WILLIAM STADLER v CURRYS GROUP LIMITED [2022] EWHC 160 (QB)

[2022] EWHC 160 (QB)Case No QB-2021-002102IN THE HIGH COURT OF JUSTICEQUEEN'S BENCH DIVISIONMEDIA AND COMMUNICATIONS LISTVenue Royal Courts of Justice, Strand, London, WC2A 2LLDate 31 January 2022
Before
HIS HONOUR JUDGE LEWIS(sitting as a Judge of the High Court)
Between
WILLIAM STADLERClaimantCURRYS GROUP LIMITEDDefendant
Daniel Glover (instructed by Irvings Law) for ClaimantGemma McNeil-Walsh (instructed by the in-house legal department) for DefendantHearing Hearing date: 29 October 2021Supplemental written submissions 29 November 2021
Approved JudgmentI direct that pursuant to CPR PD 39A para 6.1 no official shorthand note shall be taken of this Judgment and that copies of this version as handed down may be treated as authentic..............................HIS HONOUR JUDGE LEWIS
[1]This is a consumer dispute about responsibility for the security of data stored on a smart television when returned to a retailer for repair.[2]The defendant applies on notice for an order striking out the claim pursuant to CPR rule 3.4(2)(a) and (b) and/or for summary judgment pursuant to CPR rule 24.2.[3]The parties have agreed that if any parts of the claim survive these applications, the matter should be transferred to the County Court.[4]Since the hearing, both parties have filed short supplemental skeletons following the Supreme Court’s decision in Lloyd v Google LLC[2021] UKSC 50.[5]Based on the witness evidence filed, the following facts do not appear to be disputed to any material extent:a. The claimant purchased a smart television from the defendant in September 2016 (“the Smart TV”). The Smart TV allowed the user to access third party “apps”, one of which was for Amazon Prime.b. In September 2020, the claimant returned the Smart TV to the defendant for repair. Although faulty, the Smart TV had enough functionality to allow a user to log out from any apps.c. The claimant was not asked by the defendant to clear and/or remove any of the apps on the Smart TV and was told to pass the device to the defendant’s employees, together with the remote and power cable (witness statement of the claimant’s solicitor dated 20.10.2021 at [8]).d. The claimant did not log out of his Amazon app (or any other apps) before leaving the Smart TV with the defendant.e. The defendant’s technical staff determined that any repair of the Smart TV would be disproportionately costly and so offered to write-off the unit and compensate the claimant with a voucher. The claimant accepted this offer and used the voucher to purchase a new television. His understanding was that the Smart TV would be destroyed.f. The defendant then sold the Smart TV to a third-party company, without performing a factory reset or data wipe.g. On or around 31 December 2020, a movie was purchased for £3.49 by someone using the claimant’s Amazon account through the Smart TV.h. The claimant telephoned the defendant. On 2 January 2021, the defendant reimbursed the claimant for the cost of the Amazon purchase (£5). On 4 January 2021, the defendant contacted the claimant again to make sure that he had changed his passwords for Amazon and any other apps, and the claimant confirmed that he had. On 11 January 2021, the defendant provided the claimant with a £200 shopping voucher as a gesture of goodwill.[6]The claimant has now brought proceedings seeking the following:a. Damages (including aggravated and exemplary damages) up to £5,000 for(i) misuse of private information (“MOPI”);(ii) breach of confidence (“BoC”);(iii) negligence; and(iv) breach of data protection law, in particular pursuant to Article 82 UK-GDPR and sections 168 and 169 of the Data Protection Act 2018.b. An injunction requiring the defendant, if it continues to process the claimant’s personal data, to act in accordance with the requirements of the UK-GDPR and the Data Protection Act 2018.c. A declaration that by processing the claimant’s personal data the defendant has breached Article 5(1) of UK-GDPR.[7]The claim for negligence is pleaded in the particulars of claim, but not in the claim form. Whilst the defendant has taken issue with this, I have proceeded on the basis that if such a claim were viable, permission to amend the claim form would be granted.[8]This application is being considered at the start of proceedings. The defendant has not yet filed its defence, nor has either party served its substantive evidence.

