UK - When is a data protection claim not a data protection claim?

In this case¹, the thrust of the application was that the claim was, in substance, a defamation claim, and that it had been dressed up as a data protection to circumvent the challenges that a defamation claim would face (including a long-expired limitation period). If the claim proceeds to a full trial in its present form, the Court will need to consider if it is possible to recover damages for reputational harm caused by the processing of inaccurate data – an important but unsettled issue.

Background 

In 2017 and 2018, the defendant (Dow Jones) published two articles in the Wall Street Journal relating to the activities of XIO Group (a global investment firm) and naming the two claimants (senior XIO Group executives). The articles remained available to Wall Street Journal subscribers. In 2020, the two claimants left XIO Group and set up their own investment firm.  

On 16 March 2023, the claimants commenced proceedings, alleging – amongst other matters – that: 

• the two articles contained personal data relating to inaccurate allegations of criminal offences;  
• in breach of Article 5(1)(a) UK GDPR, the defendant had failed to process that personal data fairly; and 
• in breach of Article 5(1)(d) UK GDPR, the defendant had failed to erase or rectify the inaccuracies.  

The remedies sought by the claimants included compensation under Article 82 GDPR and/or s168 DPA 2018 and erasure of the personal data. In support of their claim for compensation, the claimants alleged that the articles had been an obstacle to investment in their new firm. 

In the period between the articles being published and the claimants commencing proceedings, there had been intermittent legal correspondence featuring complaints that the articles were defamatory and requests for the articles to be removed.  

The application 

The defendant argued that the claim was “purely tactical” and should be struck out as an abuse of process, and that in reality it was a time-barred defamation complaint disguised as a claim for data protection. This raised the related question of whether a claim for damage to reputation can be made in data protection proceedings. The defendant also invited the Judge to strike out the claim on Jameel grounds (i.e., the litigation involved disproportionate costs to achieve an outcome with minimal value). ²

What happened? 

The judge dismissed the defendant’s strike out application: 

1. Having noted that a claimant may rely on any viable cause of action that arises from a given set of facts, the judge first considered if the “nub” of the claim was, as the defendant suggested, the damage caused to the claimants’ reputations. The judge concluded that, on a summary application, it was not possible to go behind the claimants’ evidence that the litigation became necessary after 2020, when they experienced difficulty drumming up investment for their new firm. As a result, he was obliged accept at this stage that this was the purpose of the litigation. 
2. The judge then went on to consider if damages for harm to reputation can be recovered for breaches of data protection law. Observing that the law in this area is “uncertain and in flux, the judge described this as “a difficult and unsettled issue which is unsuitable for determination on a summary application” and that it “probably requires the attention of an appellate court”. 
3. Finally, the judge refused to strike out the claim on Jameel grounds, taking the claimants’ evidence about the objective of the litigation at face value.

What next? 

As this was a strike out application, it should be stressed that the key issues considered in this judgment (i.e., the “nub” of the claimants’ claim and the recoverability of damages for reputational harm) will be considered afresh and in greater depth, if the case goes forward to a full trial. On that front, the next stage in the proceedings will be a preliminary issues hearing at which the meaning of the articles will be determined. 

At this stage, two aspects of the case are particularly notable. Firstly, the claimants’ approach prompts a closer examination of the boundary between defamation and data protection. While the former is the natural preserve of claims for reputational harm, there may be cases where data protection also offers an effective remedy. Second and relatedly, it is an open question whether data protection claimants can be compensated for such harm. If this case decides that question, it will be an important development in data protection law. 

Footnotes

<sup>1. Pacini & Anor v Dow Jones & Company Inc. [2024] EWHC 1709 (KB)
2. Jameel v Dow Jones [2005] QB 946</sup>