What Right To Data Privacy Do You Have In The Workplace?

This guide is going to look at employee data breach claims against the RAF.

Have you ever sat down and thought about the amount of information your employer holds about you? It may be quite a lot and it may often be sensitive information that you wouldn’t want to get into the wrong hands.

Luckily, the General Data Protection Regulation (GDPR) has been enacted into UK law through the Data Protection Act 2018 (DPA). This is designed to protect personal data and prevent data breaches from occurring.

However, mistakes still happen. Therefore, we’ll show you how personal data breaches can occur and what harm can result from them. Furthermore, we’ll show you what amount of compensation might be payable if you’ve suffered due to a breach.

The Information Commissioner’s Office (ICO) has been given the role of enforcing data protection laws. That means they are allowed to investigate data breaches when they occur. If the organisation that decides how and why they process personal data (the data controller) is found to be breaking the regulations, the ICO could fine them.

Additionally, the ICO can be forced to implement tougher security protocols. However, regardless of how much you have suffered mentally or financially due to a GDPR data breach, the ICO can’t compensate you. Instead, you will need to begin your own legal action.

As you continue through this guide, you can connect to us via live chat should you need our support. If you decide that you would like to make a claim, you could connect with Legal Expert via their banner displayed below. If you’d prefer to call, their number is 0800 073 8804.

Select A Section

• What Is An Employee GDPR Data Breach Claim Against The RAF?
• What Is The GDPR?
• Does The GDPR Cover RAF Employee Data?
• What Are The GPDR’s Seven Principles?
• What Sort Of Employee Data Does The GDPR Protect?
• Examples Of Breaches Of Staff Data Protection
• How Could An Employer Breach Employees’ Data Privacy?
• Does An Employer Need Permission To Share Your Data?
• What Should Happen If Your Employer Has Breached The GDPR?
• What Does The Information Commissioner’s Office Do?
• Guidelines From The ICO On Protecting Employees Data
• Should I Report The RAF For A Personal Data Breach?
• Calculating Damages For An Employee Data Breach Claim Against The RAF
• Making No Win No Fee Data Breach Claims Against The RAF
• Learn More About Data Breaches
• GDPR: Data Protection Questions For The Armed Forces

What Is An Employee GDPR Data Breach Claim Against The RAF?

Data breaches are incidents that occur due to a security issue of some sort. Due to the incident, personally identifiable data will be disclosed, lost, destroyed, accessed or changed in an unauthorised manner. They can be deliberate, accidental or unlawful.

In employee data breach claims against the RAF, you would need evidence that:

• A data breach involving personal information about you took place; and
• Due to the breach, you suffered financial losses or psychologically.

Claims are time-limited, though. That means you’ll usually need to claim within a 6-year window from the date you obtained knowledge of the breach. However, claims relating to human rights breaches only have 1 year, so please bear that in mind.

Importantly, you could claim for an accidental data breach as well as those that are caused by illegal or deliberate acts—providing you can prove you suffered financially or mentally. If you’d like more advice on this, please click the live chat box below.

What Is The GDPR?

The GDPR is a stringent list of rules relating to data protection. It applies to all organisations that process personal data within the EU or where the individual whose data is processed (the data subject) is based within the EU. It was enacted into UK law via the Data Protection Act 2018.

Before processing such information, a lawful basis must be established. One way to achieve this is to tell the data subject why their data is needed and ask for permission to use it. That’s one of the reasons you’ll see a pop-up box asking you for your data preferences before you can use a website.

In addition to processing data lawfully, data controllers should keep it secure. The idea is to use tougher security measures so that it’s less likely your data will be accessed by hackers, cybercriminals and other unauthorised parties.

However, even though it’s common to hear about phishing emails, ransomware or viruses being the cause of data breaches, physical documentation also falls within the GDPR’s rules.

