Virgin, mystery extra line: 2 judgments for Data Protection breaches - so far!!

[BankFodder]

Thank you.

Have you submitted your directions questionnaire?

The next step will be that a date will be set for a hearing and there must be an exchange of documents about 21 days before then. When we know the hearing date then we can start to prepare.

Of course based on their defence, they are trying to introduce issues which aren't all included in your claim. Quite frankly their defence is a lot of nonsense and as far as I can make out the only thing which refers to your claim is their last paragraph which disputes and puts you to proof as to the amount of money you are claiming. Other than that, their defence seems to relate to the substantive dispute – which of course you have not started to litigate on at all yet.

You will need to make sure that you start bringing together all of your documents. Identifying what you have – also identifying what you don't have an yet you believe exists. Have a look at the advice we give on preparing your court bundle.

Also, although it shouldn't come up at this point because it is not the SAR issue, I've already pointed out to you that we will need to get some very good documentary evidence of your signature changes and your practice of changing your signature every year. I'm sure you realise that this is an extremely unusual thing to do and although this issue should not come up at all in the forthcoming hearing, it may be referred to at some point and we will have to decide whether to address it or simply say that this is not one of the issues which has been raised in your claim. I favour the latter

 

[BankFodder]

Luvly jubbly

[BankFodder]

They will probably say in relation to this latest SAR claim, that you have been sufficiently recompensed because of the previous two.

They will try to merge the three actions together as if they were one. In exactly the same way that they are trying to merge this latest SAR claim with the whole problem of the mystery handset.

It will be very important not to allow them to stray into that territory.

It's essential to keep to your agenda which is their breach of this SAR and the distress that you are suffering as a result of this particular breach. Distress caused by anything else including the setting up of the mystery handset account are completely different and they mustn't be allowed to try and bring them into the equation

[BankFodder]

It basically means that the court is saying that the case is suitable to be heard simply on the papers – and that means that there will be no representations from either side other than what has been submitted on paper and the court make a decision based on the documents before it at the time.

This would allow you to submit further documents – such as a reply to the defence – and for the judge to make the decision based on that.

Personally I think a remote hearing is probably a better idea but let's think about it.

[BankFodder]

Please could you have a look at this draft response to the order which you have posted above.

Please comment on it – is it accurate? Is there anything else of significance to add? Is there something that should be taken away? Would you be happy to sign this off as a statement of truth?

 

Quote

Case name XXXX

claim number XXXX

in Exeter County Court

 

 

Re: the order of the court dated XXX – Request for Remote Hearing

 

The claimant respectfully requests the court to reconsider its order of the XXX date that the above claim in respect of the defendant's breach of statutory duty is suitable for determination on the papers, and to substitute the order with an order that the case be heard by a remote hearing.

The claimant respectfully requests the court to enter judgement for the claimant and in which case the remote hearing should be concerned simply with the question of quantum which is the only issue in the claimant's particulars of claim which the defendant has challenged.

The claim

Breach of Statutory Duty: The claimant has brought the claim because the defendant has failed to respond to a statutory request dated XXX for disclosure of data under the Data Protection Act and which sets a statutory time limit of 30 days for compliance.

 

The court’s order

On the XXX date, the above claim was allocated to the small claims track and the Court gave notice that it considered that the claim is suitable for determination on the papers and without hearing.

In the same order at paragraph 3b. the court invited the parties to make their objections to the court’s finding that the case is suitable for determination on the papers.

 

The claimant’s objections

The defence document does not address the claim

The defendant’s defence document has not addressed the claim either generally or in its detail.

In particular, the defence does not address or deny the claimant's allegation of breach of statutory duty at all.

The failure by the defence to address or deny the claimant's allegation of breach of statutory duty can be taken to be an admission, particularly in light of the fact that they have chosen only to challenge the amount claimed.

Furthermore the defence document makes references to matters not contained in the claim at all and are wholly irrelevant to the claimant’s allegation that the defendant has committed a statutory breach of duty.

The defence document was apparently drafted on 6 March 2021 a full 10 days before the claim was even issued in the County Court.

The defence was drafted by John Boumphrey who is believed to be a barrister-at-law.

The defence was eventually signed as a statement of truth on 15 April 2021 by an unidentified solicitor but it is not clear how the unidentified solicitor signatory was able to sign a statement of truth referring to a defence document which had been drafted by barrister John Boumphrey even before John Boumphrey and the unidentified solicitor could have seen the claimant’s particulars of claim.

It would appear that neither barrister John Boumphrey who drafted the defence or the unidentified solicitor who signed the defence as a statement of truth had ever had sight of the claimant’s particulars of claim at the time that they constructed their defence.

The only reference to the claimant’s particulars of claim are two oblique references contained at paragraph 1 and paragraph 11 of the defence document. Paragraph 11 appears to be an objection to the amount claimed by the claimant.

