Court orders
Orders to compel subject access
Where you have made a subject access request which has not been complied with, you can apply to a court which may order a data controller to comply with the request. Your rights to access personal data held about you are dealt with more fully in the Right to Know section.
Orders to prevent processing
You have a right to object to processing of personal data about you and under the DPA the data controller must take account of your objections. Further information on this can be obtained in the section on Rights of Data Subjects
Where an institution receives an objection to direct marketing it must comply with your objection. In any other case it must weigh the objections raised against the reasons for the processing and decide whether to accept the objection.
Where the data controller has refused to comply with a notice to stop processing, you may apply to the court. If the court is satisfied that the notice was justified and that the processing has caused you unwarranted damage or distress, it may order the controller to stop processing.
If a controller has refused to comply with a request to stop processing for the purposes of direct marketing, you only need to show that you have given notice of your objection and that the controller has refused to comply.
Objections to automated decision making
Where a data controller makes significant decision about you by using automated processing, you have the right to object. Further information on this can be obtained in the section on Rights of Data Subjects
If you can show a court that you have served a notice on a controller requiring them to ensure that no decision is taken solely on the basis of automated processing and that the controller has nevertheless made a decision on the basis of that information, the court can order the controller to reconsider the decision or to take a new decision not based on automated information.
Rectification and other remedies for inaccuracy
Where data are shown to be inaccurate a court may order rectification of the data or other remedies. These include the possibility of erasure or destruction of the data or of having that data "blocked". Blocked is not defined within the DPA but it may require a controller to ensure that certain information, while remaining on the record, is made inaccessible either in general or to particular people.
Where the controller has received data from a third party, the court can order the controller to take reasonable steps to verify the accuracy of the data. This may require an order for third party disclosure so that the court can evaluate the evidence.
The court may order the controller to record your views that the information is inaccurate. It can also order that others be informed of the amendments that have been made.
Further information on your right to have information corrected can be found on the section on Rights of Data Subjects
Compensation
Any breach of the DPA by which causes damage will give rise to a claim for compensation for the damage and any associated distress.
You do not need to be the “data subject” in order to bring a claim. You just need to have been caused damage by the breach of the DPA.
The term “damage” is not defined in the DPA but would cover pecuniary loss (e.g. loss of profits) and non-pecuniary loss such as pain or suffering or loss of amenity. It can include damage to reputation as long as it can be proved.
Generally, you cannot claim for distress alone unless the distress actually amounts to psychiatric injury.
However, where the processing concerns the purposes of journalism, art or literature, you may seek compensation for distress alone without having to show damage.
In any claim for compensation it is a defence for the controller to prove that he has taken “such care as was in the all the circumstances reasonably required to comply with the requirement concerned”.
All claims for compensation must be made to the court, unless the matter can be resolved between the parties. This is the case even where the Information Commissioner has made an assessment that it is likely that there has been a breach of the DPA, as the Commissioner has no power to award compensation.
Usually, it will be appropriate to start a claim in the country court unless you are also seeking injunctions which only the High Court can make.
There are no guidelines as to appropriate levels of compensation for a claim under the DPA, although generally awards are fairly low. In Campbell v MGN [2002] Naomi Campbell, who had been photographed by the Mirror whilst attending a clinic was awarded £2,500 for damage and hurt feelings plus £1,000 for aggravated damages for a subsequent offensive article. In November 2003 it was reported that the Chief Constable of Greater Manchester had paid compensation of £2,000 for psychiatric harm to a woman whose details had been accessed by a police officer neighbour. In A v London Borough of Newham it was reported that the Borough paid £5,000 to the parents of a child who was wrongly stigmatised as being HIV positive, the picture of the child having used on the front of a Council publication on HIV and Children. The Borough had continued to use the picture in that way even after the parents had complained.
The judge hearing the case has discretion in these matters and would have to take into consideration many factors including the seriousness of the breach and the effect upon you, particularly when considering damages for distress.
