Pump Court Chambers

Misuse of private information: A tort in its infancy

Blog 23rd July 2020

There has been an avalanche of commentary on the recent decision of the Supreme Court in WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12[1]. The case has provided some welcome guidance on vicarious liability in the wake of the earlier decision of Mohamud v WM Morrison Supermarkets plc [2016] UKSC 11[2], and also represents the first class action of its kind in the UK.

Importantly, in WM Morrison Supermarkets plc v Various Claimants, the Supreme Court has indicated that there is nothing in the Data Protection Act (or elsewhere in the common law) to prevent an action for breach of the statutory duty imposed in the Data Protection Act 1998 (and by implication the DPA 2018[3]),  being brought against an employer by means of vicarious liability. Lord Reed laid out: 

  1. It follows that, applying the orthodox principles of statutory interpretation explained by Lord Nicholls in Majrowski, since the DPA neither expressly nor impliedly indicates otherwise, the principle of vicarious liability applies to the breach of the obligations which it imposes, and to the breach of obligations arising at common law or in equity, committed by an employee who is a data controller in the course of his employment, as explained in Dubai Aluminium.

The lack of vicarious liability on the part of Morrisons in the WM Morrison Supermarkets plc v Various Claimants case was a highly fact sensitive matter. Indeed, the importance of a careful analysis of the underlying facts is a common thread in all the recent test cases relating to vicarious liability. One can quite easily imagine circumstances, such as a simple negligent disclosure by an employee, where vicarious liability would have been established.

The tort of misuse of private Information and the small family of related causes of action can sound in quite significant damages, and the corpus of case law about how to assess those damages is quite small. Though the determination of the Supreme Court in the 2020 Morrisons case is no doubt a useful clarification of Mohamud and a restatement of key principles, it has also deprived us of a High Court judgment on the quantum of damages for the 9,263 claimants.

It is worth examining at this point what factors the courts will take into account when determining the quantum for such claims, and what a Claimant might be able to expect.

Causes of Action

Misuse of private information was first recognised as a distinct tort only as recently as 2014, In Vidal-Hall v Google Inc [2014] EWHC 13 (QB)[4], by Tugendhat J. It is distinct from breach of confidence. Breach of confidence is, importantly, an equitable cause of action, whereas Misuse of Private Information is a civil tort.

There is a great deal of overlap between these two causes of action. The essential difference is that misuse of private information concerns information which is personal, and private by its very nature (such as bank statements or hospital records). On the other hand, breach of confidence can relate to information which is sensitive or secret but which would not have to be of a personal nature (like the formula for Coke, or a company’s audit documents). A company could bring an action for the latter, but not the former.

The legal hurdles which must be surmounted for breach of confidence are also historically distinct from those which must be surmounted in misuse of private information.

The tripartite test for claims of breach of confidence was laid out in Coco v AN Clark (Engineers) Ltd [1968] F.S.R. 415[5]:

  • Does the information have the necessary quality of confidence?
  • Was the information imparted in circumstances importing an obligation of confidence?
  • Has there been an unauthorised use of the information causing detriment?

The courts will invariably have to consider art.8 and art.10 of EWCHR when considering this test. As Lord Woolf CJ held in A v B plc [2002] EWCA Civ 337, [2003] QB 195, 202[6], para 4:

“[Articles 8 and 10] have provided new parameters within which the court will decide, in an action for breach of confidence, whether a person is entitled to have his privacy protected by the court or whether the restriction of freedom of expression which such protection involves cannot be justified. The court’s approach to the issues which the applications raise has been modified because, under section 6 of the 1998 Act, the court, as a public authority, is required not to ‘act in a way which is incompatible with a Convention right’. The court is able to achieve this by absorbing the rights which articles 8 and 10 protect into the long-established action for breach of confidence. This involves giving a new strength and breadth to the action so that it accommodates the requirements of these articles.”

The test for misuse of private Information was laid out in Vidal-Hall v Google Inc [2015] EWCA Civ 311.

The ‘misuse’ element of the tort is very far reaching. Though WM Morrison Supermarkets plc v Various Claimantsoffers the very clear example of publication of material online, it could extend theoretically to simply discussing the information with another party, the accessing of such information, or the threatened use of such information. It does not appear we yet have an authority where this word is discussed in detail.

