What Are Your Rights If Your Employer Breaches Your Data Privacy?

In this guide, we’re going to examine the concept of employee data breach claims against Tesco. You might be wondering whether you could make a personal data breach claim for compensation. After all, if your employer breached your data, you could have suffered financial or emotional damage from such a privacy violation.

And, under the Data Protection Act 2018 and GDPR, those who’ve suffered psychological or financial harm from a data breach could have the right to seek compensation. We have created this guide to offer you insight into who could make such claims and what you would need to do to get started.

A data breach could be caused by lots of different incidents. You may assume that many of these relate to cybersecurity issues, such as malicious cyberattacks by hackers, intent on using exposed data for nefarious purposes.

You may already be aware that phishing attacks could lead to a hacker gaining access to computer systems and stealing your data using spyware, ransomware or malware. However, data breach claims could be made for breaches due to human error or mismanagement of your data—providing you can prove you suffered mentally or financially (or both).

How Could We Help With Employee Data Breach Claims Against Tesco?

We have provided answers to common questions about data breach claims in the sections below. However, we are aware that some claimants might be looking for advice on their specific circumstances. If you have any questions about the data breach claim process, or would like to chat with us about your case, you can use the Live Chat messaging service to speak to us.

Or, if you have evidence of a valid claim, why not use the banner below to be connected to Legal Expert? They could connect you with a data breach solicitor if your case has a favourable chance.

Select A Section

• What Is An Employee Data Breach Claim Against Tesco?
• What Are The Rules Of The GDPR?
• Does The GDPR Protect Employees In The Retail Sector?
• Introducing The Seven Principles Of The GDPR
• What Information And Data Are Protected By The GDPR?
• What Is A Breach Of The GDPR By An Employer?
• How Employers May Be In Breach Of GDPR Regulations
• What Consent Do Employers Need To Share Employee Information?
• What Should An Employer Do If There Has Been A GDPR Breach?
• Who Are The ICO?
• Guidelines From The ICO About Protecting Employee Information
• Who Do I Report Data Breaches To?
• Calculating Compensation For Employee Data Breach Claims Against Tesco
• Making No Win No Fee Employee Data Breach Claims Against Tesco
• Related Services And Guides
• FAQs On Breaches Of The GDPR By An Employer

What Is An Employee Data Breach Claim Against Tesco?

The EU and UK have strict legislation to protect the data of individuals. The GDPR and the Data Protection Act 2018 put in place strict rules that data controllers must abide by. Should your employer cause a personal data breach and, as a consequence, you suffer financial or emotional harm, the law could allow you to make a data breach claim.

After all, a data breach could cause you to become the victim of theft, or identity fraud. This could impact you financially. Other effects that you could experience because of a data breach could be emotional. You could suffer stress, distress or anxiety because of a breach.

If you could prove that you have experienced either mental or financial harm because of a breach, you could be eligible to claim data breach compensation. You would also need to launch your claim within 6 years from the date you obtained knowledge of the data breach. However, this is 1 year for a human rights breach.

This guide should give you plenty of useful information so you could get some idea of whether you could have a valid claim.

What Are The Rules Of The GDPR?

GDPR is a piece of legislation that came into force in 2018. It is, arguably, the most far reaching, strictest data privacy and security law in the modern world. It mandates a certain set of data protection standards that organisations must comply with when processing information relating to EU data subjects.

The GDPR was enacted into UK law via the Data Protection Act 2018. All UK employers must comply with the GDPR when it comes to processing personal information of employees. A failure to do so could lead to an organisation receiving hefty fines. They could also be held liable for any psychological or financial damages experienced by victims of a data breach due to a breach of GDPR.

Under GDPR, an organisation should take steps to protect the security and privacy of personal data from being breached. While you might assume this would involve installing a firewall, transferring data via secure methods such as via a VPN (Virtual Private Network) and ensuring they have computer security and network security protocols in place, the threat of a data breach is not solely digital.

A breach could happen due to a number of reasons such as the mismanagement of your personal data or because of a human error. You could even claim as a former employee, or if you worked for Tesco as an agency worker and they breached your data. However, you would have to prove that the breach had caused you mental or financial harm. Financial harm could occur if you become the victim of theft or identity fraud due to a breach. You could also claim for the emotional impact for such a breach.