 

 

Seriousness of the issue

Breach of Statutory Duty: The claim against the defendant concerns a breach of statutory duty which is a serious matter and which requires the defendant to make their own representations because a finding against them would then mean that they have a statutory duty to inform the Information Commissioner’s office.

The claimant has already obtained two previous judgements against the defendant for similar breaches of statutory duty in respect of separate failings to satisfy Subject Access Requests under the Data Protection Act.

Both of these judgements were obtained without any engagement from the defendant and the judgement sums have been satisfied by the defendant without any objection from them.

It is believed that in neither of the above two cases has the defendant complied with their duty to inform the Information Commissioner about their statutory breaches.

It is clear from the defendant’s own disregard for the statutory rights of its customers and of data subjects generally, and of their failure to inform the Information Commissioner of their statutory breaches that they have scant regard for the duties imposed by the Data Protection Act.

It is submitted that this on its own means that the matter is not suitable for a hearing on the papers.

Despite the issue of a court claim, the defendant has still made no attempt to comply with the claimant’s request for statutory disclosure of his personal data.

The serial nature of the defendant’s statutory breaches and continuing failure to disclose data have increased the level of distress experienced by the claimant.

It is respectfully pointed out that distress is a recoverable head of damage under data protection legislation and it is significant that the defendant has not challenged this principle in their defence.
In fact the defendants have themselves acknowledged in paragraph 1 of their defence that the size of the claimant's claim is for a very modest sum.

The casual handling of the claimant statutory request together with the casual and incomprehensible way that they have treated this claim – even to the extent constructing a response even before they were aware of the particulars of claim has added to the difficulty.

 

The Defendant's Request to Strike out the Claim
The Defendant has sent the court a letter dated 25 May 2021 asking the court to strike out the judgement.
The claimant has already provided the court with a response to this letter and a further copy is attached to these objections.

In conclusion

For these reasons amongst others, the claimant respectfully requests that this claim be listed for a remote hearing.

 

In compliance with the order of the court, I have sent a copy of this document to the defendant using their email address XXX@XXX on XXX date.

Statement of truth

 

 

[BankFodder]

I'm having slight second thoughts about pointing out the conflict between their paragraph 11 and paragraph 1.

Please don't send anything off yet but we certainly do need to have your comments on this.

 

[BankFodder]

Quantum is exactly that, the amount of money which is being claimed.
Recoverable head of damage = category of damage. The law doesn't allow some categories of damage to be compensated. You probably heard of "consequential loss" – where you have to weigh in for a central heating repairer who doesn't show up and as a result you are unable to attend an appointment and so you lose a job for you are unable to enter into a contract. Those are  consequential losses and they're not recoverable.
Damages for distress are not normally recoverable unless you can show that that distress has resulted in some foreseeable economic loss – which is not the case here.

However, since the case in a few years ago involving Google, the court held damages for distress caused by a data protection breach were recoverable even though they were not associated with any discernible economic loss.
This actually brought the UK into line with Europe in terms of assessing whether compensation should be available for pure distress.



I'm anxious to keep the narrative/issue focused on this particular SAR breach. I think that there has been sufficient reference to the other breaches and we don't want to labour the point and make it part of this litigation. I've referred to the fact that they are serial breachers but I don't want them eventually trying to tell the judge that you had enough money already on the previous two breaches and you don't deserve any more for a third.

 

In terms of the action from the ICO, – you may already have told us about it on this thread, but maybe you could just explain it again.

He said that the ICO has ordered virgin to give you some explanations. Did the ICO find out about this because of your contact with them or because of virgin's contact?

Maybe you could just go through the chain of events

[BankFodder]

I've made some edits to the document which I posted above.

Your objections have to be emailed to the court and to the defendant by 4 June. I think we should leave it as late as possible but I always feel a bit worried about sending it on the final day.

What email address are you going to use for virgin?

[BankFodder]

Please will you post up a copy of this letter in pdf format

[BankFodder]

 

In respect of their failure to comply with the order from the ICO, please will you write to the ICO immediately and complain that despite the order made by the ICO dated XXX, virgin have failed to comply either with the instruction to put things right or with their data protection obligations.
Please do that immediately so that we have a copy for the court.
 

In respect of the letter asking for the strikeout, I think we have to respond to that immediately – but we will also attach a copy of it to the objections which we are preparing in order to ask for a remote hearing.

 

[BankFodder]

Okay, please have a look at this – lots of dates et cetera to fill in. Needs to be very careful not to confuse dates and to make sure that it all makes sense and represents what actually happened.

We will need to send this off PDQ – probably tomorrow or Thursday morning.
I think in view of this we will need to send the objections off by the end of the week as well.

