Claims companies and law firms looking for the next bonanza in payouts are targeting people who have been the victim of a data breach, with some telling those affected they could be entitled to thousands of pounds in compensation.
A Google search for the term “data breach claim” results in a long list of firms – the vast majority of them no-win, no-fee solicitors – and there are more moving into this space all the time. Meanwhile, adverts for firms are increasingly appearing in Instagram feeds.
The proliferation of companies operating in this area has prompted speculation that this could be the industry’s next “golden goose” after the payment protection insurance scandal, and could lead to a new deluge of spam text messages and unwanted cold calls.
What is fuelling this growing market is the fact that the UK’s data watchdog, the Information Commissioner’s Office (ICO), can’t award compensation to people if they have been affected by a data breach, even when the law has been broken.
As an individual, your options include pursuing the company yourself – either by appealing to it for compensation or taking it to the small claims court – or turning to one of these firms, which could launch a group action if there are enough people with a claim against the same company.
One advantage of using one of these firms is that, assuming they take you on, they will typically do a lot of the legwork for you. Also, because most are no-win, no-fee, you often won’t have to pay anything upfront or if the claim fails.
The big downside is that, generally speaking, you can expect to hand over a quarter of your compensation to the firm as its fee if your claim is successful. An industry insider told Guardian Money that “25% is the standard”.
Over the last few years there have been a string of high-profile data breaches
The ICO defines a personal data breach as an incident that leads to “the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data”. It could be something that affects only one person or many.
Over the last few years there have been a string of high-profile data breaches, many involving big companies such as British Airways, the hotels company Marriott, Ticketmaster and TalkTalk. Some have been linked to cyber-attacks, and others related to information being lost or shared with the wrong people.
There have also been a number of incidents involving government departments or similar. Only days ago an NHS trust apologised after sharing the email addresses of people taking part in a Covid vaccine trial. Last month it emerged that Labour had been hit by a “cyber incident” affecting members’ data.
Meanwhile, some people find out they have been the victim of a data breach after submitting a subject access request to a company they are in dispute with.
Guardian Money has been told that some utility companies and other firms are still being lax when it comes to customers’ information, and are emailing Excel spreadsheets full of personal data to perhaps dozens of people.
View image in fullscreenBreaches of financial data can involve credit card and banking information. Photograph: Andrew Matthews/PA
The most basic type of personal data is your name and email address. The next level might be your home address and phone number. Most people would probably consider that breaches involving financial data such as credit card and banking information (card numbers, expiry dates and so on), and passwords, fall into the most serious category. There is also what the law describes as “sensitive” information – things such as religious beliefs, health, sexuality, ethnic background and trade union membership.
However, the impact of a breach will vary from person to person. For some individuals – a survivor of abuse or domestic violence, a member of the UK Special Forces or an asylum seeker, for example – even only the unauthorised disclosure of their name or email address could have serious repercussions but for others the impact will be minimal.
The UK’s Data Protection Act 2018 gives you the right to claim compensation from a company or organisation if you have suffered “damage” as a result of it breaking data protection law, the ICO says. This includes both “material damage” (for example, you have lost money) or “non-material damage” (for example, you have suffered distress).
If you have been the victim of financial crime after an incident, such as suffering fraudulent transactions, that may tick one or both boxes. However, you could also argue you have suffered damage if, say, you have had to change your banking details or have seen your credit score take a tumble.
“This is a very contentious area right now – it’s definitely an area of claims growth, without a doubt,” says Richard Jones, a director of DSAR.Ai, a software company specialising in subject access requests.
There are various claims as to how much people could be in line to receive. One firm says compensation could be in the region of £1,000 for less serious breaches and “up to £10,000 for very serious breaches”.
Graham Coffey & Co Solicitors, based in Manchester, is one of the firms advertising a service. Its managing partner Stuart Snape is keen to dispel the idea that a breach of the rules automatically entitles someone to compensation: “There has to be a real anxiety and a real material effect of that breach.”
It might be that the effect is minor – for example, if your name and email address is disclosed, perhaps the only consequence is that you receive more spam in your inbox. “But there are varying degrees of that,” Snape says. He adds that if more sensitive data such as credit card or bank details is involved, “that is when the compensation starts to go beyond the £1,000 mark. [That is potentially] more than just a minor nuisance. Your name and email address, while understandably concerning, is more of a minor nuisance.”
View image in fullscreenThe most basic type of personal data is your name and email address. Photograph: Tero Vesalainen/Alamy
It is not clear how many people in the UK have received compensation relating to a data breach – there are no published figures, some individuals will have secured ex gratia payments, and settlements will often be confidential.
In July it emerged that British Airways had settled a legal claim by some of those affected by its 2018 data breach. Of the 430,000 customers and staff affected, about 244,000 had their names, addresses and payment card details, including the security number on the back, exposed. The settlement related to a group action reportedly involving more than 16,000 people. However, the payout was kept under wraps
There have been a few court cases where details of payouts have been made public. In 2016 the high court awarded damages ranging from £2,500 to £12,500 to six asylum seekers for privacy and data protection law breaches after their personal data was accidentally published on the Home Office website. In the case of the two who were each awarded £12,500, “the effects have been serious”, leaving them fearing for their safety, the judge said.
There are thought to be several group actions brewing against Ticketmaster, which was fined £1.25m by the ICO in November 2020 after a breach that included names, payment card numbers, expiry dates and security codes. It potentially affected 1.5 million people in the UK, and investigators found that 60,000 payment cards belonging to Barclays customers had been subjected to known fraud. Another 6,000 cards were replaced by Monzo after it suspected their fraudulent use.
Probably your best chance of receiving compensation is if you are a customer of a company that is publicly punished by the ICO and so can’t argue that it did not do anything wrong. Handily for consumers and claims firms, companies can’t hide their failings: under the law, all organisations are required to report personal data breaches to the relevant authority within a certain period.
If you are thinking about using a claims firm go for one that is regulated by the Solicitors Regulation Authority (look out for the SRA clickable logo being displayed on a firm’s website). Also, check online reviews for the firm and whether it is acting for other people affected by the same incident.
