Why a data breach resulted in £40,000 compensation

My client Catherine was the victim of a serious sexual assault (stranger rape) which was subsequently investigated by her local Police Force, and shortly thereafter, the perpetrator of the rape, “D” was arrested and remanded into custody.

Thereafter, an unredacted bundle of evidence, which had been assembled by the Police, was disclosed by the CPS to D (who was being held on remand in prison).  Included amongst this disclosure was Catherine’s full name and home address.

On discovering this ‘mistake’, the Police made contact with Catherine, although they didn’t initially admit their own instrumental role in what had happened, merely telling Catherine that “somehow” her name and address had been disclosed to her attacker.  The Police then sought to alleviate concerns as to Catherine’s personal safety by fitting an emergency alarm at her home address (where she lived with her mother and younger siblings) and also giving her a ‘rape alarm’ device to carry around with her; however, she was so shaken and disturbed by this revelation that she actually crashed her car on the way home from work the following day, fortunately avoiding serious injury.

Then, only weeks later, Officers came to visit Catherine at her place of work to give her further information about the disclosure of her sensitive personal data; Catherine was now told that D had written a letter to the Police, telling them that he was in possession of sensitive documents, and making abusive comments about her – which had prompted a search of his cell, and recovery of the documents.

In the months following the rape Catherine had been trying to get her life back to normality; however, these data breach revelations set back her recovery significantly, by causing her terrible concern about the safety of herself and her family.  Although D was in custody, Catherine feared that he could have passed on information to someone outside of prison and that they might seek to intimidate and/or assault her and her family, in the run-up to the trial (in which D was pleading not guilty). She felt as though a “bombshell” had gone off in her life and that she could no longer trust the Police to fully protect her; indeed, she felt that they had ‘exposed’ her and given the rapist control back over her.

Catherine felt that she couldn’t trust anyone and began to suffer flashbacks to the rape, and recurrent dreams in which she was being threatened.  Furthermore, as a direct result of the risk which the Police now believed her to be in, Catherine and her family had to hastily relocate to another address, leaving behind the family home in which she had grown up.

In other words, what the Police and CPS had done, had stripped away the security and comfort of the one refuge where she should have been able to feel entirely safe and protected – her family home – and turned it from being a place of healing into a place of danger where her attacker might be able to find her, either now or in the future. The only way to resolve this risk was therefore the massive upheaval of Catherine and all of her family moving to a different location, in circumstances which Catherine and her mother were reluctant to fully explain to Catherine’s younger siblings.

This relocation could not in itself alleviate Catherine’s concerns for her safety, given the details which her attacker had been made privy to about her; and all of this added massively to the stress which burdens any rape victim who is facing the tortious process of a criminal trial to try and ensure that her attacker stays behind bars.  Catherine felt anxious and panicky most of the time, unable to relax at home (even in the new house) and frequently checking that doors and windows were secure.

Just over a year after Catherine’s rape, D was convicted of that offence, having changed his plea to guilty a day before the trial.  He received a mandatory life sentence, though Catherine knew that was not a guarantee he would never be released – and she continued to fear that he could track her down and harm her by means of an associate outside of prison.

The combined efforts of these events led to Catherine having to seek psychiatric treatment, and to suffer so much stress that she quit her job, experiencing a (thankfully temporary) period of unemployment. Thereafter, she found herself having to embark on a new career in a different, less satisfying line of employment.

Catherine brought a claim against both the Police and the CPS. This was on the basis that the unredacted evidential material containing Catherine’s personal information, had been first assembled by the Police and then disclosed to D by the CPS (via D’s criminal defence solicitors).

Remarkably, both the Police and CPS disputed liability and it was only a few weeks before the scheduled trial of the claim that the Defendants jointly settled Catherine’s claim in the sum of £40,000 damages plus legal costs.

My client’s name is changed.

Also read: Rape victim awarded £40,000 damages for Police Data Breach