The court considers two steps:

  • Is the information in question information over which the Claimant had a reasonable expectation of privacy?
  • If so, does the Claimant’s art.8 ECHR right to privacy outweigh the Defendant’s art.10 ECHR right to freedom of expression?

In effect, it can be seen that both causes of action will involve the balancing act between the art.8 right to privacy and the art.10 right to freedom of expression. This will now often be the central consideration of the court in cases involving the press.

Another cause of action which will often run alongside claims for breach of confidence or misuse of private Information is breach of statutory duty (that contained in the Data Protection Act 2018), though courts will likely approach the question of damages in the same way.


There exists currently very little case law on the assessment of damages for misuse of private information. Though courts may be able to look to earlier cases where an equitable remedy was sought for breach of confidence, this area of law has moved so fast that those cases may be of limited assistance. In Spelman v Express Newspapers[2012] EWHC 355 (QB)[7] Tugendhat J commented:

“If a remedy in damages is to be an effective remedy, then the amount that the court may award must not be subject to too severe a limitation. Recent settlements in the much publicised phone hacking cases have been reported to be in sums far exceeding what in the past might have been thought to be available to be awarded by the courts. The sums awarded in the early cases such as Campbell[8] were very low. But it can no longer be assumed that damages at those levels are the limit of the court’s powers.”

Commenting in the more recent case of Reid v Price [2020] EWHC 594 (QB)[9], Warby J has expressed the view at paragraph 49 that:

“The claimant has established a claim based on four different causes of action. But like Jay J, I do not consider that the contract claim adds anything of relevance. Nor do I see any material difference between the approach to be taken to the claims in confidentiality, misuse of private information, and breach of statutory duty. The essential task is to compensate the claimant for the wrongful retention and wrongful disclosure of images of his sexual conduct, and the wrongful disclosure of information about that conduct. In logic, and in the presentation of the case, it is the claim for wrongful disclosure that predominates.”

The purpose of damages in these cases is to compensate the Claimant for damage, injury to feelings and any distress arising from the breach of their art.8 rights. It follows that the extent of the breach must be of some relevance, and there must also be some evidence from the Claimant about the extent to which they have suffered injury and hurt feelings, as well as any damage. It is suggested above by Warby J that exercise of quantifying equitable damages for breach of confidence is also essentially the same exercise. It may also be appropriate to take into account any aggravating conduct by the Defendant which increases the hurt to the claimant’s feelings. The court, in all this however, must maintain a sense of proportion whilst providing a measure of ‘solatium’ to the claimant.

The awards vary considerably. Most of the reported cases in claims for breach of confidence or misuse of private information have been claims made by celebrities. The most recent well reported case relating to damages for such a claim was Reid v Price [2020] EWHC 594 (QB). In this case the model Katie Price disclosed videos of her ex-husband, Mr Reid (a well known cage-fighter), cross dressing and engaging in sexual activity to various people. Mr Reid had various upsetting and distressing experiences where he learnt that, despite undertakings having been given by Ms Price, she had shown them to numerous individuals, discussing the behaviour as she did so.

Ms Price, at the time of the trial, was a bankrupt. Her defence was stuck out for failure to comply with directions. Her solicitors came off record from an early stage, and it appears that she did not engage with proceedings much after that.

The Claim was limited by the claim form to £25,000 and that was the sum Warby J awarded. Had the claim not been limited a perhaps more detailed judgement on quantum might have been given. The judgment however, from one of the most experienced judges in this area, does offer some pointers. At paragraph 58, the judge indicates that it is important to maintain a sense of perspective. This might be accomplished by looking to the Judicial College Guidelines. He also indicates that considering awards for defamation / libel may also be instructive:

The submission that the claimant’s life has been “destroyed” is, in my judgment, a rhetorical exaggeration. Comparison with the tariffs for general damages in personal injury cases (Judicial College Guidelines, 15thedition) reveals that an award in excess of £60,000[10] (as contended for) would equate to the damages recoverable by someone who loses all sight in one eye, with damage to the sight in the other; or by a man made impotent in middle age. An award on that scale would seem on the extravagant side, on these facts, and out of kilter with recent awards for libel, such as Barron v Vines[11] (broadcast allegations of covering up knowledge of child sex abuse, £40,000) and Monroe v Hopkins [2017] EWHC (QB) [2017] 1 WLR 68[12](publication to over 500,000 followers on Twitter of allegation that the claimant approved of vandalising war memorials with obscene political graffiti, £24,000).

