Should corporate data breach victims be allowed to force compensation?

Consumer organisation Which? thinks so.

The not-for-profit charity is calling on the government to consider the protections and rights afforded to data breach victims. As the EU General Data Protection Regulation looms ever closer, Parliament has been debating the Data Protection Bill and what rights and responsibilities should be included.

Which? believes that consumers should be adequately protected when corporations neglect and fail in their data protection responsibilities in efforts to attempt to maximise profits and expand their businesses.

One of the main things Which? wants is for independent organisations to be given the power to help data breach victims through fighting for collective redress. Time and time again, we see data breaches headlining our newspapers: like this one affecting thousands of patients or this one affecting millions of customers, etc. Organisations (like ourselves) should be able to easily help large groups of data breach victims to force corporations to pay compensation for the damage they create.

“Data breaches are now more commonplace and yet many people have no idea what to do or who to turn to when their personal data is compromised,” said managing director of Which?, Alex Neill. “The Government should use the data protection bill to give independent bodies the power to seek collective redress on behalf of consumers when a company has failed to take sufficient action following a data breach.”

One place you can turn to for advice on the possibility of making a compensation claim – is us here at Data Leak Lawyers – we represent victims for data leaks and data breaches!

There are a lot of data breaches and the majority of them compromise information like email addresses and passwords. Compared to bank details, it doesn’t seem like much. With this information being breached time and time again, victims can’t always easily find out which corporation was responsible for the spam emails they keep receiving, making accountability hard to establish.

It should be easier for data breach victims to hold a culpable corporation accountable. As soon as a corporation has breached their data protection obligations, victims should be eligible for redress straight away as a result of the violation.

A statement by the Department for Digital, Culture, Media and Sport (DCMS) said they were “confident that our Data Protection Bill will provide consumers with the necessary protections when there’s been an infringement of their rights regarding personal data. The Bill will make the UK full compliant with the GDPR.”

Which?’s request for a more consolidated set of rights for consumers comes shortly after some of history’s largest ever data breaches the world has seen. Credit Reporting Agency, Equifax, suffered a huge breach last year that affected around 145 million people, including hundreds of thousands of Britons. Equifax failed in its responsibilities to sufficiently protect customer data as well as failing to disclose the breach to the public and authorities in a timely manner so that victims would be able to start taking steps to protect themselves.

More firms fear data breaches but don’t know how to deal with them…

Is it more cost effective to pay for cybersecurity or the aftermath of a data breach?