In a previous article, we considered the overlap between data protection claims and defamation claims and highlighted two high profile cases: Noel Anthony Clarke v Guardian News & Media Limited [2023] EWHC 2734 (KB) and Donald J. Trump v Orbis Business Intelligence Limited [2024] EWHC 173 (KB), that demonstrated this.

We now take a closer look at a recent judgment in a strike out application where amongst other things the judge has:

1. left the door ajar for claimants to bring data breach claims for damage to reputation; and
2. indicated that it would be desirable for the English Court of Appeal to resolve the uncertainty around whether claimants can recover damages for reputational harm in non-defamation cases.

Background

A newspaper published two articles in March 2017 and January 2018 which included references to the claimants being part of a conspiracy to defraud a billionaire.[1]

In pre-action correspondence, the claimants stated that the articles were defamatory but when proceedings were finally issued in March 2023 the defamation claim had been replaced by allegations that the two articles constituted breaches of UK data protection law as the defendant had failed to:

1. process the claimants’ personal data properly in compliance with Article 5(1)(a) UK GDPR; and
2. ensure the data was accurate or to remove/rectify any inaccuracies in accordance with Article 5(1)(d) UK GDPR.

The claimants alleged that, as a result of the data protection breaches, they suffered reputational harm and sought compensation under Article 82 UK GDPR and section 168 Data Protection Act 2018.

The defendant attempted to a strike out the claim at an early stage, arguing that the claim was an abuse of process by the claimants because it was a defamation claim disguised as a data protection claim and the defamation claim was time barred. Defamation claims need to be brought within one year of publication of the alleged defamatory content.

In support of its application the defendant sought to rely on the well-known Court of Appeal judgment in respect of abuse of process, Jameel.[2] In Jameel, the judge stated that it would be an abuse of process to commit substantial court time and resources to a claim, where so little was at stake given that:

1. the claim was disproportionate (because no substantial tort had been committed in England);
2. publication had been minimal; and
3. publication had done no significant damage to the claimant’s reputation.

In the present case, the defendant also asserted the claimants had little prospect of success since the reputational impact was minimal.

Judgment

The Judge considered four issues in deciding to refuse the strike out application.

1. Was the claim a defamation claim disguised as a breach of data protection laws claim?

The judge determined that there was no abuse of process by the claimants in making a data protection claim.

The judge reaffirmed the proposition that when more than one cause of action is available (in this case being a defamation claim and a data protection claim), the claimants had the right to choose which claim they wanted to pursue.

2. What was the purpose of the litigation?

The defendant claimed that the purpose of the litigation for the claimants was to protect their reputations, and they had brought the data protection claim to sidestep the one-year limitation period for bringing a defamation claim which had long since elapsed.

The claimants provided statements to the court stating that investors had refused to do business with them since 2021 due to concerns relating to the articles and, as a result, the primary reason for bringing the claim was to have the inaccurate processing of their personal data erased.

The judge found that if the claimants’ evidence was correct, the reason for the litigation occurred well after the one-year time limit for bringing a defamation claim lapsed, irrespective of previous correspondence where the claimants had threated to bring defamation proceedings. As such, it would be improper to deny the claimants the right to raise this evidence using a cause of action that was otherwise available to them at a full trial. 

3. Can a party seek damages for reputational harm in a breach of data protection laws claim?

The judge found that the law as to whether a party could recover damages for harm to reputation for a non-defamation claim was “uncertain and in flux” and as such was appropriate for consideration by the Court of Appeal.

It would therefore be inappropriate to summarily dismiss a breach of data protection laws claim seeking damages for reputational harm based on an abuse of process.

4. Was the claim an abuse of process of the Jameel kind?

The judge held that the claim was not an abuse of process. The judge asserted that it would be wrong to strike out the application on the grounds of Jameel because, amongst other things:

1. the publication was not de minimis given that it would not have required many views of the articles for the claimants to face difficulties with investors;
2. the claimants’ evidence (which the judge was satisfied with for the purposes of dealing with the application) indicated that their claim was based on issues faced since 2021 and the delay in bringing the claim was not significant; and
3. the claim was not destined to fail as the claimants sought a judgment on their allegations of the inaccuracies in the processing of their personal data by the defendant and as such this claim did hold real value for the claimants.

Comment

Data protection claims for reputational harm

The judge’s finding that, where there are multiple causes of action the claimant is well within their rights to decide which cause of action to pursue, has left the door ajar for those seeking to bring claims for breach of data protection laws as a way of circumventing the one-year time limit for a defamation claim for harm to reputation.

Businesses, especially those which publish personal data in a public forum, should be alive to the fact that there might now be an increase in claimants seeking to bring data protection claims for harm to reputation.

Recovery of damages for reputational harm in non-defamation cases

An interesting aspect of the judgment was the judge’s view that the Court of Appeal should resolve the uncertainty in law with respect to recovery of damages for reputational harm in non-defamation cases.

Initially, the Court of Appeal in Lonrho plc v Fayed (No 5) [1993] 1 WLR 1489 decided that any claim for harm to reputation had to be brought in defamation.

Since then, the High Court has taken three different approaches to this issue as set out below:

1. In Richard v BBC [2018] EWHC 1837 (Ch) the court decided that damages for reputation harm were recoverable in non-defamation cases.
2. In ZXC v Bloomberg LP [2019] EWHC 970 (QB) the court said that damages for reputation harm could only be recoverable in non-defamation cases providing the defendant could run the defences that would be available in a defamation case.
3. In Sicri v Associated Newspapers Ltd [2020] EWHC 3541 (QB) the court said that it would not award damages for reputational harm in non-defamation cases.

Given the contradictory nature of these approaches it is desirable for the Court of Appeal to resolve the uncertainty sooner rather than later.

As the strike out application failed, all the substantive issues remain live, and the case will proceed to full trial. Assuming no settlement is reached along the way, it will be interesting to see whether the court agrees that the published information in the articles constitutes a breach of UK GDPR and, if so, the basis, if any, on which the court will award damages for harm to reputation.

[1] Pacini & Anor v Dow Jones & Co Inc [2024] EWHC 1709 (KB)

[2] Jameel v Dow Jones & Company Inc [2005] EWCA Civ 75