Emma Louise Johnson – Court Ruling (United Kingdom, 2021)

The defendant is a provider of social housing, the claimant is one of its tenants. A third party requested a rent statement from the defendant. In response to the request, the defendant sent a compilation of 6,941 pages unrelated rent statements by e-mail to the third party. The e-mail also included two pages of the claimant's rent statement with name, email address, and recent rent payments made to the defendant. The inadvertent disclosure was to a single person who immediately notified the defendant of the error and was asked by the defendant to delete the e-mail. Subsequently, the defendant informed the claimant of the error and the fact that the recipient had deleted the information. The matter was also reported to the Information Commissioner's Office, who confirmed that no action was required or would be taken as a result of the inadvertent data breach. At the time of the disclosure the claimant moved home to escape an abusive relationship and was concerned that the address would somehow become known to the claimant’s former partner. The claimant brought the case to the High Court and claimed “damages for Misuse of Private Information, Breach of Confidence and Negligence, together with damages for breach of Article 8 ECHR rights as incorportated in the HRA 1998 as well as damages pursuant to Article 82 GDPR and damages pursuant to section 169 of the Data Protection Act 2018. (…) Further, the Claimant claims injunctive relief to prevent the recurrence of this type of breach and declaratory relief stating that the Defendant has breached the principles enshrined in the abovementioned legislation." In support for issuing the case in High Court, the claimant argued that the matter concerned an evolving area of law which required elaborate and complex legal reasoning. The defendant denied that the claimant is entitled to any damages at all or any other relief because the claimant suffered no loss or damage above the de minimis threshold. The defendant applied to strike out the claim under the Jameel principle and/or for transferral to the County Court. The court saw no basis for this claim being issued in the High Court, partially struck out the claims collateral to the GDPR claim and transferred the remaining claims to the County Court. The Jameel principle and de minimis threshold continue to apply under the GDPR.