I was interested to read an item published by the Newcastle Sunday Sun on 23 December 2007, which announced the startling news that "The Government is facing a multi-million pound compensation payout to families over the lost child benefit discs blunder".
Not having spotted this in the national press, I read on to learn that "a legal expert is advising victims of the astonishing foul-up… to claim compensation". A Mr Chris Shaw, "manager of Newcastle-based legal services company ADRS", was reported to have estimated "that individual payouts could range from £50 to £300 with “significantly higher” amounts for people who have suffered damage and distress". Mr Shaw is reported to have added: “This could prove very costly for the Government if families affected by the postal error take up their right to pursue a compensation claim"..
The article includes a link which takes readers to a website where they can buy a "claims pack" for £5.99, containing pdf document templates for claiming compensation.
At the risk of putting a damper on the public's windfall celebration, I don't see any compensation on the horizon, and doubt very much that Government bean counters are losing any sleep. For the full picture, we need to go to s13 of the Data Protection Act 1998, which governs data subjects' entitlement to compensation. Section 13 reads:
"13 Compensation for failure to comply with certain requirements
(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if—
(a) the individual also suffers damage by reason of the contravention, or
(b) the contravention relates to the processing of personal data for the special purposes.
(3) In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned."
There's the rub: to be entitled to compensation, you have to have actually sustained some "damage". Yes, you can claim for "distress", but only if there has been damage too. People need to understand that damage / damage and distress are not just aggravating features for compensation purposes – they are pre-requisites. Now, the one thing we all know about the HMRC fiasco is that (fortunately) there has been no sign so far that the discs have fallen into criminal hands; certainly there is no evidence that anyone whose data was lost has yet suffered any detriment. Before parting with their hard-earned £5.99, readers need to consider their "right to pursue a compensation claim" in that light. Another thing - as the article states, everyone affected by the HMRC disaster is getting a letter from the Government, so they already know who you are without you writing to them to claim: you may want to keep your money in your pocket for now. If HMG ever decides compo is called for, maybe they'll get in touch with you, and you can save the £6-odd quid (including stamp).
The webpage where you can buy the claims pack does tell you that damage is required for any entitlement to compensation, but it also stresses that a Bank recently "volunteered" compensation to some of its customers for a data breach, and a man recovered £300 for unsolicited marketing emails sent to him in breach of the 1998 Act. Whether the Government is in fact likely to volunteer any payment in the HMRC case – especially given that no data subject is yet known to have been even canvassed - let alone spammed or phished – is obviously another matter.
Six to get you fifty. Fancy a punt ?