact us using the above email address; • keep the Benefit Statement; including any details or comments that you have made on it or have attached to it until you reach retirement (or leave the Scheme). Action for us As pension scheme administrators, we want to maintain your records properly and ensure that we calculate your pension correctly. If you find any errors in the Benefit Statement, we will correct them. We will send you a Benefit Statement annually so that you can see how your pension benefits are growing and to check the details we hold.”
“The Court has already made an Order directing the reconsideration of the Anonymity Order in the Main Claim. Although the Order of21 December 2022 properly held the ring in respect of the anonymity of the Claimants in this claim pro tem, the issue of anonymity will be considered at the [hearing on 27-28 February 2023 ]. I do not presently understand why this further claim has been issued. It risks complicating (and therefore obstructing) the just disposal of the Claimants’ claims and has already generated satellite applications that the Court will need now to resolve. I have therefore directed the service of a witness statement by the Claimants’ solicitors to explain.”
“This advice is given to ensure that members of the public cannot identify officers outside of work and so that officers can preserve the confidentiality of their addresses. Unfortunately, there are people who would seek to do harm to police officers and indeed their families. Someone who has been arrested by an officer, or who has come into contact with them, may seek a confrontation. It is one thing when this happens at a police station, but another if it happens at the home address of the officer where their family resides…”
“Police officers are considered legitimate, accessible and symbolic targets for attack by Islamist and Extreme Right-Wing terrorists…”
“2.1 Statements of case should be confined to the information necessary to inform the other party of the nature of the case that they have to meet. Such information should be set out concisely and in a manner proportionate to the subject matter of the claim… 2.2 A claimant must in the particulars of claim give full details of the facts and matters on which they rely in support of any claim for damages. … 8.1 In a claim for misuse of private information, the claimant must specify in the particulars of claim … the use … of the information by the defendant which the claimant claims was … a misuse…”
“… may include unintentional use, but it still requires a ‘use’: that is, a positive action. In the language ofArticle 8 ECHR (the basis for the MPI tort), there must be an ‘interference’ by the defendant, which falls to be justified.”
“In passing the Smart TV to a third party the defendant was not making use of the data or information that is the subject of this claim. In fact, there is no evidence that the defendant had any actual knowledge of the information in question or made use of it. It follows that there cannot have been any unauthorised use (or misuse) of the information by the defendant. It would be artificial to characterise the disposal of the Smart TV as a misuse of the information itself. At best, it could be said that in failing to wipe the device, the defendant was responsible for breaching a duty of data security, but this is insufficient on the facts of this case to make out claims for either BOC or MOPI.”
“It is not necessary in all cases to prove that the libellous matter was actually seen and read by some identified third party. If it is a matter of reasonable inference that this happened, a prima facie case of publication will be established. Thus, proof that a libellous letter was sent through the post is prima facie evidence of publication to the person to whom it was addressed… There is no presumption that a letter in an unsealed envelope will be read by anyone other than the addressee: Huth -v- Huth. It is always open to a claimant to seek to prove that in the particular case it was a natural and probable consequence of sending the letter, sealed or unsealed, that it would be opened and read by a third party: see Theaker -v- Richardson. Or that the defendant knew that a letter addressed to the claimant was likely to be opened by his clerk or secretary, and that is what happened: Gomersall -v- Davies(1898) 14 TLR 430 .”
“While the law is used to awarding damages for injured feelings, there is no reason in principle … why it should not also make an award to reflect infringements of the right itself, if the situation warrants it.” [101] The judge referred to cases in which damages have been awarded to very young children (only ten months or one year old) for misuse of private information by publishing photographs of them even though, because of their age, they could not have suffered any distress: see AAA -v- Associated Newspapers Ltd [2013] EMLR 2; and Weller -v- Associated Newspapers Ltd [2014] EMLR 24. He concluded, at [144]: “I shall therefore approach the consideration of quantum in this case on the footing that compensation can be given for things other than distress, and in particular can be given for the commission of the wrong itself so far as that commission impacts on the values protected by the right.”
“the damages should compensate not merely for distress … but should also compensate (if appropriate) for the loss of privacy or autonomy as such arising out [of] the infringement by hacking (or other mechanism) as such.” [102] The Court of Appeal affirmed this decision:[2017] QB 149 . Arden LJ (with whom Rafferty and Kitchin LJJ agreed) held, at [45], that: “the judge was correct to conclude that the power of the court to grant general damages was not limited to distress and could be exercised to compensate the claimants also for the misuse of their private information. The essential principle is that, by misusing their private information, MGN deprived the claimants of their right to control the use of private information.”
“everyone has the right to the protection of personal data concerning him or her”
“… there is any realistic prospect of a trial yielding any tangible or legitimate advantage such as to outweigh the disadvantages for the parties in terms of expense, and the wider public in terms of court resources.”
“Restrictions on open justice to protect the legitimate interests of others raise more difficult issues. The starting point is the recognition that open justice (and probably of greater practical significance, the privilege that attaches to media reports of proceedings in open court) will frequently lead to some interference with the legitimate interests of parties and witnesses. Media reports of proceedings in open court can have an adverse impact on the rights and interests of others, but, ordinarily, ’the collateral impact that this process has on those affected is part of the price to be paid for open justice and the freedom of the press to report fairly and accurately on judicial proceedings held in public’: Khuja -v- Times Newspapers Ltd[2019] AC 161 [34(2)] per Lord Sumption.”
