An individual is entitled to seek compensation from an organisation if they have suffered damage as a result of a contravention by the organisation of “any of the requirements of the Act” – this includes the failure to comply with a subject access request.
Section 11 of the Act provides this right.
The Information Commissioner cannot award compensation nor assist with an application to the High Court and recommends that any person considering legal action should seek the services of a Manx Advocate.
There is no definition of “damage” in the Act, and therefore this should not be viewed as being limited to financial damage alone, although an individual who has suffered financial loss of some sort because of a breach of the Act is likely to be entitled to compensation. Individuals may also seek compensation for distress if damage has also occurred.
Individuals may seek compensation for distress alone if
- the court considers that the failure to comply with a subject access request was “unjustified and the data controller knew, or ought to have known that it was unjustified” – the court may also impose a fine on the organisation in such cases;
- the contravention relates to the processing of personal data for the “special purposes” of journalism, literature and art.
There is no requirement for an individual to go to court to seek compensation - an approach can be made directly to the organisation by the individual or by an Advocate acting on their behalf. If a settlement cannot be reached an application may then be made to the Court. In a court action, it is a defence for the organisation “to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned”.
The Information Commissioner cannot award compensation nor assist you with an application to the High Court. The Office recommends that any person considering legal action should seek the services of a Manx Advocate.
In 2015 the UK Court of Appeal ruled, in the case of Vidal-Hall v Google, that compensation under the Data Protection Act could be awarded for distress alone; however this aspect of the judgment has been appealed by Google and will now be heard by the UK Supreme Court. The guidance will be reviewed once the Supreme Court has issued its judgment.