QOCS protection at court's discretion in mixed data breach claims

United Kingdom

The Court of Appeal has confirmed in Andrea Brown v (1) Commissioner of Police of the Metropolis (2) Chief Constable of Greater Manchester [2019] EWCA Civ 1724 that qualified one-way costs shifting (QOCS) protection is not automatic for “mixed claims” such as data breach claims involving a claim for personal injury along with other causes of action.

The appeal concerned a claim for the misuse of private information under the Data Protection Act 1998, and for personal injury for the depression that followed the incident, among other causes of action. The claimant was awarded damages for the misuse of her private information, but the claim for personal injury was not successful. Overall, the claimant did not beat the defendants’ Part 36 offer, so was potentially liable for the defendants’ costs from the expiry of their offer. The claimant asserted that even though the claim for personal injury was unsuccessful, she was protected by QOCS and only liable for costs up to the aggregate amount of damages. The judge at first instance agreed, but this was overturned at the first appeal.

The claimant appealed to the Court of Appeal, but the Court of Appeal dismissed the appeal. A claim for personal injury only, which would include consequential financial losses such as loss of earnings or the cost of care flowing from the injury, would benefit from QOCS protection. However, under the exceptions in the Civil Procedure Rules, if a claim included elements not related to the personal injury, such as a claim for property damage, or for breach of a statutory duty such as the Data Protection Act, then QOCS did not automatically apply. The Court of Appeal described this as a “mixed claim”.

The Court of Appeal recognised issues inherent in this interpretation, such as the exclusion of standard RTA claims where a claim for damage to the vehicle is commonly made along with a claim for the injury suffered from the RTA, and also the potential for spurious personal injury claims to be made in order to benefit from QOCS protection. The Court of Appeal highlighted the court’s discretion within the relevant CPR provisions and the need to take into account all of the circumstances to arrive at a fair and just position on costs between the parties. If proceedings could be described as a personal injury claim “in the round”, then a minor non-personal injury element, such as a claim for breach of the DPA alongside a claim for psychological injury arising from a data beach incident, should not prevent QOCS from applying. Conversely, if it was considered that a personal injury claim was merely tacked on with the purpose of attracting QOCS protection to a mainly non-personal injury claim, this would not attract QOCS protection.

Parties considering a claim will need to consider to what extent they would benefit from QOCS protection if claims are made based on mixed causes of action.Defendants in a mixed claim should be aware of the potential to recover costs if QOCS does not automatically apply.