 

Quote

Response to the defendant’s request to strike out claim number XXX.

(In addition to a request that the matter be heard by means of a remote hearing – said request to follow shortly)

 

I am writing in response to the defendant’s request to strike out claim number XXX.

I object to the defendant's request.

the defendant has already filed a defence without any reference to a dismissal of the claim so clearly they must believe that the claim has some substance.
The defendant’s account of the events and the actions which have been taken against them in respect of their various breaches of the data protection rules, are completely confused and inaccurate.

It is difficult to come to any conclusion other than the fact that the defendants data processing is in chaos and that itself is  a breach of one of the Data Protection Principles.

It is significant that the defendant’s application to strike out is not signed as a statement of truth by a solicitor who identifies herself as Nicola Smith.
It is noted also that the defendants request to strike out does not comply with the proper procedure in that it has not been made by way of an application notice and it is believed that no fee has been paid.

Separately I will be submitting objections to the court’s order of the XXX date that the case be heard on the papers and I shall be requesting a remote hearing.

However, the current claim – number XXXX is a third and completely separate data protection breach in which the defendant failed to comply with a subject access request dated XXX date.

The claimant takes this opportunity to remark that it is objectionable that the defendant now claims that they satisfied a warrant simply because of the economics of the matter.

This amounts to an abuse of process to suggest that there was a judgement against them but which was unfairly granted and that they simply didn’t object because it was more cost efficient to go along with it.

There exists a proper procedure for challenging unfair judgements and that procedure is not simply to pay some money to make it go away.

It is hoped that the court will express its displeasure at this treatment of the court process.

The claimant also takes this opportunity to point out that in respect of the data breaches of XXX date and XXX date in respect of which claim numbers XXX and XXX were issued in respect of which judgements were granted, the claimant then submitted those judgements to the Information Commissioner’s Office as part of a formal complaint.

The information Commissioner on XXX date ordered the defendants to contact the claimant and to explain to him how they intended to put things right by meeting their obligations – or else to explain to the claimant how they had already met their data protection obligations.

To date, the defendants have failed to comply with the order of the Information Commissioner and another complaint has been made to the information Commissioner in respect of the defendant’s continuing disobedience to the order.

I am confident that when the court receives the disclosure bundle which I am currently assembling, that the court will see a logical paper trail in respect of three serial breaches of the data protection regulations, together with comprehensive attempts to communicate and to comply with pre-action protocols.

For these reasons, claim number XXX should not be stuck out and in fact should be the subject of a remote hearing on a date to be decided by the court.

 

Statement of truth

 

 

It should be sent using the same type of heading et cetera as their letter – but you won't be signing it love and kisses – Nicola. She seems to be on rather casual terms with the court.

https://www.linkedin.com/in/nicola-c-e-smith-81836036/?originalSubdomain=uk

Sign it as a statement of truth

also, the paragraphs need to be numbered so once we have got it right, it needs to be put into a Microsoft Word document with paragraph numbering. The same with the objections.

As usual, check it for typos or nonsense because it has all been dictated using software and I haven't really checked it very closely

Edited May 27, 2021 by BankFodder
Edits in red

[BankFodder]

I think I should also point out that you really do need to have the whole story very clear – and be able to show very easily and convincingly how confuse they have become about the whole thing.
I am quite sure that it is virgin which is in disarray and eventually they will have lots of egg on their face – but bear in mind that as it is you who are asking for the remote hearing – which I think is absolutely the correct course of action – if it turns out that your account of the chain of events is at all flawed, then there is a risk that they could ask the court to exercise its exceptional discretion to award costs against you.
On the other hand, they are making such a mess of everything, that as long as you have got all your ducks in a row and your documentation is very clear and tells the story without any doubt, then I think you are equally in an excellent position to ask the judge to award litigant in person costs to you on the basis that virgin's disorganisation has created unnecessary litigation and unnecessary inconvenience to you and to the court.

 

 

Assuming that you are able to obtain a remote hearing – and I expect that you will – then you will need to organise your court bundle very carefully and effectively it will fall into three files – one for each SAR.
But of course, you must be very careful not to allow this most recent data breach to be drawn into a general discussion about all of their data breaches. Each one is separate. They must not be connected – especially when it comes to assessing damages.

[BankFodder]

@lemon_martini2

Will you manage to get the response to their strike out request off today?

[BankFodder]

That's true – but it has happened a few times. We had several occasions where companies have managed to obtain strikeouts make other request simply on the basis of a letter that in fact should have been an application notice.

Only recently have I noticed on two occasions that applications have been refused because they haven't been made in the proper format.

There's no downside to sending the strikeout response and certainly even with a small risk that the judge might accept the letter, it will help to avoid the difficulty and complication of then having to make our own application notice – with a fee – to restore the case.