Does The GDPR Protect Employees In The Retail Sector?

When you apply to work at Tesco, or they employ you, they could record a number of different pieces of personal information about you. This would make them a data controller, and you would be a data subject to them. You have certain rights as a data subject, which include:

1. A right to portability of your data
2. The right to ask for restrictions on your data processing
3. A right to ask for an organisation correct inaccurate data
4. The right to have access to your data
5. A right to have data erased
6. The right to make an objection to the processing of your data
7. Rights surrounding automated decision making and profiling
8. A right to be informed about an organisation’s processing of your data

You can find out more about your data rights by visiting the Information Commissioner’s website. A breach of these rights could represent a breach of the GDPR. If you suffer psychological harm or financial loss from such a breach you could make an employee data breach claim.

Introducing The Seven Principles Of The GDPR

GDPR requires every data controller to comply with its 7 key principles. These are:

1. Data minimisation
2. Storage limitation
3. Accountability
4. Fairness, lawfulness and transparency
5. Purpose limitation
6. Security (integrity and confidentiality)
7. Accuracy

A failure of a data controller to comply with these principles could lead to an investigation by the ICO. If they find they have infringed the Data Protection Act, they could issue the organisation with a hefty fine. In addition to this, victims of such breaches who suffer financial or psychological harm could claim GDPR data breach compensation.

If you would like more advice about what could justify employee data breach claims against Tesco, why not use our live chat today?

What Information And Data Are Protected By The GDPR?

The GDPR protects a variety of different types of personal data. During your course of employment, upon application and even after you’ve left the company, your employer should protect:

• Your personal information such as date of birth, telephone number, address, name, and contact details.
• Online identifiers such as your email address.
• Medical data. This could include your sickness record and any workplace injuries.
• Financial data including your bank details, which they may need to pay you.
• Sensitive data. This could include information about your religious or philosophical beliefs, genetics, racial or ethnic origin, physical and mental health, sex life and sexual orientation. It could also include details of trade union membership, and biometrics, if used for identification.

This does not only mean an employer has to protect digital data. They should also protect data in documents such as notebooks and personnel files. A failure to protect your personal data could have a number of unwanted consequences. If you can prove you suffered emotional harm or financial expense due to a data breach, you could make a claim.

What Is A Breach Of The GDPR By An Employer?

Data breach claims could be made for a variety of different data breaches. A personal data breach could involve the unlawful or unauthorised:

• Loss of data
• Disclosure of information
• Loss of availability of data
• Theft of data
• Alteration, processing access to or destruction of data

The ICO explains that breaches could be caused by those inside or outside the organisation. They could be accidental (for example, due to negligence) or caused by malicious acts.

How Employers May Be In Breach Of GDPR Regulations

There could be a number of potential triggers for the financial or emotional harm that can lead to data breach claims. Some examples could be:

• A member of HR discussed your sickness record with your manager in earshot of your colleagues.
• Staff members lost a USB stick containing your personal data.
• Payroll sent your payslip to the wrong address where an unauthorised recipient accessed it.
• A hacker breached a firewall and stole your personal data.
• Cloud databases containing personal data were not secured, leading to a hacker accessing them without authorisation.
• Other cyberattack incidents using DDoS software, a virus, spyware, malware or other malicious software led to a data breach.

Has There Ever Been A Tesco Data Breach?

In 2020, there was a Tesco Clubcard data breach that reportedly affected loyalty card data of over 620,000 customers. The Tesco data breach of 2020 involved a hacker stealing a database of usernames and passwords, according to reports. While the retailer claimed that no financial details were breached, Tesco blocked access to affected accounts and informed affected parties of the breach.

Source: https://www.which.co.uk/news/2020/03/boots-advantage-card-tesco-clubcard-both-suffer-data-breaches-in-same-week/

No matter whether you suffered a data breach as a customer or an employee, if you can prove you endured emotional or financial harm because of such a breach, you could have your case assessed. That way, you could see if you could be eligible for compensation.

What Consent Do Employers Need To Share Employee Information?

Your employer should gain your consent before sharing your personal data, unless they have a lawful reason for sharing personal information without consent. If you’re wondering what valid reasons there could be for an employer sharing information without consent, you can find details on the ICO website. Generally speaking, the following reasons could be considered valid:

• Contract
• Legal obligation
• Legitimate interests
• Vital interests
• Public tasks

This guide about valid employee data breach claims against Tesco aims to provide information to help you. However, if you’d like to speak to an advisor and access free legal advice, click the banner below.

