This brings with it various costs implications for potential claimants. This judgment has limited the scope to bring breach of confidence and misuse of private information claims in respect of data protection. Therefore, the only remaining claim was under the DPA and for this reason the case was transferred to the County Court. It was held that neither breach of confidence or misuse of private information impose a data security duty on the holders of information (even if private/confidential information) because the causes of action require a positive wrongful act on the defendant’s part.Īs to the negligence claim, it was held that there was no common law duty of care ( Smeaton v Equifax Ltd ) and a state of anxiety falling short of a clinically recognisable illness does not constitute damage sufficient to complete a tortious cause of action. The application was granted by Mr Justice Sani. DSG argued that (i) the claims for breach of confidence and misuse of private information required positive information and (ii) there is no duty of care in negligence. He therefore pursued a claim for breach of the Data Protection Act 1998 (DPA), misuse of private information, breach of confidence and negligence.ĭSG applied for strike-out/summary judgment, save for an aspect of the DPA claim for breach of the data security duty. The claimant claimed that the data relating to him (name, address, phone number, date of birth and email address) was potentially compromised. This was a low-value dispute brought against DSG Retail Ltd (DSG) in respect of a cyber attack to its systems in 2018 caused by an unauthorised third party installing malware which affected potentially around 14 million data subjects.

Judgment has been handed down in the case of Warren v DSG Retail Ltd, striking out the claimant’s claim for breach of confidence, misuse of private information and negligence.

Breach of confidence