The de minimis principle in practice. When is a data breach too trivial to found a claim: Rolfe and others v Veale Wasbrough Vizards LLP



What amount of damage is necessary before a claim for a data breach or of misuse of private information is actionable?   In TLT and others v The Home Office [2016] 2217 (QB), Mitting J noted that the threshold was based on the “de minimis principle”, but how is that principle to be applied in practice?  In a short and helpful judgment, Master McCloud provided some guidance to the question in Rolfe and others v Veale Wasbrough Vizards LLP [2021] EWHC 2809 (QB).

The Defendant acted for a school in a fees dispute with the Claimants.  On 17 July 2019 the Defendant sent an email to the child’s parents that consisted of a letter requesting the payment of fees along with a statement of account.  However, the sender of the email mistyped the relevant email address with the consequence that the email was sent to a third party.  The recipient responded promptly saying that they thought that that the email had been sent in error.  The Defendant quickly responded by asking that the message be deleted.  The recipient confirmed that this had been done.

The Claimants thereafter sought damages for misuse of confidential information, breach of confidence, negligence and for damages under s82 of the GDPR and s.169 of the Data Protection Act 2013.

The Defendant sought summary judgment on the basis that any damage caused to the Claimants was too trivial to found a claim.

Master McCloud noted some common ground between the parties at [§5]:

It was common ground that in principle damages can be recovered and other remedies obtained for breaches of data protection regulations and misuse of private information, including simply for the distress caused even absent specific pecuniary loss. See Vidal-Hall v Google [2016] QB 1003. Similarly, it is not in dispute that in principle loss of control of personal data can constitute damage: Lloyd v Google [2020] QB 747”.

However, the Court went on to observe that there remained the need for there to be “damage”, quoting from Sir Geoffrey Vos in Lloyd:

I understood it to be common ground that the threshold of seriousness applied to section 13 as much as to MPI [misuse of private information]. That threshold would undoubtedly exclude, for example, a claim for damages for an accidental one-off data breach that was quickly remedied.

At [§8] Master McCloud relied upon Ambrosaidou v Coward [2011] EWCA Civ 409, where Lord Neuberger observed:

Just because information relates to a person’s family and private life, it will not automatically be protected by the courts: for instance, the information may be of slight significance, generally expressed, or anodyne in nature. While respect for family and private life is of fundamental importance, it seems to me that the courts should, in the absence of special facts, generally expect people to adopt a reasonably robust and realistic approach to living in the 21st century.”

In coming to a conclusion on whether the data breach could have caused “distress”, the Court concluded at [§11] that:  In this case the question boils down to the relatively simple one: given the nature of the breach and the nature of the information and the steps taken to mitigate the breach, and the material before me, is it more than fanciful to suppose either that actual loss has been suffered or that distress has been suffered above a de minimis level.”

In the next paragraph, the Master asked “What harm has been done …” before holding that “We have a plainly exaggerated claim for time spent by the Claimants dealing with the case and a frankly inherently implausible suggestion that the minimal breach caused significant distress and worry or even made them ‘feel ill’. In my judgment no person of ordinary fortitude would reasonably suffer the distress claimed arising in these circumstances in the 21st Century, in a case where a single breach was quickly remedied.

And at [§13] “There is no credible case that distress or damage over a de minimis threshold will be proved. In the modern world it is not appropriate for a party to claim, (especially in the High Court) for breaches of this sort which are, frankly, trivial. The case law referred to above provides ample authority that whatever cause of action is relied on the law will not supply a remedy in cases where effectively no harm has credibly been shown or be likely to be shown.

What though of the argument that loss of control itself can constitute damage?  Here the Court adopted the submissions advanced in the Defendant’s skeleton argument that “loss of control” must mean more than one third party briefly having access to relatively low-level information before deleting it.

This short judgment is a helpful and welcome application of good sense to the field of privacy law and should assist defendants when faced with low-level and isolated data breaches.

Latest News & Events

Lipton and Another v BA Cityflyer Limited [2024] UKSC 24: Denied Boarding, and Brexit Rules of Engagement

In a recent decision the Supreme Court gave guidance as to the interpretation of Regulation (EC) 261/2004 (almost universally – but not in the Supreme Court – known as ‘the Denied Boarding Regulation’), and in doing so, set out a handy guide for practitioners on…

The Dekagram: 15th July 2024

This week we examine the perils inherent in issuing proceedings at the last minute, especially when dealing with the e-filing system implemented in order to make all of our lives easier. As always, the team’s advice is: don’t do it, it’ll end in tears. And…

Catherine Atkinson and Jake Richards successful in General Election

Congratulations to both Catherine Atkinson and Jake Richards who were elected as Members of Parliament in last week’s General Election. Catherine was elected in Derby North and Jake was elected in Rother Valley. We wish them both well in their new positions.

Subscribe to our mailing list

Deka Chambers: 5 Norwich Street, London EC4A 1DR

© Deka Chambers 2024


Portfolio Builder

Select the expertise that you would like to download or add to the portfolio

Download    Add to portfolio   
Title Type CV Email

Remove All


Click here to share this shortlist.
(It will expire after 30 days.)