Warby J was referred to a number of authorities in this case and made a very quick summary of the principles which it would be necessary to consider at paragraph 51:

  • If damages are to be an effective remedy, they must not be subject to too severe a limitation;
  • Although vindicatory damages are not recoverable in this context, in misuse of private information and data protection claims, damages may be awarded for loss of autonomy or loss of control; 
  • The nature of the information disclosed and the degree of loss of control should bear on this aspect of the court’s assessment of damages – the more intimate the information and the more extensive the disclosure, the greater the award.

However, the quantification of damages in this area remains clearly an esoteric and highly subjective exercise. Where this overflows into the realm of psychiatric damage there will of course need to be expert evidence to prove causation.

Some further guidance was given by Mann J in Gulati V MGN Ltd [2015] EWCA Civ 1291[13] at paragraphs 229 – 230:

  • The disclosure of certain types of private information was more significant than others;
  • Information about mental and physical health and significant private financial matters attracted a higher degree of privacy, and therefore compensation; 
  • Information about social meetings attracted a lower degree of privacy and compensation;
  • Information about matters internal to a relationship would be treated as private, and disclosures which disrupted a relationship or were likely to adversely affect a couple’s attempts to repair it were likely to be treated as a serious infringement deserving substantial compensation;
  • The appropriate compensation would depend on the nature of the information, its significance as private information, and the effect on the victim of its disclosure;
  • The effect of repeated intrusions by publication could be cumulative;
  • in relation to distress, the “egg-shell skull” principle applied, so that a thinner-skinned individual might be caused more upset, and therefore receive more compensation, than a thicker-skinned individual who was the subject of the same intrusion
  • For each year of serious levels of phone hacking the starting point was an award of £10,000.

In many of the reported cases there is also a flavour of damage to reputation, based on the  celebrity status of many of the claimants. In Hannon v News Group Newspapers Ltd [2014] EWHC 1580 (Ch); [2015] E.M.L.R. 1[14], Mann J suggested that there was no principle to disallow a claim incorporating damage to reputation in a privacy action.

The orthodox cause of action for reputational damage would normally be defamation or malicious falsehood. However, unlike in a claim for defamation, it is no defence to a claim for misuse of private information that the information in question is true. Indeed, in a culture of morality clauses one can easily anticipate situations where the disclosure of private information, though true, would harm the reputation of certain celebrities and perhaps cause realisable damage.

Below is a summary of the some of the recent awards for misuse of private information and breach of confidence (unadjusted for inflation).

Case name and citation Conduct complained of Award
Mosley v News Group Newspapers Ltd [2008] EWHC 1777 (QB); [2008] E.M.L.R. 20 Disclosure by a newspaper that that the Claimant had taken part in a sadomasochistic sexual activities and published covert video recordings on its website. £60,000 (Eady J)
Cooper v Turrell [2011] EWHC 3269 (QB) Defendant had published covert recordings on the internet relating to the claimant’s health. £30,000 (Tugendhat J)
AAA v Associated Newspapers Ltd [2012] EWHC 2103 (QB); [2013] E.M.L.R. 2 The Claimant was a young child and received damages as a result of her non-pixelated face being published three times by a newspaper without her mother’s consent (the claimant was the illegitimate daughter of a prominent politician). £15,000 (Nicola Davies J)
WXY v Gewanter [2013] EWHC 589 (QB) The Claimant was awarded damages after the Defendants published allegations regarding her sexual conduct and details of her private discussions (allegedly concerning sensitive matters involving a head of state) online. £24,950 (Tugendhat J)
Weller v Associated Newspapers Ltd [2014] EWHC 1163 (QB); [2014] E.M.L.R. 24 Three children, one aged 16 and 10 month old twins, were awarded damages for the publication of their non-pixelated faces in a newspaper. The claimants were the children of musician Paul Weller and had been photographed by the paparazzi shopping with their parents in Los Angeles. £10,000 (Dingemans J)
Gulati & Ors v MGN Ltd [2015] EWCA Civ 1291 [2016] C.L.Y. 2141 A number of Claimants in the public eye claimed for infringements of privacy rights arising primarily from phone hacking by newspapers. Many of the Claimants’ voicemail messages had been hacked regularly over long periods of time, significant parts of their private lives had been exposed and then reported. £72,500 to £260,250 (Mann J)
TLT and others v Secretary of State for the Home Department [2016] EWHC 2217 (QB) The Claimants were asylum seekers whose personal data was mistakenly made available on the internet in the context of the Home Office’s publication of data on family returns. £2,500 – £12,500 (Mitting J)

Many of these awards will be entirely out of the contemplation of most individuals. Most individuals are, thankfully, very unlikely to have their phones hacked by the press or be photographed with their children by the paparazzi.

