AB – Court Ruling (United Kingdom, 2014)

The data subject made multiple subject access requests (SARs) to the Ministry of Justice following his wife's death, seeking personal data concerning communications between officials about the inquest. The first relevant SAR was made on 22 October 2006. The data subject made further requests on 19 December 2006, 21 April 2007, and 12 September 2007. The data controller failed to respond within the statutory 40-day period under section 7(8) DPA 1998. Material was eventually disclosed approximately 17 months after the relevant request, in March 2009. Some material was withheld for over 6 years on grounds of legal professional privilege, though the court later found one annotated document should have been disclosed as privilege had been waived when shown to a non-lawyer for independent opinion. The data subject sought damages for breach of statutory duty, distress caused by the delays, and time/costs incurred pursuing the requests. The High Court held that the controller breached section 7(8) DPA 1998 by failing to respond to the data subject's SAR within the prescribed 40-day period. On damages, the court held: First, the data subject was entitled to nominal damages of GBP 1 for the breach, as he failed to properly quantify his professional time and expenses. Second, critically, the court held that once "damage" (even nominal) was established under section 13(1), the data subject became entitled to compensation for distress under section 13(2). The court stated: "By accepting that the claimant suffered some damage... even if only to the extent of a nominal sum, it follows that the claimant has satisfied the requirements of section 13(2)(a), which means that an individual who has also suffered relevant distress is entitled to an award of compensation in respect of it." Third, the court awarded £2,250 for distress caused specifically by the delays in responding to the SARs, stating this represented "fair and proportionate compensation for the distress." On the withhel