The defendant’s application

[9]The defendant challenges the claimant’s case on three grounds, namely that:(i) the pleading discloses no reasonable grounds for bringing a claim in any of the causes of action pleaded and the claim falls to be struck out pursuant to 3.4(2)(a);(ii) given the compensation already provided, all that remains is the “distress” purportedly caused to the claimant during the short period in which he realised his accounts had not been logged out, and such a claim is “not worth the candle” and falls to be struck out pursuant to 3.4(2)(b); and/or(iii) the claim has no reasonable prospects of success such that summary judgment ought to be granted pursuant to CPR 24.2.[10]CPR rule 24.2 provides that the court may give summary judgment against a claimant or defendant on the whole of a claim or on a particular issue if: “(a) it considers that—(i) that claimant has no real prospect of succeeding on the claim or issue; or(ii) that defendant has no real prospect of successfully defending the claim or issue; and (b) there is no other compelling reason why the case or issue should be disposed of at a trial”.[11]The approach to be taken when considering a defendant’s application for summary judgment applications was summarised by Lewison J in Easyair Limited (Trading As Openair) v Opal Telecom Limited[2009] EWHC 339 (Ch) at [15] (citations removed):
“i) The court must consider whether the claimant has a “realistic” as opposed to a “fanciful” prospect of success. ii) A “realistic” claim is one that carries some degree of conviction. This means a claim that is more than merely arguable. iii) In reaching its conclusion the court must not conduct a “mini-trial”. iv) This does not mean that the court must take at face value and without analysis everything that a claimant says in his statements before the court. In some cases it may be clear that there is no real substance in factual assertions made, particularly if contradicted by contemporaneous documents. v) However, in reaching its conclusion the court must take into account not only the evidence actually placed before it on the application for summary judgment, but also the evidence that can reasonably be expected to be available at trial. vi) Although a case may turn out at trial not to be really complicated, it does not follow that it should be decided without the fuller investigation into the facts at trial than is possible or permissible on summary judgment. Thus the court should hesitate about making a final decision without a trial, even where there is no obvious conflict of fact at the time of the application, where reasonable grounds exist for believing that a fuller investigation into the facts of the case would add to or alter the evidence available to a trial judge and so affect the outcome of the case. vii) On the other hand it is not uncommon for an application under Part 24 to give rise to a short point of law or construction and, if the court is satisfied that it has before it all the evidence necessary for the proper determination of the question and that the parties have had an adequate opportunity to address it in argument, it should grasp the nettle and decide it. The reason is quite simple: if the respondent's case is bad in law, he will in truth have no real prospect of succeeding on his claim or successfully defending the claim against him, as the case may be. Similarly, if the applicant's case is bad in law, the sooner that is determined, the better. If it is possible to show by evidence that although material in the form of documents or oral evidence that would put the documents in another light is not currently before the court, such material is likely to exist and can be expected to be available at trial, it would be wrong to give summary judgment because there would be a real, as opposed to a fanciful, prospect of success. However, it is not enough simply to argue that the case should be allowed to go to trial because something may turn up which would have a bearing on the question of construction.”
[12]CPR rule 3.4 makes provision for the court to strike out a statement of case or part of a statement of case if it appears that it discloses no reasonable grounds for bringing or defending a claim. The court may do so if it appears to the court:(a) that the statement of case discloses no reasonable grounds for bringing or defending the claim;(b) that the statement of case is an abuse of the court’s process or is otherwise likely to obstruct the just disposal of the proceedings; or(c) that there has been a failure to comply with a rule, practice direction or court order[13]The approach to strike out applications under the first limb was summarised in Duchess of Sussex v Associated Newspapers Limited [2020] EWHC 1058 (Ch)at [33]:
“(2) An application under CPR 3.4(2)(a) calls for analysis of the statement of case, without reference to evidence. The primary facts alleged are assumed to be true. The Court should not be deterred from deciding a point of law; if it has all the necessary materials it should “grasp the nettle”: ICI Chemicals & Polymers Ltd v TTE Training Ltd [2007] EWCA Civ 725, But it should not strike out under this sub-rule unless it is “certain” that the statement of case, or the part under attack discloses no reasonable grounds of claim: Richards (t/a Colin Richards & Co) v Hughes [2004] EWCA Civ 266[2004] PNLR 35 [22]. Even then, the Court has a discretion; it should consider whether the defect might be cured by amendment; if so, it may refrain from striking out and give an opportunity to make such an amendment.”