Further information on your right to compensation, and other rights that can be enforceable in the courts, can be found on the section on Individual Rights
Where you have made a subject access request which has not been complied with, you can apply to a court which may order a data controller to comply with the request. Your rights to access personal data held about you are dealt with more fully in the Right to Know section.
Orders to prevent processing
You have a right to object to processing of personal data about you and under the DPA the data controller must take account of your objections. Further information on this can be obtained in the section on Rights of Data Subjects
Where an institution receives an objection to direct marketing it must comply with your objection. In any other case it must weigh the objections raised against the reasons for the processing and decide whether to accept the objection.
Where the data controller has refused to comply with a notice to stop processing, you may apply to the court. If the court is satisfied that the notice was justified and that the processing has caused you unwarranted damage or distress, it may order the controller to stop processing.
If a controller has refused to comply with a request to stop processing for the purposes of direct marketing, you only need to show that you have given notice of your objection and that the controller has refused to comply.
Objections to automated decision making
Where a data controller makes significant decision about you by using automated processing, you have the right to object. Further information on this can be obtained in the section on Rights of Data Subjects
If you can show a court that you have served a notice on a controller requiring them to ensure that no decision is taken solely on the basis of automated processing and that the controller has nevertheless made a decision on the basis of that information, the court can order the controller to reconsider the decision or to take a new decision not based on automated information.
Rectification and other remedies for inaccuracy
Where data are shown to be inaccurate a court may order rectification of the data or other remedies. These include the possibility of erasure or destruction of the data or of having that data "blocked". Blocked is not defined within the DPA but it may require a controller to ensure that certain information, while remaining on the record, is made inaccessible either in general or to particular people.
Where the controller has received data from a third party, the court can order the controller to take reasonable steps to verify the accuracy of the data. This may require an order for third party disclosure so that the court can evaluate the evidence.
The court may order the controller to record your views that the information is inaccurate. It can also order that others be informed of the amendments that have been made.
Further information on your right to have information corrected can be found on the section on Rights of Data Subjects
Compensation
Any breach of the DPA by which causes damage will give rise to a claim for compensation for the damage and any associated distress.
You do not need to be the “data subject” in order to bring a claim. You just need to have been caused damage by the breach of the DPA.
The term “damage” is not defined in the DPA but would cover pecuniary loss (e.g. loss of profits) and non-pecuniary loss such as pain or suffering or loss of amenity. It can include damage to reputation as long as it can be proved.
Generally, you cannot claim for distress alone unless the distress actually amounts to psychiatric injury.
However, where the processing concerns the purposes of journalism, art or literature, you may seek compensation for distress alone without having to show damage.
In any claim for compensation it is a defence for the controller to prove that he has taken “such care as was in the all the circumstances reasonably required to comply with the requirement concerned”.
All claims for compensation must be made to the court, unless the matter can be resolved between the parties. This is the case even where the Information Commissioner has made an assessment that it is likely that there has been a breach of the DPA, as the Commissioner has no power to award compensation.
Usually, it will be appropriate to start a claim in the country court unless you are also seeking injunctions which only the High Court can make.
There are no guidelines as to appropriate levels of compensation for a claim under the DPA, although generally awards are fairly low. In Campbell v MGN [2002] Naomi Campbell, who had been photographed by the Mirror whilst attending a clinic was awarded £2,500 for damage and hurt feelings plus £1,000 for aggravated damages for a subsequent offensive article. In November 2003 it was reported that the Chief Constable of Greater Manchester had paid compensation of £2,000 for psychiatric harm to a woman whose details had been accessed by a police officer neighbour. In A v London Borough of Newham it was reported that the Borough paid £5,000 to the parents of a child who was wrongly stigmatised as being HIV positive, the picture of the child having used on the front of a Council publication on HIV and Children. The Borough had continued to use the picture in that way even after the parents had complained.
The judge hearing the case has discretion in these matters and would have to take into consideration many factors including the seriousness of the breach and the effect upon you, particularly when considering damages for distress.
Further information on your right to compensation, and other rights that can be enforceable in the courts, can be found on the section on Individual Rights
