Halliday v Creation Consumer Finance Ltd (CCF)

Factual and Procedural Background

On 11 August 2008, District Judge Stuart, sitting in the Cambridge County Court, granted the Appellant judgment in default of defence against Company A for breaches of various provisions of the Data Protection Act 1998. The Appellant claimed damages for harm to reputation and for distress. The assessment of damages before District Judge Pelly resulted in an award of nominal damages only. The Appellant appealed to a higher county court judge, who dismissed the appeal. The Appellant then obtained permission to appeal to this court on whether an award for substantial damages was required before damages for distress could be granted under the Act.

The underlying facts involve the Appellant entering into a credit agreement with Company A to purchase a television. Earlier breaches of the Data Protection Act led to a consent order discharging the credit agreement and requiring Company A to pay sums to the Appellant and delete his data. Subsequent incorrect data entries by Company A were forwarded to a credit referencing agency, falsely showing the Appellant owed money under the terminated agreement. This breach led to the default judgment and subsequent damages assessment.

The main issue became whether damages for distress could be awarded without proof of substantial pecuniary damage, and if so, the quantum of such damages. The court was also asked whether it should address the distress damages itself or remit the matter to the county court.

Legal Issues Presented

1. Whether an individual must prove substantial pecuniary damage under section 13(1) of the Data Protection Act 1998 before being entitled to damages for distress under section 13(2).
2. Whether the court should award damages for distress in this case and, if so, what the appropriate amount should be.
3. Whether the court has a duty to impose sanctions under Article 24 of Directive 95/46/EC in addition to damages.
4. Whether the nominal damages awarded constitute an effective remedy under EU law.

Arguments of the Parties

Appellant's Arguments

• The Appellant claimed damages for harm to reputation and distress caused by breaches of the Data Protection Act.
• He argued that nominal damages awarded were insufficient and that damages for distress should be awarded even without proof of substantial pecuniary loss.
• The Appellant contended that the remedy of nominal damages was not effective under EU law and relied on the authority of Von Colson & Kamann regarding effective remedies.
• He further submitted that the court should impose a penalty under Article 24 of Directive 95/46/EC, as nominal damages alone would not satisfy the Directive’s sanction requirements.
• By analogy with discrimination cases (citing Vento and Da'Bell), the Appellant sought an award for distress within the middle band of £6,000 to £18,000.

Respondent's Arguments

• The Respondent conceded that nominal damages constitute "damage" under the Directive and the Data Protection Act.
• It argued that the breach was of a limited nature and did not cause substantial harm to reputation or credit.
• The Respondent submitted that the period during which the wrongful data was available was limited to approximately four months.
• It was noted that the Appellant did not promptly complain to Company A or the credit agency upon discovering the incorrect data, suggesting the distress was not severe.
• The Respondent maintained that the case was a single episode of wrongful processing arising from a mechanical error, without fraudulent or malicious intent.
• The Respondent denied that sanctions under Article 24 of the Directive were directly enforceable by individuals in private law proceedings.

Table of Precedents Cited

Precedent	Rule or Principle Cited For	Application by the Court
Von Colson & Kamann v Land Nordrhein-Westfalen [1994] ECRR 1892	Effective remedy requirement under EU law.	The court considered whether nominal damages alone constituted an effective remedy under the Directive and found that, in this case, national law did provide an effective remedy.
Van Duyn v Home Office [1974] ECR 1337	Criteria for direct effect of EU directives ("unconditional and precise").	The court held that Article 24 of Directive 95/46/EC was not directly enforceable by individuals in private law proceedings.
Vento v Chief Constable of West Yorkshire Police [2013] 1 ICR 31	Guidance on bands of compensation for injury to feelings in discrimination claims.	The court considered but ultimately held that the discrimination compensation bands were not directly applicable for assessing damages for distress under the Data Protection Act.
Da'Bell v NSPCC [2010] IRLR 19	Updated inflationary adjustments to compensation bands for injury to feelings.	Referenced in relation to Vento bands for comparison, but not applied directly.
Franchet and Daniel Byk v Commission of the European Communities (Case T-48/05)	Recognition of feelings of injustice and frustration as relevant to remedies.	The court accepted the principle that violations of important European instruments like data protection should be marked by some form of remedy reflecting frustration caused.

Court's Reasoning and Analysis

The court began by recognizing that the Data Protection Act 1998, implementing Directive 95/46/EC, entitles individuals to compensation for damage or distress caused by contraventions of data protection requirements. The critical statutory provision was section 13(2), which allows compensation for distress if the individual suffers damage or if the contravention relates to special purposes.

The court noted that the Respondent conceded nominal damages constitute "damage" under the Directive, removing the need to decide whether substantial pecuniary damage is a prerequisite to damages for distress.

The court rejected the Appellant’s argument that the court should impose sanctions under Article 24 of the Directive, holding that this provision concerns legislative measures by Member States and is not directly enforceable by individuals in civil proceedings. The court also emphasized that sanctions are generally imposed through other judicial or administrative mechanisms, not civil damages.

In assessing damages for distress, the court considered the evidence submitted by the Appellant, which was limited to a witness statement expressing distress at the Respondent’s disregard for a prior court order and the court’s inability to protect its process. The court acknowledged the importance of data protection rights but found the breach to be a single episode of a mechanical error without evidence of fraudulent intent or significant harm to reputation or credit.

The court weighed the limited duration of the breach, absence of contemporaneous evidence of distress, and the modest nature of the harm. It found the analogy to discrimination compensation bands to be of limited assistance given the differing nature and impact of data protection breaches.

Ultimately, the court concluded that compensation should be modest and awarded damages for distress in the sum of £750, alongside nominal damages of £1 for the breach itself. The court also declined to refer the matter to the Court of Justice of the European Union, considering the application of domestic law to the facts to be clear and appropriate.

Holding and Implications

The court ALLOWED THE APPEAL and awarded the Appellant nominal damages of £1 under section 13(1) of the Data Protection Act 1998 and damages for distress in the sum of £750 under section 13(2).

The decision confirms that damages for distress under the Data Protection Act can be awarded without proof of substantial pecuniary loss, provided nominal damages are established. However, the quantum of such damages is to be modest and fact-sensitive, reflecting the nature and extent of the breach and its impact on the claimant. The court clarified that sanctions under Article 24 of Directive 95/46/EC are not directly enforceable in civil proceedings as penalties but are matters for legislative and administrative measures.

No new precedent was established beyond the application of existing principles to the facts of this case. The ruling brings finality to the Appellant’s claims and provides guidance on the approach to damages for distress in data protection breaches.