The claimant’s case

[14]The claimant says that the facts in the present action remain disputed and controversial and need to be determined at trial.[15]The main areas of factual uncertainty and/or dispute in the case appear to be:a. What information about the claimant was, in fact, stored on the Smart TV, or accessible through apps on the device that were logged in.b. Whether the claimant told the defendant at the outset that he had undertaken a reset of his Smart TV, which would have meant that he was not logged into his apps.c. Whether the repairs undertaken were subject to terms and conditions of the defendant, and what those terms said about data.d. The basis upon which the claimant agreed that the defendant could dispose of the Smart TV, and the terms on which matters were concluded.[16]In respect of sub-paragraph (a), namely what data was stored on or accessible from the television, the claimant’s position has been as follows:a. The claimant’s detailed letter of claim stated that the claimant was logged into Amazon, Sky, Disney Plus, BT Sport and BBC iPlayer, and that these applications “would have contained all of the claimant’s personal and financial details”. It was also said that the claimant used the television to access his bank accounts, and YouTube: “clearly, the TV contained vast amounts of personal/financial and or sensitive information which belonged to the claimant. The TV (with all of this information) was subsequently passed on to a third party”.b. The claimant’s solicitor subsequently signed a witness statement, with statement of truth, confirming as a fact that “the television in question contained a vast amount of personal, financial and sensitive information” (witness statement at [13]).c. The claimant’s pleaded case is much narrower, namely that the personal data (and private information) of the claimant that was compromised included inter alia the following:(i) name;(ii) account details for several apps and or accounts including Amazon Prime, Sky, Netflix, Disney Plus and BT; and(iii) payment details in respect of the above accounts.d. The claimant’s pleaded case remains unclear about what is meant by “account details”, and to what extent any of this information (in particular, payment details) would have been available to someone in possession of the television without the account password.[17]The claimant’s case in relation to damages has also been inconsistent: a. In his letter before claim, the claimant’s solicitors said:
“The claimant has suffered psychological injury/ discomfort/ distress/ inconvenience/ damage. In this regard, the claimant will seek to rely upon the case of TLU & Others v SOS Home Department as support for the assertion that psychological/ psychiatric injury can form part of “distress”
. Further by reason of the claimant having endured additional humiliation and suffering as a result of your wrong-doing he also claims aggravated damages.” b. The claimant’s solicitor subsequently signed a witness statement, with statement of truth, simply confirming that when the claimant discovered a movie had been purchased on his account he was “surprised and concerned” (witness statement at [12]). c. The particulars of claim state that as a result of the defendant’s actions, he “suffered psychological distress, anxiety, loss and damage. The distress and anxiety have been exacerbated due to the sensitive personal and financial nature of the data that was unlawfully processed by the Defendant and accessed by a third party”.

Pleadings in media and communications claims

[18]As these proceedings were issued in the High Court, they were allocated to the Media and Communications List of the Queen’s Bench Division (“MAC List”), see CPR rule 53.[19]Claims proceeding in the MAC List must be conducted in accordance with PD53B, which prescribes the matters that parties are required to address in their pleadings.[20]PD53B only applies to cases in the MAC List. It does not apply to cases in the County Court, even if they include causes of action that would be allocated to the MAC List if in the High Court. That said, parties to County Court actions still need to plead their cases properly and so they would be well advised to follow PD53B, regardless of whether they are required to do so.[21]The defendant takes issue in this case with the adequacy of the claimant’s pleadings, which in many respects do not comply with CPR PD 53B.[22]I have considered whether to strike out all or part of the particulars of claim as a result of the failure to comply with PD53B. I have decided not to do so, for three reasons. Firstly, if any part of the case appears meritorious, the proper course would likely be to provide the claimant with an opportunity to apply to amend the pleading. Secondly, there is enough information about the substance of the claimant’s case for me to be able to deal with the applications before me, avoiding the cost of re-hearing the application after pleadings have been amended. Thirdly, it is agreed that if the claim survives then it will be transferred to the County Court, where PD53B technically does not apply.

