In the UK there is legislation designed to protect the personal data of individuals and when this is not adhered to, this is classed as a data breach. In this guide, we take a look at data law and explain what a data breach is as well as examining some of the terminology used within the legislation.
We’ll also take a look at the eligibility requirements that need to be met in order to start a claim for a data breach and the ways in which a solicitor or legal representative could help you when seeking compensation.
To find out more, you can:
- Phone us on 0333 241 2521
- Contact us online.
What Is UK GDPR?
The UK General Data Protection Regulation (UK GDPR) is a piece of data protection legislation in the UK. It sits alongside the Data Protection Act 2018 (DPA 2018) to outline the responsibilities of data controllers (those who decide why and how they will process your personal data) and data processors (those who act on behalf of the controller). Data controllers and data processors must adhere to these pieces of data protection laws.
The UK GDPR defines personal data, which is data that can be used to identify a person as the data subject. This includes, for example, your name, date of birth, email address or contact details. In addition, the UK GDPR outlines what a data breach is and sets the criteria for claiming compensation.
What Is Considered A Breach Of GDPR?
A personal data breach is a breach of security leading to an impact on the availability, confidentiality, or integrity of your personal data. A breach of the UK GDPR could lead to accidental or unlawful destruction, unauthorised disclosure, or your personal data being compromised.
This confidentiality breach could occur due to accidental disclosure through human error, or unlawfully, such as when those who are unauthorised gain access to personal data transmitted and engage in identity theft. The seriousness of the breach will vary depending on the nature of the data and the potential impact it could have e.g. a leak of patient records could cause a great deal of alarm or distress.
What Is The Penalty For A UK GDPR Violation?
Under this legislation, organisations need to inform the supervisory authority Information Commissioner’s Office (ICO) of a reportable data breach, considered one that puts the rights and freedoms of data subjects at risk.
The ICO is an independent body that upholds data protection rights within the UK. As part of their role, they can investigate data breaches as well as issue fines to organisations for failing to adhere to the legislation and compromising personal data records.
How Long Does A Company Have To Report A Data Breach?
Organisations are expected to have appropriate technical and organisational measures to avoid possible data breaches, but when this isn’t the case, a security incident or data breach may result. Organisations are responsible for reporting data breaches to the ICO without undue further delay and within 72 hours of being aware. They must also provide the details of the organisation’s data protection officer.
Additionally, an organisation that experiences a breach is also responsible for sending a personal data breach notification, in clear and plain language outlining the nature of the personal data breach, to data subjects (i.e those whose data has been breached) without undue delay, especially if it presents a high risk. Personal data records concerned with confidential medical details could be one such example.
Can You Claim Compensation For A Personal Data Breach Under UK GDPR?
The UK GDPR grants data subjects whose personal data was breached the right to compensation. However, in order to claim, you must meet the criteria laid out in Article 82.
This is as follows:
- The data controller or data processor did not uphold their responsibilities in adhering to the UK GDPR and DPA 2018.
- Due to their wrongful conduct, a breach in which your personal data was compromised occurred.
- Additionally, you must have evidence that shows you experienced harm. This could be damage to your mental health or undue stress, which could be proven with copies of your medical records. Alternatively, you may have suffered financial losses, which could be evidenced with copies of your credit reports or bank statements.
How Long Do I Have To Make A Claim For A Breach of Personal Data Records?
Generally, you have 6 years to begin a data breach claim. However, this is reduced to 1 year to bring a claim for breach using Human Rights legislation against a public body.
Can I Claim For Personal Data Breaches On A No Win No Fee Basis?
If you are eligible to claim compensation for a personal data breach, you could seek the support of a solicitor. One of our experienced data breach solicitors could help.
Usually our solicitors use a No Win No Fee agreement known as a Conditional Fee Agreement (CFA) to provide their legal services. This means that generally, your solicitor won’t ask for ongoing or upfront payments towards their work on personal data breaches.
Your solicitor will instead deduct a ‘success fee’ from your awarded compensation if your claim has a positive outcome for you. The success fee is taken as a percentage that is limited by the law. If your claim isn’t successful, you won’t be asked to pay this fee, so there is no risk involved in making a data breach claim.
For further information, you can:
- Phone us on 0333 241 2521
- Fill out our ‘check compensation‘ form.