What Should An Employer Do If There Has Been A GDPR Breach?

The action an employer should take if they have a data breach depends on whether the rights or freedoms of data subjects are at risk. If they are, an organisation has 72 hours to report the breach to the ICO unless they have a valid excuse for not doing so within the timeframe. They should also inform affected data subjects.

Should a data breach happen without risk to the rights and freedoms of individuals, the organisation should make a record of it. However, they do not have to report this kind of breach to the ICO.

Who Are The ICO?

We’ve referred to the ICO a number of times in this guide. ICO stands for Information Commissioner’s Office. This public body protects the data protection rights of individuals in the UK. It could investigate breaches of individuals’ data rights, and enforces data protection law in a number of different ways.

One way it could enforce GDPR is by issuing a fine to an organisation for a data breach. Fines could be hefty and reach tens of millions.

Could The ICO Help Me Make Employee Data Breach Claims Against Tesco?

The ICO would not issue compensation for the suffering a data breach causes. You would need to launch your own claim if you suffer harm from a data protection breach. A data breach solicitor could help with this.

Guidelines From The ICO About Protecting Employee Information

There is a useful document on the ICO website, known as the Employment Practices Code. This publication offers guidance to employers on best practices for data protection of health and personnel records, as well as giving guidance on workplace monitoring. It re-iterates to employers that they must protect the data privacy of:

• Current and former employees
• Former and current contractors
• Agency workers
• Applicants (former and current, whether they are successful or not)
• Contract workers

Who Do I Report Data Breaches To?

If you’re assuming you have to report a data breach to the ICO to claim compensation, this is not necessarily the case. The ICO prefer you to try and settle complaints directly with an organisation that breaches your data.

If, however, they do not respond to your complaint or do not settle your complaint to your satisfaction, you could contact the ICO, who could investigate the matter further. You would need to do so within three months of your employer’s final response to you on the matter.

Even if you don’t escalate your complaint with the ICO, you could make an employer data breach claim. That is, providing you can prove your mental or financial suffering. A data breach lawyer could assist with this.

Calculating Compensation For Employee Data Breach Claims Against Tesco

We have already mentioned that data breach claims could be made for financial and emotional harm. The reason you could claim for psychological or psychiatric injuries (without also having to claim for financial losses) is due to Vidal-Hall and others v Google Inc [2015].

In this case, from 2015, the Court of Appeal held that compensation awards like those for personal injury claims involving psychiatric and psychological harm should be considered within a data breach claim. This means you could potentially claim for anxiety, loss of sleep, depression and stress if you suffer such injuries due to a data breach.

Before this case, you could only claim for psychological harm if you’d also lost out financially.

How To Calculate Employee Data Breach Claims Against Tesco

Calculating GDPR data breach compensation for financial harm could be as simple as assessing bank statements and bills to calculate the value of stolen funds or fraudulent purchases. When calculating compensation for psychiatric injuries, lawyers prefer to see a medical report.

You would obtain this by attending a medical assessment with an independent medical expert as part of your claim. The medical assessment also acts to allow you to evidence that your condition was caused or worsened by the data breach.

Lawyers and the courts could assess the medical report alongside the Judicial College Guidelines (JCG), to see how much compensation could be appropriate. The JCG contains recommended compensation amounts for varying injuries.

To give you a little insight into what the publication says could be appropriate for psychological injuries, we’ve created the compensation table below.

Injury	Approx Guideline Amount Per The JCG	Severity
General psychological damages	Up to £5,500	Less severe
PTSD damages	Up to £7,680	Less severe
General psychological damages	£5,500 to £17,900	Moderate
PTSD damages	£7,680 to £21,730	Moderate
General psychological damages	£17,900 to £51,460	Moderately severe
PTSD damages	£21,730 to £56,180	Moderately severe
PTSD damages	£56,180 to £94,470	Severe
General psychological damages	£51,460 to £108,620	Severe

If you’re not quite sure how severe your injury is or are wondering if you could be eligible for this type of compensation, why not use Live Chat to get advice and support from our team?