If you’ve suffered anxiety, stress, depression or similar conditions because of a data breach, or if you’ve lost money following it, it might be possible to claim compensation. As we progress, we’ll show you how much you may be entitled to and what you could claim for.

Does The GDPR Cover RAF Employee Data?

All organisations that process personal information in the UK are bound by GDPR rules. The RAF is no different. Data protection laws mean that any personal information you give your employer needs to be protected.

The GDPR covers the information you provide at the start of your employment and anything else that’s added as you continue to work for the company. For example, information about your disciplinary, sickness and performance records would be covered.

Importantly, claims aren’t only possible if your information is stolen by criminals. For example, if your colleagues found out that you’d been disciplined because computer files weren’t stored securely, you might be eligible to claim for the stress and embarrassment caused by the breach.

If you have evidence of a valid claim, we can provide extra information on employee data breach claims against the RAF via live chat.

What Are The GDPR’s Seven Principles?

In this section, we are going to examine the 7 principles that are the basis of the new legislation. We’ve provided a brief summary below:

1. Lawfulness, transparency and fairness. As such, you should be told why your information is required. The data must also be processed lawfully as described earlier.
2. Accuracy of data. Any personally identifiable information needs to be kept up to date. Where errors are spotted, the data must be amended or deleted.
3. Limitation of use. Processed data may only be used for the purposes indicated when it was collected.
4. Minimal data. Data that is required should be processed and nothing more.
5. Storage of information. Information should not be stored for any longer than is necessary.
6. Confidentiality and integrity. The security of personal data is vital. Therefore, methods like anonymisation or encryption could be used to make the data confidential.
7. Accountability. All data controllers need to show how they comply with the GDPR’s rules.

What Sort Of Employee Data Does The GDPR Protect?

In essence, any information that could be used to identify you (whether on its own or alongside other information) is protected through the GDPR. The types of data that could be used for identification include:

• Names
• Contact details
• Employee numbers
• National insurance numbers

Also, some data that might indirectly lead to identification is covered as well. This can include information about marital status, religion, ethnicity or disabilities.

Both digital and physical data are covered. Personal information can, for example, be:

• Kept in some type of filing system.
• Retained by a public body.
• Processed using computers.

For information on how this applies to employee data breach claims, please get in touch today.

Examples Of Breaches Of Staff Data Protection

As you might imagine, there are plenty of different ways an employee data breach could take place. To give you some idea of how they might occur, we have listed a few scenarios below.

• A portable device that is unencrypted is lost or stolen and contains personal data.
• Sensitive employee data is accessed by unauthorised persons because it’s stored on an unsecured part of the computer network.
• A letter containing your personal information that is intended for you ends up being sent to another employee who is not authorised to access it, but does so.
• Your manager is overheard by your colleagues discussing details of your disciplinary because they failed to close their office door.

In these scenarios, you might be eligible to claim compensation for the psychological suffering or financial loss the data breach causes.

How Could An Employer Breach Employees’ Data Privacy?

In this part of our guide, we are going to supply information about a potential data breach involving the RAF alleged through online reports in 2009. The report contains information about three unencrypted hard drives containing highly sensitive data that had apparently gone missing.

According to the article, high-ranking officers were interviewed for security clearance. The recordings of these interviews were stored on the missing hard drives. The interviews are said to include information about medical conditions, extra-marital affairs, debt and drug use. All of this information would be deemed sensitive enough to be protected by the DPA and GDPR.

News report: https://www.wired.com/2009/05/uk-data-breach-makes-royal-air-force-staff-target-for-blackmail/

Does An Employer Need Permission To Share Your Data?

On many occasions, data controllers need your permission before they process data about you. However, there are a number of ways a lawful reason to share without your permission is possible. They are:

• Where there is a legal obligation to share. For example, employers are obliged to tell HMRC about income and tax payments.
• Because of vital interests. Here, information about you might be shared if somebody’s life is at risk.
• Where you have a contract with them, under certain circumstances.
• Where the organisation needs to use it on a public interest basis.
• Because of legitimate business interests.

