Have you suffered emotional distress or financial harm as a result of your manager or employer sharing your personal information? If so, you could be eligible to claim data breach compensation, if the incident meets the relevant criteria for a valid claim.
Here, we’ll explore the requirements for claiming compensation from your employer following a data protection breach, potentially involving some of your personal or sensitive data. We’ll outline the steps you may need to take, including gathering evidence and ensuring you take action within the time limit for data breach claims. Additionally, we explore how your employer might have breached your personal information by failing to comply with data protection principles.
Finally, we discuss how a No Win No Fee solicitor could help you claim compensation and hold your employer accountable for a failure in their data processing and handling activities.
For more information, you can:
- Call on 0333 241 2521
- Speak with an advisor via the contact form
Data Protection Law in the Workplace
Your employer sharing personal data amongst employees is still considered a breach of the Data Protection Act, regardless of how free the workplace culture can be. Your employment contracts and employee handbooks likely give cautionary statements that disclosing such employee data, even with an employee’s permission, is a breach of data protection obligations in both the Data Protection and Equality Act.
As for the private lives of employees, whilst it’s not illegal to talk about, it’s important to respect other employees. Disrespect can lead to a phone call to the HR department and disciplinary action likely will follow. HR functions to protect other co-workers from ill-treatment and lack of equality.
A lot of this information is laid out in the employee records. Nonetheless, personal data and company information, such as proprietary data, insider information and trade secrets are all topics that must be kept confidential to stay on the right side of employers and the law.
My Manager has Breached My Confidentiality UK – What Are My Rights?
Under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, certain parties have a responsibility to protect your personal data.Personal data is any information that identifies you or that could lead to you being identified i.e. your name or email address. Some sensitive personal data warrants extra protection due to its nature and is classed as . Examples might include trade union membership status.
Data controllers and processors must comply with data protection legislation. Data controllers decide why and how your personal data is used, while data processors are responsible for processing your data on the controller’s behalf. In some circumstances, certain employers must appoint a data protection officer, especially if they are involved in large-scale data processing or process sensitive or special category data.
Your employer, as a data controller, must adhere to these key data protection policies. As such, they must have a lawful basis for processing your personal data. If they share an employee’s personal data without a lawful basis for doing so, this could be considered a breach of data protection.
If your personal data held by your employer has been compromised following a breach of the UK GDPR at work, and this causes you emotional harm, financial loss, or both, you may have valid grounds as the data subject to start a data breach claim against your employer.
The same applies if your employer shares or transfers your personal data using a third party, such as a payroll provider. There is a responsibility for ensuring the third party is compliant with GDPR when it comes to processing employee data.
Examples Of Employer Data Breaches
If you are unsure how an employer data breach could occur, we’ve listed some examples below:
- Your employer may send a letter containing your personal information to thewrong postal address, despite having your correct home address on file.
- An email data breach can happen if your employer sends correspondence to the wrong email address or fails to use blind carbon copy (BCC) when sending either internally to employees or externally.
- Hackers could access your personal data in a cyber attack if your workplace’s internal online security systems lack the appropriate encryption software.
- An individual’s data is left in a communal work area or on a work printer.
Can I Make A Claim For An Employer Data Breach?
In order to have an eligible claim for workplace data breach compensation, you’ll need to gather evidence that can highlight the following:
- Your employer when processing personal data has failed to comply with the UK General Data Protection Regulation and the Data Protection Act 2018.
- Your personal data stored has been compromised in a breach as a result.
- You have subsequently suffered psychological harm and/or financial loss.
Useful evidence you could obtain to support your data breach claim include:
- A letter of notification from your employer that confirms your personal data was compromised in a breach. Your employer must inform you without undue delay when your rights and freedoms are at risk.
- Any correspondence with your employer regarding the personal data breach. For example, you may have raised a complaint via email or by sending a letter.
- Any correspondence with the Information Commissioner’s Office (ICO). You can report a suspected breach to the ICO, the independent body that upholds UK data subjects’ rights and freedoms.
- Medical evidence that can prove you have suffered some harm e.g. your medical records or a report from an independent medical expert outlining any mental distress caused, or even post traumatic stress disorder.
- Evidence of any financial losses, such as that contained in bank statements.
Is There A Time Limit For A Workplace Data Breach Claim?
Generally, you’ll have six years to start a data breach claim against an employer. However, if the claim is against a public body, this is reduced to one year.
You can get in touch to find out more about the time limits and how long you have to seek compensation for a data breach in an employment context.
Make A Claim With A No Win No Fee Data Breach Solicitor
A No Win No Fee data breach solicitor could assist during the claims process by offering a Conditional Fee Agreement (CFA). Under this type of No Win No Fee arrangement, they’ll offer the typical benefits of a solicitor, such as gathering evidence on your behalf.
Additionally, data breach solicitors offering their services under the terms of a CFA usually won’t charge any fees for their work upfront or whilst the claim is ongoing. If your data breach claim is unsuccessful, you won’t pay your solicitor for their services. A legally capped success fee will be taken from your settlement if your claim does succeed.
To learn more about when you could make a claim following an employer-employee data breach, please contact an advisor. To do so, you can:
- Call on 0333 241 2521
- Speak with an advisor via the contact form
How Much Employer Data Breach Compensation Can I Claim in the UK?
It is difficult to pinpoint the exact amount that can be made through a breach of an individual’s personal data by an employer, or due to fellow employee misuse, and the following information can easily shift based on judicial decision-making. However, take these as average estimates for a personal data breach claim due to employee negligence when it comes to data protection laws:
Minor Breach – Minor breaches can be described as non-sensitive data being leaked, or a breach that is identified early and concluded quickly. They tend to bring compensation of around £1,000 to £3,000.
Moderate Breach – Moderate breaches often involve highly sensitive data, such as bank account information. What makes them moderate is if the level of financial losses, if any, are relatively small. Emotional distress is also taken into account, of course. You can expect to see a range of £3,000 – £10,000 for a compensation claim.
Serious Breach – These are personal data breaches that involve highly sensitive confidential data often alongside significant financial losses, with emotional distress being a significant factor. You can expect compensation of around £10,000 to £25,000.
Severe Breach – These are considered a serious security incident where there has been an absolutely catastrophic failure to protect an individual’s confidential data, leading to the employee to suffer financial losses and a high level of emotional anguish. You could potentially receive compensation awards of £25,000 and above for this type of data protection breach.
Start Your Data Breach Claim today
Data breaches by an employer do not have to be intentional, and it is possible that your claim could result from an accidental data breach. There are many instances of data falling into the wrong hands through something as simple as incorrect email recipients being used or due to malicious action by an employer or fellow employee.
If your employer, or former employer, has breached your personal data whether intentionally or not, there is a good chance that you have a compensation claim. We can introduce you to specialist data breach solicitors who can handle your claim on a no win. no fee basis.
