Full Circle?27 Mar 2015 19:35
http://itsecurity.co.uk/2015/03/uk-court-of-appeal-issues-game-changing-judgment-in-google-safari-case/
The meaning of damage in section 13 of the DPA, in particular, whether there can be a claim for compensation without pecuniary loss
The discussion and decision on this point of the case is without doubt some of the most significant interpretation of law with regards to data protection and privacy that we have ever seen in the UK. Google argued that under the Data Protection Act there was no support for damages as a result of distress (except for some very special circumstances explicitly mentioned in the Act) and that because the plaintiffs had suffered no material damage and did not meet the requirements of the special circumstances for distress that there was no merit in the case and therefore it should be dismissed.
However, the Court of Appeal not only disagreed, but rewrote UK law on the grounds that the Data Protection Act was not compatible with the Data Protection Directive (95/46/EU):
We cannot, therefore, interpret section 13(2) compatibly with article 23.
They went on to explain that despite the fact that Parliament had made very explicit reasons for the types of damage that were covered – they had provided no reasoning for the exclusion of general distress or “moral damage” and as such the Court had no choice than to take the position that the DPA was not compatible and that a judgment must be made in line with Article 23 of Directive 95/46/EC with support from Article 47 of the EU Charter of Fundamental Rights.
The significance of this decision can not be overstated. As a privacy advocate, one of the biggest hurdles I have been faced with when filing complaints with the Information Commissioner’s Office (ICO) in the UK has been that of damage. In every single case I have filed with the relevant authorities in the UK the decision to take no action has always hinged on the argument that there was no damage. In cases I have filed with ICO (Google’s WiFi scandal, Phorm and many others) they have always used this argument of damage – the same with the Crown Prosecution Service (CPS) over a criminal complaint I filed against Phorm for criminal breaches of Regulation of Investigatory Powers Act (RIPA) – again the CPS argued it would not be in the public interest to pursue a prosecution because there was no “damage”.
With this decision from the Court of Appeal, we now have a precedent that states simply that a misuse of private information is in and of itself a damage – and this is what I have been arguing for nearly a decade. The mere act of abuse of a fundamental right is a damage because whether or not there is any material loss fundamental rights are an essential foundation of our society and any attack on those rights, damages society at a core level.