If these reasons don’t exist and your information has been shared without your consent, it is possible that you could claim damages, providing you can evidence that you suffered mentally or financially.

If you have evidence of a valid claim, use our live chat for more information about employee data breach claims against the RAF.

What Should Happen If Your Employer Has Breached The GDPR?

If your employer becomes aware of a potential data breach, there are a number of steps they’re obliged to take. In many cases, these could be carried out by the organisation’s data protection officer. They include:

• Investigating what has happened to establish when and why the breach happened. The investigation should also determine whose data has been affected.
• Telling the ICO that a data breach has occurred within 72 hours (if it risks the rights and freedoms of data subjects).
• Telling any data subjects who could be harmed by the breach about what has happened without undue delay.

If the breach doesn’t risk the rights and freedoms of data subjects, the organisation doesn’t have to inform the ICO. However, they should keep a record of the data breach.

As with any type of compensation claim, evidence is vital to support your allegations. Therefore, should you be contacted by your employer about a breach, it’s a good idea to retain the email or letter. It could be used to confirm that the breach took place and that your personal data was included.

What Does The Information Commissioner’s Office Do?

In the United Kingdom, the Information Commissioner’s Office is the watchdog in place to enforce data protection legislation. Their remit allows them to conduct investigations when they find out about potential breaches of data protection legislation.

Where wrongdoing is identified, they can use enforcement notices to tell companies to change how they process data. They could also issue a large financial penalty.

However, because the ICO doesn’t have the powers to compensate you, you would need to take your own legal action if a personal data breach has led to financial loss or psychological harm.

Legal Expert can provide free legal advice on employee data breach claims. To get in touch with them, please click their banner displayed throughout this page.

Guidelines From The ICO On Protecting Employees Data

To help companies adhere to data protection legislation, the ICO writes vast amounts of training documentation. For instance, they have written an Employment Practices Code that  explains the ways in which the GDPR affects:

• Employment records.
• Staff monitoring.
• Hiring and recruiting.
• Health and sickness records.

Furthermore, it provides information about how the GDPR applies to existing and previous employees, contractors, agency staff, temps and also unsuccessful applicants.

So long as an employer holds your personal data, they should protect it, even if you’re no longer an employee.

Should I Report The RAF For A Personal Data Breach?

The ICO could investigate your employer’s data breach but you’ll need to use the correct process before contacting them. Consequently, you will need to lodge an official complaint with your employer first.

After you have escalated the complaint as far as possible, you could ask the ICO to look at the problem. You should do this before it has been 3 months since you had a final, meaningful update on your complaint. Remember, though, their investigation won’t result in you being paid compensation.

If you get in touch with our advisors, it may be worth asking them about contacting the ICO. That’s because an investigation might not be necessary if enough evidence to support your claim already exists.

Calculating Damages For An Employee Data Breach Claim Against The RAF

If you can prove you have a valid claim, your compensation would be based on either or both of the following:

• Material damages: where you can claim for any financial losses or expenses caused by the data breach.
• Non-material damages, which focus on the psychological impact the breach has caused. For example, any distress or anxiety that resulted.

At the Court of Appeal, some important decisions have affected data breach compensation claims. In the case of Vidal-Hall and others v Google Inc [2015]. The Court held that:

• Where a claimant has been injured (psychologically) following a personal data breach, damages to cover the suffering can be sought. (Before this case, you could only claim for psychological harm if you’ve also suffered financially.)
• Where the claimant’s case is successful, any compensation should be awarded in line with recommended amounts awarded in personal injury law.

Therefore, we have supplied a compensation table below that contains example compensation amounts found within the Judicial College Guidelines. This publication is referred to by legal professionals when valuing injuries.