 

[BankFodder]

When you send it into the court, I suggest that you send it asking for an email receipt and maybe even a read receipt.

I'm afraid I would probably send it to 3 times just in case it gets lost. The county courts are inefficient at the best of times and at the moment there are chock-a-block. Maybe send one without a receipt request either.

Any doubts – 

 

 

[BankFodder]

Yes, we would prefer that you put up a redacted final version of the document that you are going to send off. This will be helpful to others.

I have added a couple of lines to the strikeout application – in red. Please see above.

Also, in the version you have sent to me, you have not used the Microsoft Word paragraph numbering system and it would be better presented if you did because that system gives a better sense of space and makes the document more readable. To forget that these judges have lots of reading to do and not a lot of time.

Also the version which you have emailed to me still contains our auto links and you will need to remove these by hovering over them, clicking your right mouse button and then "remove hyperlink".
I see also that you haven't given the statement of truth. You have simply copied out my words "statement of truth". You are intended to actually write out the statement of truth paragraph. You have an example on the defence document which you received from virgin. This is important to do. – Especially as you have remarked that the strikeout application does not contain a statement of truth at all.

Please will you post the eventual redacted final version. – But it needs to be sent off today

I'll have a look at the objections to the hearing on the papers and get back to you

 

[BankFodder]

The remote hearing document looks all right – except that you haven't used Microsoft Word to number the paragraphs, you have left in the auto links and these need to be removed and also you haven't typed out the statement of truth at the bottom.
They must bear a statement of truth
Don't forget that both these documents will need to be signed – at least by typing your name at the bottom

 

[BankFodder]

Better send a copy to Nicola Smith - I suppose that it could go on Monday.  Then maybe Wednesday - send the request for remote hearing and copy to our Nicola

[BankFodder]

Maybe we should send them some more sar's

At 300 quid a pop it's a pretty good little earner

[BankFodder]

A very lazy attitude from the ICO. Frankly if I were you I would send them a message telling them that their laid-back complacent attitude is completely unacceptable and that you will tell them when there has been compliance. Furthermore, they should require from virgin confirmation that there has been compliance and a copy of whatever they have done to comply.

 

[BankFodder]

It's all quite extraordinary.

I suppose the only thing one can do is to keep on storing it all up and include it in the general story of incompetence and mismanagement of your account and mismanagement of data.

There is certainly inaccurate data processing going on and that is another data protection breach which might be worth a pop at later on.

I suppose the payments that you made in December/January 2020 relate to your valid phone account and the arrears that they are identifying relate to the phantom account. Might that be correct?

I suppose we haven't heard anything more from the court since you filed your objections to deciding it on the papers.

[BankFodder]

It's been nearly 2 weeks else's the deadline for objecting to the order to decide on the papers.

I think it might be an idea to start telephoning the court to check what has happened. The courts often make mistakes and it would be a good idea to make sure that the objections have been overlooked.

Nothing to lose by doing this

[BankFodder]

Please have a read of our guide on how to prepare your court bundle

[BankFodder]

Can you tell us where you are in respect of complying with the recent court order?

Most of the steps are mere formalities but have you complied with step 5 and step 6 (I've numbered the steps in your earlier post).

Have you started to prepare your court bundle as in step 7?

I think we should be preparing a skeleton argument.

 

[BankFodder]

You should include in the bundle anything that you propose to rely upon in court.

If the conversation you have had are relevant then you should certainly include something relating to them in your bundle. I think putting together a transcript is going to be very onerous for you and so I would suggest that if you are going to use any recordings that you try simply to make some notes of what has been said and use that as the document.
Then I would send a copy of those notes to the other side as quickly as possible and say to them that in order to avoid the necessity for getting a transcript and to avoid the cost of the transcript which will be added to any costs that they will be liable for when you get judgement, you have made the following notes in respect of the recording on XXX date and do they want to disagree with your interpretation of the call.

If they don't respond or if they agree, then you can simply mark the notes as "agreed by defendant".

In the same email to them you can ask them that if they disagree, could they please explain in what respect they disagree. Explain to them that if necessary you will play the recording to the judge.

If this becomes necessary then I would suggest also in your notes of the call you put the timing so that you know whether a particular comment is made is 3 minutes 40 seconds or 5 minutes 6 seconds in et cetera.
Also, you better have some kind of machine which is capable of playing the calls at a reasonable volume and if you have to include recordings then you will have to supply them to the court on a USB stick.

The court was only allowed one hour for the hearing but it seems to me to be a fairly optimistic estimate. Also – note that you are prioritised. It will only be if the timeslot becomes available.

When you supply the bundle to the court and to the other side, include your notes of the call – each call on a separate piece of paper with the date and inserted in the appropriate place in the bundle. I hope you seen my notes on preparing the court bundle. Include a USB stick for everyone