Making No Win No Fee Employee Data Breach Claims Against Tesco

Many claimants who would like to make employee information data breach claims prefer to have a data breach lawyer on their side. This way, they can feel assured that all paperwork would be put together professionally.

In addition, the data breach solicitor could take on all the negotiations for a compensation settlement. Using a lawyer doesn’t have to mean paying legal fees upfront either. With No Win No Fee claims, you would not have to pay legal fees until your compensation payout comes through.

How Do No Win No Fee Employee Data Breach Claims Against Tesco Work?

1. Your data breach lawyer sends you a Conditional Fee Agreement (the formal term for a No Win No Fee agreement). This is a document that would set out the success fee you would pay in the event of a successful claim. It is normally a small percentage of the compensation.
2. When your lawyer receives your signed agreement, they would work on your case for you. They would try to negotiate a payout on your behalf.
3. Once compensation comes through, the solicitor would deduct the agreed fee, and you’d benefit from the balance.
4. If your data breach compensation claim failed, you would not pay the success fee.

Do you have evidence of a valid claim and are interested in learning more about No Win No Fee claims? You can reach us via Live Chat to ask us any questions about this method of claiming. Alternatively, why not click on the banner below? It will take you to Legal Expert. Contacting Legal Expert’s advisors could result in them connecting you to a No Win No Fee solicitor.

Related Services And Guides

Trends In Data Security Incidents: You can find insight into the industry sectors that have experienced data breaches here.

Are You Data-Aware?: It is very important for people to be aware of who has their personal data and how they use it. This guide could help you become more data-aware.

NCSC Guidance: Here, you can find advice from the National Cyber Security Centre on data breaches.

Your Rights At Work: You can find useful insight into your rights while you’re at work here.

Employee Data Breach Claims: Our general guide pertaining to employee data breaches can be found here.

No Win No Fee Claim: Would you like to learn more about No Win No Fee claims? This guide could help.

FAQs On Breaches Of The GDPR By An Employer

What Constitutes A Breach Of The GDPR?

A breach of the GDPR could involve the loss or theft of personal data. Or it could involve the unlawful or unauthorised access to, or transmission, disclosure, destruction or alteration of your personal information. Even the loss of availability of your data could be a breach of data protection law.

Can I Sue My Employer For Breach Of Data Protection?

To make data breach claims against an employer you would need to be able to prove a breach occurred. You’d also need to evidence the harm it caused you, whether financial or emotional or both.

Thank you for reading our guide that explores what valid employee data breach claims against Tesco could look like.

Guide by JEF

Edited by VIC

In this article, we’ll look at how the General Data Protection Regulation (the GDPR) applies in employee data breach claims against Barclays. A claim might be required if you’ve been harmed financially or mentally because your personal information is exposed following a data security incident. Furthermore, we’ll discuss the role played by the Information Commissioner’s Office in relation to staff data safety.

What Are My Data Protection Rights In The Workplace?

If you are one of the many Barclays employees, you’ll probably have given the company lots of information about yourself. That’s not necessarily a bad thing as it means they can manage your employment and pay you easily! Luckily, any personal and sensitive data Barclays holds on you is protected by the GDPR.

The Data Protection Act 2018 (the DPA) was enacted in May 2018 at the same time the GDPR came into force. As a result, the rules relating to data safety have been enhanced in an attempt to reduce data breaches.

If breaches do occur, they can cause many different problems. In some cases, individuals (or data subjects) can lose money or suffer from distress, anxiety or depression. This is the type of suffering that you might be entitled to seek damages for.

We are here to help you whilst reading this guide. If you have any queries, please connect to live chat and we’ll provide free advice. Where you would like to start a claim, you could connect to Legal Expert (using their banner) for free legal advice about your options. Alternatively, you can call their advisors on 0800 073 8804.

Select A Section

• What Are Employee Data Breach Claims Against Barclays?
• What Is The General Data Protection Regulation?
• Does The GDPR Protect Personal Information In The Workplace?
• The Key Principles Of Data Protection Set Out In The GDPR
• What Employment Data Does The GDPR Protect?
• What Is A Breach Of The GDPR By Your Employer?
• Ways In Which Employers Could Breach GDPR Guidelines
• Can My Employment Data Be Shared Without My Permission?
• What Happens If Your Employer Has Breached The Data Protection Act?
• What Does The ICO Do?
• Employment Data Protection Practices
• Who Is Responsible For Reporting Data Breaches To The ICO?
• Employee Data Breach Claims Against Barclays Compensation Calculator
• No Win No Fee Employee Data Breach Claims Against Barclays
• Further Data Breach Claim Resources
• Employee Data Breach Claim FAQs

What Are Employee Data Breach Claims Against Barclays?