Injury Type	Level of Severity	Compensation Range	Additional Notes
Psychiatric Injury	Severe	£51,460 to £108,620	There will be serious problems for the claimant relating to how they are able to cope with life and maintain relationships. This will result in a very poor prognosis.
Psychiatric Injury	Moderately Severe	£17,900 to £51,460	Significant issues will exist similar to those listed above. However, the prognosis will be more optimistic.
Psychiatric Injury	Moderate	£5,500 to £17,900	Initially, all of the symptoms listed above will cause problems. However, there will have been a good level of recovery meaning that a good prognosis will be given.
Psychiatric Injury	Less Severe	Up to £5,500	This category looks at how long daily activities were affected for.
PTSD	Severe	£56,180 to £94,470	The victim will suffer permanently from PTSD symptoms which may include mood disorders, hyper-arousal, flashbacks and suicidal ideation.
PTSD	Moderately Severe	£21,730 to £56,180	In this category, it is hoped that the victim's condition will improve with professional support. Initially, they will suffer significantly as described above.

Medical Evidence and Data Breach Compensation Claims

To help prove the full impact of your suffering, and to prove that your condition was caused or worsened by the data breach, you’ll need to attend a medical review as part of the claim. This will be conducted by a medical specialist who is independent of the case.

The specialist will try to determine what mental harm you’ve sustained and how it might affect you in the future. To achieve this, they’ll ask questions and refer to your medical notes. Following the meeting, they will prepare a report that lists their findings and send it to your solicitor.

Due to the fact that the report is so important, we believe medical reviews are essential in all cases. Please connect with us in live chat if you’d like to know more about the claims process.

Making No Win No Fee GDPR Data Breach Claims Against The RAF

Hopefully, you’ve found this article about employee data breach claims against the RAF helpful. At this point, many people start to worry about how much they might need to pay a solicitor, especially where the case is lost.

However, you shouldn’t be too worried about this because of No Win No Fee agreements. That means that if your claim is accepted, you’ll get legal representation, but the financial risks of using the services of a solicitor will be lowered.

At the start of the claims process, the solicitor will run through your case with you. If they decide to take your claim on, they’ll supply you with a Conditional Fee Agreement (the formal term for a No Win No Fee agreement). This explains what must be achieved before your solicitor will be paid.

Essentially, you won’t pay the solicitor’s fees in unsuccessful cases.

If the claim does have a positive outcome, you’ll pay a success fee to cover your solicitor’s expenses and time. This is explained within the No Win No Fee agreement and is a small percentage of your compensation that the solicitor will retain. Success fees have been capped by legislation to prevent overcharging.

If you have evidence of a valid claim and you’d like to speak to an advisor, please click on the banner below. Otherwise, for more information about your eligibility to claim on this basis, please use our live chat to contact us.

Learn More About Data Breaches

You have almost completed our guide on employee data breach claims against the RAF. Therefore, to provide further support, we have added some more useful information in the list below.

Guide To Data Protection – Guidance from the ICO on data protection.

Be Data Aware – Information from the ICO on keeping your personal data secure.

Anxiety – NHS guidance about how anxiety is diagnosed and what treatment is available.

Employer Data Breaches – Guidance about how data breaches by employers might lead to a compensation claim.

NHS Employee Data Breaches – Advice for NHS staff who have been impacted by a GDPR data breach.

No Win No Fee Funding – An explanation about how No Win No Fee claims are funded and when you might be eligible.

GDPR: Data Protection Questions For The Armed Forces

In this final part of our guide, we’ve listed answers to some common questions relating to data security laws. However, if you have any further queries, please connect with us in the live chat.

Is employee data covered by GDPR?

Any personal data held by your employer is included in the GDPR’s scope if it could be used to identify you, whether on its own or in combination with other data. The GDPR’s rules mean that any personal or sensitive data needs to be protected.

What are the legal requirements for data protection?

Personally identifiable data is protected by the Data Protection Act 2018 and the GDPR. This means that it should be stored securely. It should also only be kept as long as it’s needed and not processed without a lawful reason.

