In a recent case, a married couple were awarded £17,000 compensation when their neighbours set up CCTV to monitor their activities. The case serves as a reminder that data protection law applies to CCTV and other forms of surveillance. It is also a good example of how a person can claim compensation for breach of data protection law purely for the distress caused by the breach.
In Woolley v. Akram (or Akbar), Mrs Akram ran a guest-house in the lower portion of a building in Edinburgh. Mr A managed the business. Mr and Mrs Woolley lived in an upper floor flat in the same building. The two couples got on well until Mrs Akram applied to the City Council to turn the guest house into a bail hostel for up to 18 people awaiting trial. This application was opposed by the Woolleys and was ultimately rejected by the City Council. Soon afterwards, Mrs Akram installed CCTV monitoring and audio recording equipment. Both systems operated 24 hours a day and were set to permanently record. Cameras at the front of the property recorded all individuals approaching the Woolleys’ home. Until April 2015, there was also a camera at the rear of the property recording the Woolleys’ private garden.
The Court ruled that the Akrams had breached the Data Protection Act 1998 in a number of ways:
- First Data Protection Principle – The data processing had been neither fair nor lawful. No notices were put up alerting visitors to the recording and no sufficient reason or justification was given for it. The Woolleys were provided with no information which set out who had access to the data, for how long it was to be kept or for what purpose.
- Third Data Protection Principle – The data processing had been excessive and unjustified and, in the Court’s view, ‘evidently an effort to oppress’.
- Fifth Data Protection Principle – The footage had been retained longer than necessary. It should have been deleted on a daily basis.
The Court accepted that the Woolleys that they were extremely distressed by the surveillance. It had caused them to restrict their activities in and around their own property. The Court described as ‘disturbing’ the fact that Mr Akram could view the recorded footage from a remote location and referred to Mr Akram’s ‘sinister’ decision to text Mrs Woolley to tell her that she knew her daughter was in the flat.
Turning to the question of compensation, the Court referred to previous case law which established that a claim could be brought under the Data Protection Act where distress was the only damages suffered but observed that there was limited guidance as to how such compensation should be calculated. In these circumstances, it accepted the Woolleys’ suggested method of calculation – namely, the nominal amount of £10 per person per day multiplied by the number of days the unlawful data processing had continued (excluding one month a year when the Woolleys would be away from the property – e.g. on holiday).
We really need more guidance on how compensation should be calculated under the Data Protection Act from the higher courts. In the meantime, whilst this decision probably does not carry great weight as a precedent, it does illustrate how a court might approach the issue – particularly where a data protection breach has continued for a substantial period.