Changes to Civil Procedure Rules - privacy and data protection claims

The Ministry of Justice has announced changes, coming in on 1st October 2019, to the Civil Procedure Rules. These relate to the rights of data subjects to claim damages for breaches of data protection and privacy legislation.  Rather than only applying to defamation cases Court Rules Part 53 and the pre-action protocol will be amended and become applicable to any case that includes a claim for misuse of private information, data protection or harassment by publication.



Pre-action will need to include significantly more detail than previously. In practical terms this means that pre-action letters for a claim relating to data protection will need to include the following:

  • The identity of the data subject;

  • The data controller to which the claim is addressed;

  • The information claimed to constitute personal data;

  • Details of the relevant processing;

  • Identification of the duty(ies) breached and details of the manner in which they have been breached;

  • Why the data ought not to be processed;

  • Nature and details of damage caused; and

  • The basis of any group claim if one is being made.


The changes also specify an obligation on all parties to ‘act reasonably to keep costs proportionate to the nature and gravity of the case and the stage the complaint has reached’.


The role of the High Court - The Media & Communications List

The Rule changes have also established a specialist List of the High Court (The Media & Communications List), meaning that any claims relating to data protection or misuse of private information, brought in the High Court, must be brought in the High Court in London. This means that any claims issued in courts elsewhere in the country will be transferred to London and this brings with it further rules about what the statements of the case must contain and how to deal with cases transferred in and out of that list). 


This brings a number of challenges - not least in terms of increasing costs for both sides. Similarly, while it would still be possible to bring a straightforward, low value claim in the County Court, this could open the door procedural battles between Claimants, who want to issue in the High Court (to increase the chances of cost recovery) and Defendants (who want to limit costs by staying in County/Small Claims Court). These arguments could well lead to an increase in costs and drag out the length of time cases take further.


Time will tell what impact these changes will have. It is expected that they will be positive for larger cases but add cost and complication for smaller claims. This may, in turn, disincentivise data subjects considering bringing claims for damages relating to data breaches.