What would happen if an employee breaches GDPR?

If you’ve suffered psychologically or financially because another employee has breached the GDPR’s rules and caused a data breach, you could ask for damages to cover the suffering caused.

However, your claim is likely to be made against your employer rather than the other member of staff. That’s because, as the data controller, they will be responsible for overseeing data protection processes within the organisation.

Thanks for reading our guide to employee data breach claims against the RAF.

Guide by HB

Edited by VR

What Are My Rights If My Employer Breaches My Data Privacy?

In this guide, we are going to look at employee data breach claims against NHS Wales. That’s because, if you are an employee of NHS Wales and information about you ends up in the wrong hands, you could be eligible to seek compensation if you can prove that you suffered either financial or mental damage as a result.

As you may be aware, the General Data Protection Regulation (GDPR) has been introduced into law. Along with The Data Protection Act 2018, it gives you a certain level of control over how your personal information is used. Additionally, anybody who uses data about you (the data controller) needs to try and keep it safe. The idea of these laws is to try and prevent the harm caused by personal data breaches. However, they still happen.

In the UK, the Information Commissioner’s Office (ICO) is responsible for enforcing the GDPR. Their remit allows them to fine any organisation responsible for personal data breaches. These fines can be up to 4% of a company’s turnover (up to £17.5 million).

However, if you’ve suffered because your personal data has been exposed, the ICO can’t compensate you. For that reason, you’d need to take action against your employer yourself. We’ll show you your legal options as you progress through this guide.

If you have any questions whilst reading this guide, please feel free to connect with us in our live chat service. If you have evidence that you’ve suffered damage mentally or financially following an NHS Wales data breach, you may wish to use the Legal Expert banner below. They could appoint a data breach solicitor to your case if it has strong grounds. If you’d rather phone them, they can be reached on 0800 073 8804.

Select A Section

• What Is GDPR And The DPA?
• Are NHS Wales Employees Protected Under GDPR Rules?
• The Main Principles Of GDPR?
• What Types Of Private Data Does GDPR Protect?
• What Is A Breach Of The GDPR By An Employer?
• How Could My Employer Fail To Protect My Data Privacy?
• What Are Employee GDPR Data Breach Claims Against NHS Wales?
• Does Your Employer Need To Consent To Share Your Data?
• What Happens When Your Employer Breaches The GDPR?
• What Is The ICO?
• Guidelines From The ICO On Protecting Employee Data
• Reporting Your Employer For A GDPR Breach
• Calculating Compensation For A GDPR Data Breach Claim Against NHS Wales
• Making No Win No Fee GDPR Employee Data Breach Claims Against NHS Wales
• Resources On Data Protection
• GDPR – FAQs For The Health And Social Care Sectors

What Is GDPR And The DPA?

The GDPR is known as one of the strictest set of data protection laws in the world. Any company that processes personal data within the EU or about EU residents needs a lawful basis before doing so. As a result, you may see pop-up notifications on websites asking for you to confirm you are happy with their data policies. That’s because one method of gaining a lawful basis is to ask for your (the data subject) permission to use your data.

As well as making sure you know why your data is needed, the data controller has to implement stringent security protocols. The idea here is to make access to your data by unauthorised parties (cybercriminals, hackers, etc) as difficult as possible.

However, electronic data is not the only type covered by GPDR. Although you will see reports about phishing emails, ransomware, keyloggers and firewall exploits being used to access data illegally, data breaches can be caused by human error and relate to physical documents as well.

If you have been harmed because of an NHS Wales data breach, you could be entitled to claim compensation. In the rest of this article, we’ll explain what damages could be sought in employee data breach claims against NHS Wales. This could include both financial suffering and psychological suffering.

Are NHS Wales Employees Protected Under GDPR Rules?

The rules of the GDPR apply to any organisation that processes personal information. That means the type of information you give to your employer when you join them will be covered by the new legislation. For example, to manage their obligations towards you, your employer is likely to want details about your address, national insurance number, bank details and contact details.