Data Protection

[23]The claimant relies on Article 82, as supplemented by s.168 of the Data Protection Act 2018. Article 82 of the UK-GDPR provides data subjects with a right to civil compensation for data breaches by a controller. The relevant parts read as follows: “1. Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.[2]Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.[3]A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage…”[24]Section 168 of the DPA provides that “In Article 82 of the GDPR (right to compensation for material or non-material damage), "non-material damage" includes distress.”[25]Section 169 of the DPA provides for compensation for damage contravention of other data protection legislation, “damage” being defined as including financial loss and damage not involving financial loss, such as distress.[26]The claimant says he was a data subject, and the defendant was the data controller. He says that the defendant breached its data protection duties in disposing of the television without first wiping any data stored on it. In support of his case, the claimant refers to the following:a. The Information Commissioner’s Office guidance on “IT asset disposal for organisations” which explains to data controllers what they need to consider when disposing of electronic equipment that may contain personal data, including the deletion of such data before devices are recycled or disposal.b. The defendant’s own trade-in website which provides that:
“keeping your data and sensitive information secure is our top priority. When we receive a device for trade-in we (or an approved third party) wipe the data stored on it – this is done to Infosec Standard 5 (the same standard as the UK government data destruction)”
. I note that this was not a trade-in and that the defendant says that it does not operate a data erasure solution in respect of returned/faulty items which are then re-sold onto other consumers.[27]Whilst not of direct application, the claimant has also referred to a decision in a local court in Germany on 5 October 2020 which concluded that resale of a laptop which contained personal information constituted a violation of the data protection law and compensation of Euro 800 was payable pursuant to art 82 GDPR: Hildesheim (file number 43 C145/19).[28]The defendant firstly takes issue with the adequacy of the pleading of the data protection claim. CPR PD 53B paragraph 9 provides that in any claim for breach of any data protection legislation the claimant must specify in the particulars of claim(1) the legislation and the provision that the claimant alleges the defendant has breached;(2) any specific data or acts of processing to which the claim relates;(3) the specific acts or omissions said to amount to such a breach, and the claimant’s grounds for that allegation; and(4) the remedies which the claimant seeks.”[29]The defendant says that the claimant has not pleaded with sufficient particularity the acts of processing relied upon, merely stating that the defendant “failed to safeguard the data protection rights of the claimant” and that the information was not “processed fairly or lawfully” and processed “in a manner that was incompatible with the specified, explicit and legitimate purpose for which it was collected”.[30]The defendant accepts that the data stored on the television would constitute “personal data”, but it does not accept that it was necessarily private or confidential. The defendant says that it did not process the data and was not a data controller because it did not know about the data, had not been made aware of it, and reasonably believed it to be the responsibility of the claimant. Furthermore, it says that it only ever held the television as a physical asset and did not make use of the claimant’s accounts, and it was the third party who was responsible for the event giving rise to the damage, ie purchasing the film. The defendant also says that the claimant’s complaint appears to be about the defendant’s failure to log out of the apps (or wipe the device), which is an omission which cannot amount to data processing.[31]I am not satisfied that it is appropriate to grant the defendant summary judgment on the data protection claim for two reasons.[32]Firstly, further factual information is needed to evaluate the extent of the defendant’s duties to the claimant under data protection legislation, in particular in respect of what was said between the parties when the device was handed over, and when it was agreed it would be scrapped, and what terms and conditions applied to the repair and subsequent disposal.[33]Secondly, I consider that the data protection claim has a reasonable prospect of success. On the basis of the claimant’s account of events, it seems that the defendant would or should have been aware that there was personal data on the device, and it is certainly arguable that it had duties as a data controller, particularly if at any point it became the owner of the Smart TV. If the defendant was a data controller, then it would have been under data protection duties in respect of the disposal of data, which is a form of processing, Article 7(2) GDPR. These are matters to be considered at a final hearing, and not determined on a summary basis.[34]The defendant also seeks to strike out the data protection claim on the basis that it is trivial and below a threshold of seriousness, or alternatively that it is an abuse to allow the claim to proceed, following the principles identified in Jameel (below).