The modern phenomenon of revenge porn, however, cannot be discounted. Though Mr Reid and Ms Price were both in the the public eye, there appears to be no reason in principle why a person could not claim comparably significant damages for injury to feelings and self esteem if, for example, an intimate video or photo was uploaded onto a website for anyone to access.

It must not be forgotten that a Claimant must take reasonable steps to mitigate loss. Such steps might include the instruction of solicitors to ensure a video or photo is removed from a website after proof is obtained, or the Claimant taking such measures themselves.

What of the 9,263 claimants in WM Morrison Supermarkets plc v Various Claimants case? Though there would probably be no practical benefit to their bringing a claim against the incarcerated Mr Skelton, theoretically their claim against him would be solid. And it is this sort of claim which might be in the contemplations of most people. Employers and service providers hold vast quantities of data sensitive to us, which nonetheless is in the hands of employees who are just as susceptible to negligence as the next person.

In this sort of claim, TLT and others v Secretary of State for the Home Department [2016] EWHC 2217 (QB)[15]might provide the most assistance. The Claimants were not celebrities but asylum seekers, whose sensitive information was placed on the internet by mistake in a spreadsheet. The breach lasted for 13 days. The Home Office acted entirely properly thereafter. They informed the individuals whose data had been compromised, made a statement to Parliament and notified the Information Commissioner’s office.

The Court held that looking at the awards for claims involving the deliberate dissemination of private and confidential information for gain by media publishers or individuals engaged in that trade was not helpful in this case. The court rather considered that the cases had more in common with cases where Claimants have been caused to suffer psychiatric injury by an actionable wrong, whether a careless act or deliberate wrong. Mitting J gave the example of sexual abuse as a child, which seems somewhat a somewhat extreme choice given the relatively low awards in this case (paragraph 16).

The court also held that there is a threshold below which no damages could be awarded, and that threshold was the de minimis principle. It was not engaged on the facts of this case (paragraph 15).

It is however conceivable that if a tribunal were to substantially reject a Claimant’s evidence about distress and damage, that the de minimis principle could be engaged. In the 2020 Morrisons case, the data was taken down within a day of its being posted on the internet. It is not inconceivable that some of the 9,263 Claimants in fact suffered no appreciable distress or anxiety at all. One imagines, however, that cross examining all of them to that effect probably would not be a cost effective litigation tactic.

The question arises, in terms of quantum; is there any lower threshold (as you find in the Judicial College Guidelines, 15th Edition, Minor Injuries Chapter 13) for an award? Might a court contemplate an award as low as only a few hundred pounds? There is certainly nothing inhibiting such an award.

In the TLT and others v Secretary of State for the Home Department [2016] EWHC 2217 (QB) case, damages were assessed at £12,500 each, where two Claimants moved home as a result of the disclosure, and felt genuine and rational concern for the safety of a young relative in Iran. Mitting J remarked at paragraph 28:

To describe the totality of their experiences as “distress” is a misstatement and an understatement, and I use the word only because it is the label under which damages are assessed in cases of this type.

It is difficult to compare this experience with that of Mr Reid, and his award of £25,000. Both experiences are undoubtedly abhorrent.

It seems, however, courts are prepared to award higher awards in instances where there has been active dissemination, or other aggravating activity, on the part of the Defendant. Courts also appear to look carefully at the nature of the disclosed material and how sensitive it is. There is clearly a spectrum with perhaps a sort code at one end and intimate videos of sexual activity at the other.

As to one of the other Claimants in the TLT case, the court found that the ‘shock’ of the discovery, a few months of genuine concern, and the consequent loss of confidence in the Home Office merited an award of £3000, “an award which is not out of kilter with awards for less severe psychiatric and psychological injury”.

This approaches what might have been expected for many of the claimants in the Morrisons 2020 case. We do not know what evidence may have come forth at a trial on quantum, but what is evident is that Morrisons acted expeditiously in limiting the damage. As mentioned, the disclosure only lasted a single day (paragraph 8), though it must be recognised that once information is in the public domain it can be copied and stored by a third party.