Your personnel record is likely to grow as your employment continues. For instance, details about sickness, performance and disciplinary information could be appended. This is also information that could cause you to suffer if leaked so will need to be protected too. We’ll look at the ways in which data breaches involving an employer could occur later on.

The role of NHS Wales as an employer is to protect personal data as much as possible. If a GDPR data breach occurs and causes you to suffer, you could be entitled to claim compensation. For free information on making employee data breach claims against NHS Wales, please connect with our team today.

The Main Principles Of GDPR?

The GDPR documentation is quite a long piece of legislation. However, it is fairly easy to comprehend which helps make implementing it a bit easier. All organisations are obliged to collect and process data in accordance with a set of principles. They are:

• Lawfulness, fairness and transparency. Any personal data has to processed using a lawful basis. The data subject must be told about the reason for processing.
• Limited use. The personal data that is processed needs to be used only for the reasons specified.
• Accurate information. If personal data is stored, any errors or omissions should be updated or deleted immediately.
• Storage. It is only legal to store processed data for as long as it is required.
• Confidentiality and integrity (security). All data of a personal nature needs to be processed in a secure manner. This can include using methods like encryption.
• Minimum data. Only data that is required should be requested and nothing more.
• If the ICO asks, the data controller must show how they adhere to these principles.

To learn about these principles in greater detail, please take a look at the ICO’s page on them.

What Types Of Private Data Does GDPR Protect?

The GDPR clarifies that all data that could be used to identify a data subject falls within its scope. This includes the type of information that could identify you directly. The list of data that could be included here includes employee numbers, names, email addresses, national insurance numbers and home addresses.

Furthermore, some data relating to certain characteristics could be covered as they could indirectly lead to your identification. They include information on disabilities, ethnicity, age or marital status.

Whether the data is digital or paper-based, it will be covered if it is:

• Processed using electronic systems.
• Stored in filing systems.
• Held by a public authority.
• A part of a public record i.e. your education records.

What Is A Breach Of The GDPR By An Employer?

In this section, we’ll provide examples of scenarios that could lead to employee data breach claims against NHS Wales. The true list of possibilities is way too long to include here but here is a handful of examples:

• If an email or letter asking you to attend a disciplinary meeting is sent to another employee.
• Where documents containing sensitive documents are stored on an unsecured network area allowing unrestricted access.
• If a portable device (laptop, memory stick etc) that’s unencrypted is lost or stolen and contains data about you.
• Where another member of staff looks up your contact details without authorisation or business need.

Remember, for these instances to entitle you to seek compensation, they will have had to have caused you to suffer financially or mentally. This could include anxiety, distress or other similar conditions.

How Could My Employer Fail To Protect My Data Privacy?

In this section, we are briefly going to use a news report to show how data breaches could happen. In this case, a pharmacy group inadvertently sent an email to locums that contained the personal information of about 24,000 members of staff.

The email contained a spreadsheet that included payroll numbers, email addresses, names, addresses and phone numbers. The message was recalled immediately but, according to the news report, the company admitted there was still a risk of identifiable data being shared.

The pharmacy group instigated an investigation and informed the ICO about the incident.

Report: https://pharmaceutical-journal.com/article/news/well-pharmacy-apologises-after-leaking-personal-information-in-data-breach

What Are Employee GDPR Data Breach Claims Against NHS Wales?

The GDPR explains that a personal data breach is most likely to be caused by some type of security problem. As a result, personally identifiable data will be accessed, destroyed, lost, disclosed or changed in an unauthorised manner.

To make a successful claim against NHS Wales for an employee data breach, you will need to demonstrate (with evidence) that:

• A GDPR data breach involving data about you occurred.
• As a result, you suffered a financial loss or sustained a psychological injury.