To help during the course of this article, we’re going to explain some GDPR terms before we move on:

• Data processing. The filing, updating, dissemination of personal data and other acts involving it.
• The data subject. An individual whose data will be processed.
• The data controller. An organisation that has defined why personal information is required.
• A data processor. The company or individual that could be used to process data for the data controller.

Data breaches are caused by security incidents such as cyberattacks, criminal action or procedural mistakes. Due to the incident, information that relates to a data subject will end up being destroyed, disclosed, accessed, changed or altered unlawfully.

If you wish to be compensated following a GDPR data protection breach, you’ll need to show that:

• A data protection breach that involved your data took place.
• The breach occurred due to the failings of the defendant.
• Subsequently, you suffered financial harm or psychological injuries.

The most reported form of data breaches are those involving firewall attacks, ransomware, phishing emails and other forms of cybercrime. However, breaches can also be caused by simple mistakes made by staff that handle personal data. It’s worth pointing out that you could claim in either of these situations if you’ve suffered as a result.

Please bear in mind that a 6-year time limit usually applies to data breach claims, which runs from the date you gained knowledge of the breach. That said, where the claim centres on a human rights breach, you’ll only have 1-year.

What Is The General Data Protection Regulation?

During the Brexit transition period, a number of laws have been amended. The GDPR has become the UK GDPR but it is effectively the same as before. It applies to data controllers and processors that collect and process personal data that relates to UK residents. Importantly, the UK GDPR must be adhered to by companies based abroad if they are dealing with customers in the UK.

The regulations mean that data controllers need to have a lawful basis to process personal data. There are several ways to achieve this such as asking for your permission before processing information about you. This is one of the reasons you might be presented with a pop-up box when you visit a new website.

As well as processing information legally, data controllers need to implement measures to keep data safe. This is one of the main reasons the GDPR was implemented and has led to a lot of changes for many organisations.

Where paper-based documents (that contain personal information) are stored in filing systems, the GDPR will also apply. Furthermore, the new rules will cover any information transferred from paper to computer systems. As you’d expect, all data of a personal nature stored electronically is also protected by the GDPR.

Does The GDPR Protect Personal Information In The Workplace?

It is a fact of life that your employer will require some personal information about you. For instance, they wouldn’t be able to pay you without your bank details. Similarly, they wouldn’t be able to keep you up to date about your pension without your home address. Because this type of information could be used to identify you, it is covered by the GDPR’s rules.

Where employers fail to secure your data, it could cause you to suffer damage. For instance, where a colleague finds out you’ve been disciplined because a manager left an email open on an unlocked computer, you might suffer from distress and anxiousness. In cases involving criminals, data breaches could result in financial suffering as well. For any type of suffering that’s occurred, you might be entitled to begin a claim. Please get in touch to learn more.

The Key Principles Of Data Protection Set Out In The GDPR

The GDPR was built on a set of principles. They are:

1. That the processing of personal data must be lawful, obvious and fair.
2. When data is processed, it can only be used for the reasons described when it was collected.
3. During data processing, only data that is needed should be collected.
4. All information of a personal or sensitive nature should be kept up to date. Errors or inaccuracies should be deleted or amended as soon as possible.
5. If data needs to be stored, it must only be kept for as long as it will be required.
6. Confidential and secure methods of data processing must be used. This means systems like encryption might be needed.
7. The data controller must be able to show how they’ve complied with these principles. Ultimately, they are accountable for any personal data they process.

What Employment Data Does The GDPR Protect?

When data controllers plan to process data, they need to work out if it is classed as being personal. The GDPR says data is personal if it could be used to identify a data subject. Importantly, data is covered by the scope of the GDPR if it could indirectly help to identify somebody.

Here some examples of data that could be used to identify you directly:

• Staff or payroll number.
• Your name.
• National Insurance number.
• Your address.
• Mobile or home telephone number.
• Email address.
• Computer username.