[35]A threshold of seriousness applies to claims under section 13 Data Protection Act 1998. In Lloyd v Google[2020] QB 747 the Chancellor said “I understood it to be common ground that the threshold of seriousness applied to section 13 as much as to misuse of private information. That threshold would undoubtedly exclude, for example, a claim for damages for an accidental one-off data breach that was remedied quickly” at [55]. The Supreme Court in Lloyd (supra) proceeded on the basis that there is a threshold that applies to data protection claims: Lord Leggatt (with whom the other judges all agreed) referred on a number of occasions to the fact that the potential for damages applies to non-trivial claims: see [88], [115], [128], [137] and [138].[36]The parties agree that in the context of DPA 1998, claims under s.13, damages for ‘non-trivial’ breaches are not recoverable unless there is proof of damage or distress. This position would appear to apply equally to claims under Article 82 UK-GDPR.[37]An example of the application of the de minimis principle can be found in the decision of Master McCloud in Rolfe & others v Veale Wasbrough Vizards LLP[2021] EWHC 2809 (QB), which was a claim in respect of a single email about late payment of school fees that was sent to the wrong person, who confirmed they had deleted it without reading.[38]The question of Jameel abuse in data protection claims was considered by Nicklin J in Harlow Higinbotham (formerly BWK) v Teekhungam & another [2018] EWHC 1880 (QB):
“Jameel. 44. Again, there is not much dispute as to the legal principles to be applied: i) The Court has jurisdiction to stay or strike out a claim where no real or substantial wrong has been committed and litigating the claim will yield no tangible or legitimate benefit to the claimant proportionate to the likely costs and use of court procedures: in other words, " the game is not worth the candle ": Jameel [69]-[70] per Lord Phillips MR and Schellenberg –v- BBC [2000] EMLR 296 , 319 per Eady J. The jurisdiction is useful where a claim " is obviously pointless or wasteful ": Vidal-Hall –v- Google Inc [2016] QB 1003 [136] per Lord Dyson MR. ii) Nevertheless, striking out is a draconian power and it should only be used in exceptional cases: Stelios Haji-Ioannou –v- Dixon [2009] EWHC 178 (QB) [30] per Sharp J. iii) It is not appropriate to carry out a detailed assessment of the merits of the claim. Unless obvious that it has very little prospect of success, the claim should be taken at face value: Ansari –v- Knowles [2014] EWCA Civ 1448 [17] per Moore-Bick LJ and [27] per Vos LJ. iv) The Court should only conclude that continued litigation of the claim would be disproportionate to what could legitimately be achieved where it is impossible " to fashion any procedure by which that claim can be adjudicated in a proportionate way ": Ames –v- Spamhaus Project Ltd [2015] 1 WLR 3409 [33]-[36] per Warby J citing Sullivan –v- Bristol Film Studios Ltd [2012] EMLR 27 [29]-[32] per Lewison LJ. 45. By ground 3, the Claimant contends that the Master was wrong to extend the Jameel abuse jurisdiction to Data Protection Act claims. No authority has been cited for that proposition and I am satisfied that it is not correct: see Vidal-Hall [134]-[136] (itself a data protection claim) and Sullivan -v- Bristol Films , supra .”
[39]The fact that a claim is of low value does not mean that the court should necessarily refuse to hear it. This was considered in Sullivan v Bristol Film Studios Limited [2012] EMLR 27 in which it was said that: “when… a judge is confronted by an application to strike out a claim on the ground that the game is not worth the candle he or she should consider carefully whether there is a means by which the claim can be adjudicated without disproportionate expenditure” per Lewison LJ at [32]. A similar point was made in that case by Etherton LJ at [44] “consideration could have been given to transfer to… an appropriate county court for (re-)allocation on the small claims track”.[40]In this case, the claim is unquestionably of low value. It arises out of a single incident – namely the disposal of the Smart TV without wiping the claimant’s personal data - and matters were remedied promptly.[41]Whilst the defendant is sceptical that the Smart TV will have held all the information identified by the claimant - in particular bank details and other significant personal information in respect of each app - I acknowledge that this is the claimant’s pleaded case. A statement of truth has been signed on the claimant’s behalf. This can only have been signed by the claimant’s solicitor on the express instructions of the claimant, confirming the claimant’s belief that the factual matters set out in the pleading are true.[42]If what the pleading says is correct, then in my view this cannot be characterised as a trivial breach given the nature of the information disclosed, and the fact that it appears at least one of the apps has been used by a stranger since the Smart TV was re-sold.[43]I am, however, concerned that it would be disproportionate to allow such a low value claim to be litigated in the way that it is, with all the costs that arise out of High Court litigation. If this was a type of claim that would not be transferred to the County Court and the small claims track, for example for defamation, then it seems there would be good reasons for striking it out on Jameel grounds – the claim would simply not be worth the candle.[44]In my judgment, this claim can, however, be managed in a way that is proportionate to its value through allocation to the small claims track. This would allow for it to be dealt with under what was intended to be an informal process, with limited additional work needed to prepare for a two or three-hour final hearing. Given this, applying Sullivan(supra), it is not appropriate for the claim to be struck out on Jameel grounds.[45]I dismiss the defendant’s applications in respect of the data protection claims.