Something to bear in mind is that it doesn’t matter if the security incident was accidental. Breaches of this nature are covered in the same way as illegal or deliberate acts. Let us know via live chat if you’d like to know more.

Does Your Employer Need To Consent To Share Your Data?

As we’ve explained early, to process personal data there must be a lawful basis as defined by the GDPR. The same applies if your employer wishes to share information about you with others. However, they won’t always have to seek your permission. That’s because the lawful basis could be formed by:

• Vital interests. For example, where your employer believes your life (or somebody else’s) might be in danger.
• Legal obligation. This could include the scenario where employers have to tell HMRC about tax and income relating to employees.

Where information about you has been disclosed or shared with others but there is no lawful basis for doing so, you might have a valid claim if the act caused you to suffer damage to your finances or mental health.

What Happens When Your Employer Breaches The GDPR?

As part of the GDPR, data controllers should have an action plan in place so that they know what to do if a personal data breach occurs. This should include the following actions:

• Beginning an investigation to identify what has happened. This should help them to understand what data was included, how the breach occurred and whose data was involved.
• Making the ICO aware of the potential breach and subsequent investigation.
• Informing data subjects, without undue delay, if the breach could put them at risk.

Importantly, evidence is required as part of your claim to prove what happened and how you’ve suffered. Therefore, a letter or an email confirming the breach took place could go a long way to proving what happened. For that reason, you should retain any communication you receive informing you of the breach.

What Is The ICO?

The Information Commissioner’s Office is the UK’s watchdog of data protection laws. The ICO police laws including the Data Protection Act and the GDPR. As part of that role, they are allowed to investigate suspected wrongdoing. Where problems are identified, the ICO can use enforcement notices to change the way a company works. They can also issue financial penalties too.

The reason you’ll need to take your own legal action following a data breach is that the ICO does not have the resources or powers to deal with compensation claims.

If you believe you’ve got a valid case against NHS Wales, you could ask for a free claim review from Legal Expert. If that’s what you want to do, please use the banner above to connect with their team.

Guidelines From The ICO On Protecting Employee Data

As well as reacting to data breaches, the ICO tries to help companies comply with the GDPR by providing training materials. For example, the Employment Practices Code explains how the GDPR applies to:

• Staff including agency, temporary or contract workers.
• Applicants – whether successful or not.
• Current staff and former employees.

The information within the guide focuses on staff monitoring, health records, recruitment processes and employment records.

Reporting Your Employer For A GDPR Breach

You may wish to speak to the ICO about your case. However, you’ll need to have complained formally to your employer first. Also, if there is an escalation path offered by your employer’s response, you will need to follow it.

After 3-months have passed since any meaningful update, you could request that the ICO investigate if you’re still not happy.

This is something you may wish to check with your solicitor first though. That’s because, as mentioned earlier, the ICO can’t award compensation. However, if there isn’t enough evidence to prove what’s happened, an ICO report could make the claims process easier.

Please use live chat to connect with us if you’d more information on what evidence is required to support your claim.

Calculating Compensation For A GDPR Data Breach Claim Against NHS Wales

Generally, if you seek compensation following a data protection breach, it will usually be for one or both of the following:

• Material damages: Compensation that tries to cover any financial costs or losses resulting from the breach.
• Non-material damages: The part of your claim that focuses on the harm caused by psychological injuries like distress, anxiety or depression.

In the case of  Vidal-Hall and others v Google Inc [2015] heard by the Court of Appeal, it was decided that:

• Where the claimant has suffered mental injuries due to a data breach, a compensation award should be considered. This is true whether any financial loss has resulted or not.
• If compensation is to be paid, values used in personal injury law should be used to set the correct level.

To demonstrate how much might be paid for some relevant injuries, we’ve provided the table below. It contains amounts listed in the Judicial College Guidelines – a document used in personal injury cases.