“There might exist a very small number of people whose attitude towards MPs (and those who work for them) is so hostile that they might conceivably be moved to offer some threat of physical violence to them, but this risk is remote. The Claimants have not put forward any credible and specific evidence that one or more Claimants is at particular risk of any such threat. The civil justice system and the principles of open justice cannot be calibrated upon the risk of irrational actions of a handful of people engaging in what would be likely to amount to criminal behaviour. If it did, most litigation in this country would have to be conducted behind closed doors and under a cloak of almost total anonymity. As a democracy, we put our faith and confidence in our belief that people will abide by the law. We deal with those who do not, not by cowering in the shadows, but by taking action against them as and when required.”
“(1) The starting point is the common law principle of open justice, authoritatively expounded in Scott -v- Scottand subsequent authorities at the highest level. The judge was right to begin here. The summary of the common law principles which he adopted from the argument of Mr Bentham is not materially different from the summary in the Judicial College Guide, approved in R (Rai) -v- Winchester Crown Court [2021] EMLR 21. (2) The general principles that (a) justice is administered in public and (b) everything said in court is reportable both encompass the mention of names. As a rule, ‘[t]he public has a right to know, not only what is going on in our courts, but also who the principal actors are’: R (C) -v- Secretary of State for Justice[2016] 1 WLR 444 [36] (Baroness Hale). In this case, it is clear that but for the claimant’s late request for a derogation from these principles the NCA would have named him in open court. Its decision to do otherwise was a purely executive act which has no bearing on the propriety of the judge’s decisions to grant and then lift anonymity. Those were decisions about what the law required. It would have been irrelevant if the NCA had consented to an anonymity order, as parties cannot waive or give up the rights of the public: see the Practice Guidance [16]. (3) When considering the application for derogation in this case the judge was right to identify and apply a test of necessity. Under the common law as it existed prior to the entry into force of theHuman Rights Act 1998 , anonymity could only be justified where this was strictly necessary ‘in the interests of justice’: see Khuja [14]. This was and remains an exception of narrow scope: see the tests cited in Clifford -v-Millicom[2023] ICR 663 [31]-[32]. It has never been suggested that this case meets that standard. The claimant’s case rests on the common law privacy right derived from Article 8, to which the Supreme Court referred in Khuja. But in that context too the applicant for anonymity has to show that this is necessary in pursuit of the legitimate aim on which he relies. (4) The threshold question is whether the measure in question – here, allowing the disclosure of the claimant’s name and consequent publicity – would amount to an interference with the claimant’s right to respect for his private and family life. This requires proof that the effects would attain a ‘certain level of seriousness’: ZXC -v- Bloomberg LP[2022] AC 1158 [55], Javadov -v- Westminster Magistrates’ Court[2022] 1 WLR 1952 [39]… (5) The next stage is the balancing exercise. Both the judge’s decisions expressly turned on whether it was ‘necessary and proportionate’ to grant anonymity. That language clearly reflects a Convention analysis and the balancing process which the judge was required to undertake. The question implicit in the judge’s reasoning process is whether the consequences of disclosure would be so serious an interference with the claimant’s rights that it was necessary and proportionate to interfere with the ordinary rule of open justice. It is clear enough, in my view, that he was engaging in a process of evaluating the claimant’s case against the weighty imperatives of open justice. (6) It is in that context that the judge rightly addressed the question of whether the claimant had adduced ‘clear and cogent evidence’. He was considering whether it had been shown that the balance fell in favour of anonymity. The cases all show that this question is not to be answered on the basis of ‘rival generalities’ but instead by a close examination of the weight to be given to the specific rights that are at stake on the facts of the case. That is why ‘clear and cogent evidence’ is needed. This requirement reflects both the older common law authorities and the more modern cases. In Scott -v- Scott at p.438 Viscount Haldane held that the court had no power to depart from open justice ‘unless it be strictly necessary’; the applicant ‘must make out his case strictly, and bring it up to the standard which the underlying principle requires’. Rai is authority that the same is true of a case that relies on Article 8. The Practice Guidance is to the same effect and cites many modern authorities in support of that proposition. These include JIH -v- News Group Newspapers Ltd[2011] 1 WLR 1645 where, in an often-cited passage, Lord Neuberger of Abbotsbury said at [22]: ‘Where, as here, the basis for any claimed restriction ultimately rests on a judicial assessment, it is therefore essential that (a) the judge is first satisfied that the facts and circumstances of the case are sufficiently strong to justify encroaching on the open justice rule …’ …” ‘Where, as here, the basis for any claimed restriction ultimately rests on a judicial assessment, it is therefore essential that (a) the judge is first satisfied that the facts and circumstances of the case are sufficiently strong to justify encroaching on the open justice rule …’ …”
“The application is brought by the 474 individuals listed… who have all provided instructions… to bring a claim against the Defendant and make this application.”
“the positive misuse by the Defendant here [is] in sending to the wrong address: that is the misuse”