Similarly, here are some examples of data that might indirectly identify you:

• Your ethnicity or race.
• Information about a disability.
• Your religious beliefs.
• Marital status.
• Your sexual orientation.
• Your age.

What Is A Breach Of The GDPR By Your Employer?

It is important to realise that data breaches aren’t always big events caused by criminal gangs. They can be caused by simple acts as well. Here are some examples of how your data could be exposed by a workplace data breach:

• Where documents containing personal information is not shredded prior to disposal.
• If your personnel file is accessed by colleagues because it’s stored on an area of the network that’s not password protected.
• Where a device that’s not been encrypted is stolen or left behind.
• Where criminals use hacking techniques to steal staff data.
• If your records are accessed by somebody who has no business requirement to look at them.
• Where your manager leaves your name and personal telephone number on a sticky note on their desk and it’s seen by others.

If you connect to us via live chat, we can see if you might be eligible to begin a claim.

Ways In Which Employers Could Breach GDPR Guidelines

In this section, we’ll briefly look at a reported Barclays security breach. It’s not related to an employee data breach but shows the potential for harm to be caused.

In the report, it is suggested that a Barclays software update led to customers being able to view other customers details when logging in to online banking. On the day of the issue, 4 of the 85,000 users who logged in reported the issue. As a result, Barclays had to take their banking platform offline and roll back the latest upgrade.

Article: https://www.computerworld.com/article/2596448/security-breach-forces-barclays-to-temporarily-close-online-bank.html

Can My Employment Data Be Shared Without My Permission?

In this modern world, data is everywhere. It’s in your office and on your phone. To speed things up, data is often shared between organisations. That’s generally a good thing as it makes things a lot quicker. However, a legal basis for data sharing must exist before it happens.

That said, your employer might be able to share information about you without your permission. A legal basis for doing so can be achieved in a couple of ways. Firstly, where there is a legal requirement to share, your employer won’t have a choice.

For example, they are legally obliged to let HMRC know how much you’re paid each month. Another example is where your life (or somebody else’s) could be at risk. In that scenario, your information could be given out without your permission.

Regardless of whether you’ve consented to data sharing or not, your employer can only give out information that is necessary and nothing else.

What Happens If Your Employer Has Breached The Data Protection Act?

If a data breach has taken place, your employer must act swiftly. Usually, this will require them to conduct an investigation and an immediate risk assessment. If the breach needs to be reported, they have to let the ICO know:

• What has happened.
• When they were aware of the breach and how they found out.
• Who has been affected and who could be affected.
• What steps have been taken to sort the issue out.

Additionally, where there is a chance that the breach puts data subjects at risk, they must be told about it without undue delay. That means a letter or email must be sent to explain when the breach took place, how it occurred and what information was accessed.

If you receive such a letter, we’d suggest you should keep a copy safe. If you do go on to start a claim, it could be used as evidence to prove your data was involved in the breach.

To learn what other evidence might support your case, why not chat with an online advisor today?

What Does The ICO Do?

The Information Commissioner’s Office is the UK’s data protection watchdog. It oversees how companies use personal data. As part of their role they:

• Review issues that are raised with them from the public or data controllers.
• Investigate companies who broken data protection laws.
• Force changes in the ways companies work to help improve data security.
• Fine companies up to 4% of their turnover where laws have been broken.
• Keep a database of fee payers.

In the next section, we’ll show how the ICO works proactively to help organisations comply with the UK GDPR.

Employment Data Protection Practices

Whilst the ICO can use enforcement action to punish data controllers, they’d rather be proactive and help prevent breaches without taking action. Therefore, they supply training documentation that helps companies meet their GDPR obligations.

To help employers, the Employment Practices Code has been written. It helps employers implement the GDPR into staff monitoring, recruitment and other employment processes.

Who Is Responsible For Reporting Data Breaches To The ICO?

If you believe a data breach has taken place, you are able to ask the ICO to investigate if:

• You have raised the issue formally with your employer;
• They have supplied a written response;
• No more than 3-months have gone by since your last update from them.

On the ICO’s website, it says issues that take too long to reach them could be turned down. To discuss whether you should complain to the ICO, connect to live chat today.