Psychological Injury	Severity	Settlement Range	Further details
Psychiatric Injury			These factors are used to assess psychiatric injuries: 1) The victim's ability to cope with work, life in general or education;2) the level of impact on relationships; 3) if treatment would help; 4) the victim's vulnerability; e) medical prognosis.
	Severe	£51,460 to £108,620	Marked problems with every factor leading to a very poor prognosis.
	Moderately Severe	£17,900 to £51,460	Significant issues with each factor but with a more optimistic prognosis.
	Moderate	£5,500 to £17,900	Initial issues with each factor with improvements being made leading to a good prognosis.
	Less Severe	Up to £5,500	Minor symptoms that resolve in full within a short period of time.
PTSD	Severe	£56,180 to £94,470	Permanent PTSD symptoms including hyper-arousal, flashbacks, nightmares and suicidal ideation. These will affect all aspects of the victim's life
	Moderately Severe	£21,730 to £56,180	A similar amount of suffering as above. However, there will be some hope of recovery with professional support.

Because you have to prove the extent of your suffering, a medical assessment is required for all claims. This will be conducted by an independent party and solicitors can usually arrange local appointments.

To find out more, why not use our live chat service? Alternatively, you could use the banner at the top of the page to see if Legal Expert could provide a data breach lawyer to represent you.

Making No Win No Fee GDPR Employee Data Breach Claims Against NHS Wales

You might think that the risk of paying for a solicitor and then losing your case is too high to proceed. However, you shouldn’t put off your claim on that basis. That’s because many law firms provide No Win No Fee services. Where they do, you could get the access you’re after but with reduced financial risk.

As the solicitor will be taking on most of the risk, they will need to vet cases before they are taken on. After your case has been reviewed, if the solicitor agrees to represent you they’ll give you a contract. This is called a Conditional Fee Agreement (CFA). The CFA makes it clear what your solicitor must achieve if they are to be paid. Basically, you will only be liable for their fees if you receive compensation.

Within the CFA, you will see a success fee listed. This is a small percentage of any compensation you are paid that will be retained by the solicitor. It is used to cover their costs and the time spent on your case. To prevent overcharging success fees are capped by law.

Importantly, if your case is funded by a No Win No Fee agreement, you will find that:

• Your solicitor won’t request any funds in advance.
• There won’t be any solicitor’s fees charged to you while the case progresses.
• If the case does not work out, you won’t have to pay for your solicitor’s work.

Legal Expert offers No Win No Fee services for employee data breach claims. Please feel free to use the banner above to connect with them. They’ll review your case for free to see if it is suitable.

Resources On Data Protection

As you have almost completed this article about employee data breach claims against NHS Wales, we are going to use this section to list some additional resources which may help you.

Subject Access Requests – Guidance on how you can request copies of data held about you.

Cognitive Behavioural Therapy – NHS information on how CBT can help tackle conditions like anxiety.

Employer Data Breach Claims – An article that takes a more general look at employee data breach claims.

Your Workplace Rights – This article explains a number of rights that employees have within the workplace.

What Is Employer Negligence? – A definition of employer negligence which is important in regard to workplace injury claims.

GDPR – FAQs For The Health And Social Care Sectors

In this final section of our guide about employee data breach claims against NHS Wales, you’ll find answers to some frequently asked questions.

Are employers bound by the GDPR?

All organisations that process personal information about you fall within the scope of the GDPR. Therefore, if your employer fails to secure data about you and you suffer because it is leaked, you could seek damages against them.

How long do you have to make a GDPR data breach claim?

Mostly, you’ll have 6-years to make your claim. However, where a claim is based on a breach of your human rights, you’ll only have 1-year to submit your case.

What could you claim for in a personal data breach claim?

Data breaches on their own won’t entitle you to seek compensation. That’s because you’ll need to prove what suffering was caused because of the breach. Thereafter, you could seek damages for any financial losses or psychological suffering that happened because of the incident.

Thanks for reading our guide to employee data breach claims against NHS Wales.

Guide by HB

Edited by BER