Privacy and Confidence

[46]I will consider next the claims for MOPI and BOC.[47]Warren v DSG Retail Limited[2021] EWHC 2168 (QB) was a case in which damages were sought against Currys for distress arising out of the loss of personal data on basis of breach of confidence, misuse of private information, breach of the Data Protection Act 1998 and common law negligence. The data loss occurred after Currys’ systems had been infected by malware following a cyber-attack, resulting in the disclosure to the hackers of the claimant’s name, address, phone number, date of birth and email address. The parties accepted in Warren that the data protection claim should be transferred to the County Court for determination. Saini J dismissed and/or struck out all the remaining causes of action. Whilst the facts of Warren are different to those in this case, much of Saini J’s analysis of the claims is of application in this case.[48]Where privacy and confidence claims are brought in the High Court, CPR PD53B paragraph 8 sets out the information that the claimant is required to specify in the particulars of claim.[49]For privacy claims, the claimant must specify:(1) the information as to which the claimant claims to have (or to have had) a reasonable expectation of privacy;(2) the facts and matters upon which the claimant relies in support of the contention that they had (or have) such a reasonable expectation;(3) the use (or threatened use) of the information by the defendant which the claimant claims was (or would be) a misuse; and(4) any facts and matters upon which the claimant relies in support of their contention that their rights not to have the specified information used by the defendant in the way alleged outweighed (or outweigh) any rights of the defendant to use the information in that manner.[50]For claims for misuse of confidential information or breach of confidence, the claimant must specify in the particulars of claim:(1) the information said to be confidential;(2) the facts and matters upon which the claimant relies in support of the contention that it was (or is) confidential information that the defendant held (or holds) under a duty or obligation of confidence;(3) the use (or threatened use) of the information by the defendant which the claimant claims was (or would be) a misuse of the information or breach of that obligation.[51]The claimant has not pleaded his privacy claim adequately, merely asserting that the information that I have already identified – including his name – was information in relation to which he had a reasonable expectation of privacy, without setting out the facts and matters upon which he relies to support such a contention. Nor does the claimant plead the use (or threatened use) of the information, simply stating that “the acts of the defendant in disclosing the private information to a third party” was a wrongful infringement of the claimant’s privacy rights.[52]The claimant has not pleaded his confidence claim adequately, failing to identify the actual information said to be confidential, why it is said it was confidential information held under an obligation of confidence, and the use of the information that is said to constitute misuse.[53]The defendant puts forward a number of different arguments in support of its application. I am not going to set them all out. The gist of the defendant’s position is that on the facts of this case the claimant could not have had a reasonable expectation of privacy in the data, and that any possible privacy rights that were engaged were outweighed by the rights of the defendant to access the television for repair. The defendant further relies on the fact that the claimant voluntarily furnished the Smart TV to the defendant, and it remained within his power to protect and keep private his personal information.[54]The defendant also highlights what is described as a fundamental defect with the claim, namely that complaint is made of a failure by the defendant to take protective measures, rather than in respect of some form of positive action by the defendant or use of the data.[55]This last point was considered in some detail in Warren, where Saini J considered that neither BoC nor MPI impose a data security duty on the holders of information (even if private or confidential). In support of this view, Sani J considered a number of authorities, and also quoted from two leading textbooks at [28] and [29], which are pertinent to the present case: a. Toulson & Phipps at §5-011:
"There is a distinction between an equitable duty of confidentiality and a duty to take care to prevent confidential information or documents from falling into the hands of someone else. The former is an obligation of conscience, which requires the recipient not to misuse the information or documents. The latter is a duty of a different character and is not an automatic concomitant of the former. In the absence of a relevant contract, it will arise only if there is a special relationship between the parties giving rise to a duty of care under the law of negligence." b. Gurry on Breach of Confidence, 2nd ed., §15.41: "
Strict liability for misuse of information by a defendant also serves to distinguish the duty of confidence from a duty of care. Negligence on the part of a defendant is relevant in determining whether a duty of confidence has been broken only if the negligence results in an unauthorised use or disclosure of the confidential information. Care on the part of the defendant is not the measure by which it is assessed whether a duty of confidence has been discharged."[56]In Warren, Saini J also noted that an important part of any claim for MOPI or BOC is the need for there to be a “use” made of the information in the form of a positive action on the part of the defendant.[57]The claimant says in his pleading that the wrong was the “disclosure” of private information to a third party, but counsel for the claimant confirmed during the hearing that the positive step complained of is the resale of the Smart TV without having erased the claimant’s personal information.[58]I accept the defendant’s argument that there is a fundamental defect with the claims for MOPI and BOC. In passing the Smart TV to a third party the defendant was not making use of the data or information that is the subject of this claim. In fact, there is no evidence that the defendant had any actual knowledge of the information in question or made use of it. It follows that there cannot have been any unauthorised use (or misuse) of the information by the defendant. It would be artificial to characterise the disposal of the Smart TV as a misuse of the information itself. At best, it could be said that in failing to wipe the device, the defendant was responsible for breaching a duty of data security, but this is insufficient on the facts of this case to make out claims for either BOC or MOPI.[59]Given this, I do not need to consider the other arguments put forward by the Defendant in respect of these claims.

