Understanding Section 168 of the Data Protection Act 2018: The Cost of Inaccurate Data

When most people think of data protection breaches, they envision large-scale cyber-attacks or leaked financial records. However, data protection laws also govern the everyday accuracy of the personal information we process and share.

Under Section 168 of the Data Protection Act (DPA) 2018, read alongside Article 82 of the General Data Protection Regulation (GDPR), individuals have the right to claim compensation if they suffer material or non-material damage due to an infringement of their data rights.

A recent High Court claim we were involved in highlights exactly how these data protection principles can overlap with civil disputes, serving as a cautionary tale for individuals and organisations alike.

Case Study: Defamation and Data Inaccuracy

To understand the practical application of Section 168, we can look at a recent claim issued in the High Court’s Media & Communications List.

The Background The dispute arose after a defendant allegedly made and published defamatory statements in two separate distributions. These distributions were circulated to approximately 280 occupiers of flats within a specific residential development. As a result of these distributions, the claimants pursued legal action seeking damages.

The Section 168 Application While the primary grievance was defamation, we also utilised data protection legislation as an alternative legal avenue. The claim sought compensation specifically under Section 168 of the DPA 2018 and Article 82 of the GDPR.

The legal argument was straightforward:

• The defendant had processed the claimants’ personal data when distributing the statements to the residents.
• The defendant allegedly infringed Article 5 of the GDPR by failing to ensure that the personal data being processed was actually accurate.
• The claimants suffered damage directly resulting from this failure to maintain data accuracy.

The Potential Consequences of a Breach

This case perfectly illustrates the multifaceted consequences a party can face if they breach data protection regulations by distributing inaccurate personal information. Based on the remedies sought in this claim, the potential fallout includes:

• Financial Compensation: The claimants sought financial damages for the distress and harm caused.
• Mandatory Rectification: Beyond just money, the courts can order the offending party to actively correct the record. In this case, the claimants sought formal rectification of the inaccurate personal data.
• Public Retraction: To undo the reputational damage caused by the inaccurate data being shared with hundreds of residents, the claimants demanded a published retraction.

The claim was eventually compromised with the Defendant, albeit not until after expensive court proceedings had to be uiss

Key Takeaways

This case study is a stark reminder that data protection compliance is not just a regulatory checkbox; it is a strict legal obligation. Article 5 of the GDPR mandates that personal data must be accurate and kept up to date. Failing to verify the accuracy of personal information before publishing or distributing it—even in a localized setting like a residential block—can trigger significant legal liabilities under Section 168 of the DPA 2018.

If you are involved in a dispute regarding the misuse or inaccurate processing of your personal data, or if you are facing a claim and need guidance on your data protection obligations, our team of experts can help you navigate the complexities of the DPA 2018 and the GDPR.

Contact our commercial disputes team or email us at hello@huttonslaw.co.uk