Employee Data Breach Claims Against Barclays Compensation Calculator

We are now going to look at what amount of compensation could be paid in a data breach claim. Usually, they consist of two parts. The first, material damages, is claimed if you’ve lost money because of the breach.

The second, non-material damages, is used to cover injuries sustained as a result of the breach. This can include psychological damage caused by distress, anxiety or Post-Traumatic Stress Disorder (PTSD).

During the case of Vidal-Hall and others v Google Inc [2015] at the Court of Appeal, two statements were made that are relevant to this section:

• If the claimant has suffered mental damage because of a data breach, it is right to consider compensating them even in the absence of financial damage—a previous requirement when making a claim.
• Where an award is made for mental damage, the payout should be in line with personal injury law.

When settling personal injury claims, legal professionals use the Judicial College Guidelines to determine compensation levels. Therefore, we’ve also used its figures in our compensation table. Bear in mind, though, these are just examples. If your case is reviewed by a data breach lawyer, they’ll give you a better estimate once your claim has been reviewed.

Injury / Claim	Level	Settlement Bracket
General Psychiatric Injury	Severe	£51,460 to £108,620
	Moderately Severe	£17,900 to £51,460
	Moderate	£5,500 to £17,900
	Less Severe	Up to £5,500
Post-Traumatic Stress Disorder (PTSD)	Severe	£56,180 to £94,470
	Moderately Severe	£21,730 to £56,180
	Moderate	£7,680 to £21,730
	Less Severe	Up to £7,680

To help demonstrate that your injuries were caused by the breach and to determine their severity, a medical assessment will be needed during your claim. The appointment can usually be arranged locally by law firms to reduce how far you need to travel.

In your appointment, an independent specialist will try to ascertain how you’ve suffered previously and whether any symptoms will persist in the future. They’ll ask several questions and use your medical records to try and achieve this. Once they’ve finished, a report will be filed that sets out their findings.

No Win No Fee Employee Data Breach Claims Against Barclays

Law firms understand that claimants don’t want to lose money on solicitors fees. For that reason, many provide No Win No Fee services. By doing so, they take on most of the financial risk and reduce it for the claimant. If your case is taken on, you will still be represented by a data breach solicitor and the claim process should be less stressful.

Before your case is taken on, the solicitor will need to consider its viability. If they are happy to work for you, a contract called a Conditional Fee Agreement (CFA) will be supplied. Within the CFA, you’ll see that your solicitor will only have to be paid for their work if you’re compensated.

If your claim is won, your solicitor will deduct a success fee from your compensation award. This is shown in the CFA as a small percentage of any compensation used to cover the cost of your solicitor’s work. By law, these fees are capped to prevent you from being overcharged.

The solicitors at Legal Expert work on a No Win No Fee basis for claims they accept. If you’d like them to consider your claim, you can contact them on 0800 073 8804.

Further Data Breach Claim Resources

In this part of the guide on employee data breach claims against Barclays, we have provided links to some additional resources.

Freedom Of Information – Advice on how to request information by submitting an FOI request.

Anxiety Advice – Details of how Generalised Anxiety Disorder is diagnosed and treated.

HSBC Employee Data Breaches – This guide explains how HSBC staff could claim for suffering caused as a result of a data breach.

NHS Data Breach Claims – Information on why NHS employees may wish to make a claim.

Employer Claims – This guide isn’t about any company in particular but shows the process employees could take if they’re affected by data breaches.

Employee Data Breach Claim FAQs

This is the final part of this guide about employee data breach claims against Barclays. Therefore, we’ve listed some answers to questions about data breach claims below.

How much compensation can you get for a data breach?

When claiming for psychiatric damage caused by a data breach, compensation payments range from a few thousand pounds up to over £100,000. The extent of your suffering will determine where your claim fits into that range. Furthermore, you could also include any financial losses within the claim.

How long does a data breach claim take?

The length of time a data breach claim takes will depend on whether liability has been accepted for your suffering. If it has, the claim could take just a matter of months. However, if liability has not been accepted early, the claim will take longer as further evidence may be required to prove what happened.

What can I do if my data has been breached?

You could raise a complaint with the company involved and subsequently ask the ICO to investigate. However, if you have suffered financially or psychologically, you may wish to seek compensation for that suffering.

Thanks for reading our guide to employee data breach claims against Barclays.

Guide by HAM

Edited by BIL