Negligence

[60]The negligence claim is pleaded as an alternative cause of action to the claim for breach of data protection rights, the claimant noting that the defendant says that the DPA and UK-GDPR do not apply to this claim.[61]The defendant challenges the claim for negligence on two bases.[62]The first is that it is said that the Court of Appeal has held that there is neither need nor warrant to impose a duty of care where the statutory duties under the data protection legislation operate. In Warren, Saini J decided that on the facts of that case there was no room for the court to construct a concurrent duty in negligence where there existed a bespoke statutory regime for determining the liability of data controllers, such regime providing for relief of precisely the same nature as is claimed in negligence in the claim before him [35]. He found that accordingly there was no duty of care in the circumstances of that case.[63]The second is that there is not a complete cause of action because the claimant has not suffered a recoverable loss. Saini J at [40] in Warren noted that “A cause of action in tort for recovery of damages for negligence is not complete unless and until damage has been suffered by the claimant. Some damage, some harm, or some injury must have been caused by the negligence in order to complete the claimant’s cause of action. However, a state of anxiety produced by some negligent act or omission but falling short of a clinically recognisable psychiatric illness does not constitute damage sufficient to complete a tortious cause of action. Compare s.13 of the DPA which, as interpreted by the courts, allows compensation for “distress” by reason of contravention by a data controller of requirements under the Act”.[64]In the present case, the only pecuniary loss suffered by the claimant was the cost of the film purchased on his account, but this was refunded to him by the defendant. The claimant has not brought a claim for personal injury, and simply seeks to recover damages for distress and anxiety. He has not therefore suffered any recoverable loss, and as a result he has not pleaded a complete cause of action in common law negligence. Given this, the negligence claim falls to be dismissed and/or struck out.[65]In the circumstances, I do not need to consider the defendant’s first ground of objection to the negligence claim.

Claims not pursued

[66]The claims for aggravated and exemplary damages and for an injunction are no longer pursued, although they have not yet been formally withdrawn by way of pleading amendment.[67]It is difficult to understand on what basis the claimant could have sought to recover aggravated and exemplary damages, nor the purpose of an injunction in circumstances where it was known that the defendant did not have the Smart TV in its possession. These claims appear wholly misconceived and without merit, and I strike them out and/or grant the defendant summary judgment in respect of them.