The nature of the private information disclosed is detailed in the judgement of Lord Reed at paragraph 4:

… the name, address, gender, date of birth, phone numbers, national insurance number, bank sorting code, bank account number and salary of each member of staff.

This information is sensitive, but not in any way comparable to the sort of information in many of the reported High Court decisions. The ‘type’ of information disclosed does not fall into the categories attracting larger awards. It lacks the intimate character required. The period of the disclosure was also short, and the clean up by Morrisons swift and efficient.

Though the egg-shell skull principle applies, it is submitted that this principle clearly has its limits. Tribunals will take the issue of quantum in the round, looking at the severity of the tort and weighing it against the account given, the Judicial College Guidelines, and the nature of the information disclosed. Many claims for distress will include a degree of rhetorical exaggeration on the part of Claimants, and tribunals will be alive to this.

It appears, based on TLT, that most of the individual claimants in the Morrisons 2020 case would have been awarded damages below £3000. In some cases perhaps less than half of that. But this is, of course, entirely academic!

It is perhaps worth mentioning Andrea Brown v The Commissioner of Police of the Metropolis and The Chief Constable of Greater Manchester Police [unreported 2016][16]. HHJ Luba QC sitting in the County Court made an award of £9000, where the Metropolitan Police had misused their data gathering powers by utilising them for employment disciplinary matters rather than the prevention of crime, and where GMP had wrongfully disclosed information about Ms Brown and her child. This decision was handed down shortly after TLT, and it is quite difficult to reconcile the level of this award being three times that of some of the Claimants in the earlier case. The judgement is on remedy only, and it helpfully discusses some of the arguments on exemplary and aggravated damages which might be utilised by both Claimants and Defendants in such claims.

Absent tricky questions of vicarious liability, breach of duty can be established relatively straightforwardly in wrongful data disclosure cases like in Morrisons v Various Claimants. Claimants ought to be able to use a Defendant’s potential costs liability to negotiate a favourable settlement. In such a fresh area, where the assessment of damages remains highly subjective, Claimant solicitors should not shirk from making ambitious Part 36 offers at an early stage in proceedings.

This article Misuse of private information: A tort in its infancy was written by Henry Hawkesworth. For further information on his practice or how to instruct Henry please contact our clerking team via the switchboard on 020 7353 0711 or email: clerks@pumpcourtchambers.com.




[4] https://www.bailii.org/ew/cases/EWCA/Civ/2015/311.html

[6] https://www.bailii.org/ew/cases/EWCA/Civ/2002/337.html

[7] https://www.bailii.org/ew/cases/EWHC/QB/2012/239.html

[8] Campbell v MGM Ltd [2004] UKHL 22; https://publications.parliament.uk/pa/ld200304/ldjudgmt/jd040506/campbe-1.htm

[9] https://www.bailii.org/ew/cases/EWHC/QB/2020/594.html

[10] The sum awarded in Mosley v News Group Newspapers Ltd [2008] EWHC 1777 (QB); [2008] E.M.L.R. 20 https://www.bailii.org/ew/cases/EWHC/QB/2008/1777.html

[11] https://www.bailii.org/ew/cases/EWHC/QB/2016/1226.html

[12] https://www.bailii.org/ew/cases/EWHC/QB/2017/433.html

[13] https://www.bailii.org/ew/cases/EWHC/Ch/2015/1482.html

The awards in this case are some of the largest in all the reported case law. They were the subject of an appeal by the Defendant, which was dismissed: https://www.judiciary.uk/wp-content/uploads/2015/12/representative-claimants-v-mgn.pdf. The appeal judgement generally asserts that the assessment of damages in these cases falls within a broad Judicial discretion.

[14] https://www.bailii.org/ew/cases/EWHC/Ch/2014/1580.html

[15] https://www.bailii.org/ew/cases/EWHC/QB/2016/2217.html

This judgment was the subject of an appeal on liability (https://www.bailii.org/ew/cases/EWCA/Civ/2018/2217.html), which did not challenge the quantification of damages, but rather the fact sensitive issue of whether the information disclosed gave some of the Claimants a viable cause of action at all. The Court of Appeal did not disturb the findings of the trial judge that it did.

[16] The judgement is, however, available online: https://inforrm.files.wordpress.com/2016/10/judgment-brown-v-commissioner.pdf

Shortlist close
Title Type CV Email

Remove All


Click here to email this list.