Other matters

[68]The letter before action in this case informed the defendant that proceedings would be issued in the High Court and representations made that it be allocated to the Multi-Track due to the “complexity of the legal issues” and because the claimant will be seeking declaratory and injunctive relief.[69]The letter before action also placed the defendant on notice that the claimant is funded by a post-April 2019 conditional fee agreement. The solicitors informed the defendant that their client “will be fully protected by ATE insurance all the way to trial with a staged policy premium. As this matter is a privacy claim, such premium will be recovered from you at the successful conclusion of this said case. The longer that this case is defended/not resolved, the more the said premium will increase”.[70]In its reply, the defendant explained to the claimant’s solicitor that judges of this court have made clear recently that these sorts of modest value claim are not suitable for the High Court, or indeed the multi-track. It also drew the claimant’s attention to the obligation on ensuring cases are justly and proportionately managed in accordance with the overriding objective. It is regrettable that the claimant did not take on board this sound advice.[71]There does not appear to be any reason for this claim to have been issued in the High Court. Whilst defamation claims must be issued in the High Court (with limited exceptions), the same is not true in respect of the causes of action pursued in this case.[72]CPR PD7A para 2.9A provides: (1). […]a claim relating to media and communications work (which includes any work which would fall within the jurisdiction of the Media and Communications List if issued in the High Court) may be started in the County Court or High Court; and paragraph 2.1 [the £100,000 minimum threshold] shall not apply to such a claim. (2). Such a claim should be started in the High Court if, by reason of the factors set out in paragraph 2.4(1) to (3), the claimant believes that the claim ought to be dealt with by a High Court judge. (3). If a claimant starts such a claim in the High Court and the court decides that it should have been started in the County Court, the court will normally transfer it to the County Court on its own initiative. This is likely to result in delay.[73]CPR PD7A paragraph 2.4 provides that a claim should be started in the High Court if by reason of: (1). the financial value of the claim and the amount in dispute, and/or (2). the complexity of the facts, legal issues, remedies or procedures involved, and/or (3). the importance of the outcome of the claim to the public in general, the claimant believes that the claim ought to be dealt with by a High Court judge.[74]Parties to civil claims are under a duty to ensure that proceedings are conducted in accordance with the overriding objective.[75]This is a very low-value claim. Consumer disputes of equivalent complexity are heard every day in the County Court on the small claims track and do not need to be dealt with by a High Court judge.[76]Whilst there will often be good reasons for including more than one cause of action in a claim, especially where there are differences between them in respect of proof of damage, or heads of loss, parties must always conduct litigation proportionately and in accordance with the overriding objective. By including multiple causes of action in respect of this low value claim, the claimant has increased the complexity of the proceedings unnecessarily.[77]There has also been tactical skirmishing by both sides. The claimant has made more than one attempt to obtain default judgment despite an acknowledgement having been filed. The defendant issued a formal application seeking to take technical issues on service that were unmeritorious.[78]This has resulted in the parties having already incurred significant levels of costs. The claimant’s costs in respect of these applications are close to £11,000, in addition to which there will be his costs of the substantive action. The defendant’s costs for the applications are around £5,500. This needs to be considered in the context of a claim that might end up being worth just a few hundred pounds, depending on the evidence.

Next steps

[79]The defendant’s initial response to this claim was to seek a declaration pursuant to CPR rule 11 that the court has no jurisdiction to try the claim or should not exercise any jurisdiction which it may have. The defendant’s challenge on jurisdiction was withdrawn at the start of the present hearing. As a result, the acknowledgement of service filed by the defendant ceases to have effect: CPR rule 11(7)(a).[80]I will provide the defendant with a further period of 14 days in which to file a further acknowledgement if so advised, namely by 11 February 2022. If an acknowledgement is lodged, any defence shall be filed and served by 4pm on 25 February 2022. Directions questionnaires in form N180 shall be lodged by 4pm on 11 March 2022.[81]It is agreed that I should now transfer this matter to the County Court. The claimant’s local court centre is Hastings. As noted at the start of this judgment, it appears to me that the matter should be allocated to the small claims track, although that will be a decision for the district judge upon receipt of the defence and directions questionnaires.

Cited in 2 later judgments