Can You Claim For An Internal Email Data Breach?

Certain parties have a legal responsibility to protect your personal data. The applicable laws are the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA).

These parties are:

Data controllers – those who choose when (and how) your personal data is processed.
Data processors – those who process your data on behalf of the data controller.

In some cases, data controllers will process your personal data in-house and there won’t be an external data processor.

The Information Commissioner’s Office (ICO) is an independent body that acts to uphold your rights and to ensure that the laws listed above are adhered to.

Failure to comply with data protection laws by either the data processor or controller could lead to a personal data breach.

According to the ICO, a personal data breach is any type of security incident where your personal data’s availability, integrity or confidentiality is impacted.

If you wish to claim for an internal email data breach, it must be proven that:

Either the data controller or processer failed to protect your personal data in line with the UK GDPR and the DPA
That failure to comply caused your personal data to be exposed in a data breach; and
As a result, you have suffered financial losses or mental harm.

If you believe you’ve been the victim of an email data breach and suffered as a result, why not call our team for advice on your options?

How Could An Internal Email Data Breach Happen?

There are several ways in which your personal information could be exposed by an internal email data breach, including:

When a hospital emailed its monthly employee newsletter, it contained an attachment of your medical records.
A file containing your disciplinary record was sent to finance in an email error.
The bank accidentally emailed your statement to a number of different colleagues in an error rather than sending it directly to you.

Remember, if you want to make an email data breach claim following an internal email error, you must be able to prove that the incident occurred because the data controller or processor failed to adhere to data protection laws, and this caused you to suffer financially or emotionally.

To discuss your potential internal email data breach claim, please contact our team today.

What Should You Do If Your Personal Data Has Been Exposed By An Internal Email Data Breach?

If an internal email data breach has exposed your personal data, you should first try to find out what information has been compromised. Although you may have been informed about the breach by the organisation responsible, further correspondence can be helpful and potentially support any compensation claim.

In the event that the response isn’t adequate or forthcoming, you can complain about the breach to the ICO. This complaint should be made within 3 months of the last meaningful contact you had with the organisation. The ICO may then approve an investigation of the data breach and potentially issue a fine to the organisation.

To support your internal email data breach claim, you’ll need evidence. Some examples of this include:

Your data breach notification letter or email, if you received one. Other correspondence relevant to your claim can also be used as evidence
A list highlighting what personal data was compromised in the breach
A copy of your report to the ICO, together with the findings of any investigation
Your medical records, providing insight into the psychological harm you suffered
Documents covering your financial losses

Our solicitors have extensive experience helping obtain evidence on behalf of their clients. If you’d like to find out how one of them could assist your claim for internal email data breach compensation, please contact our advisors.

Data Breach Claims – Compensation Payouts

If you make a successful internal email data breach claim, you may receive compensation for your:

Material damage: Financial loss caused by a breach
Non-material damage: Anxiety, post-traumatic stress disorder (PTSD), and stress due to a data breach

To help assess non-material damage, your solicitor may refer to the Judicial College Guidelines (JCG). The JCG contains compensation guideline brackets for various types of harm.

Our table below uses data from the JCG. Please note that the included brackets are not a guarantee of compensation or data breach claim values.

Compensation Table

The first entry of the table was not taken from the JCG.

Harm	Category	Compensation Guidelines	Detailed Information
Severe and multiple instances of psychological harm plus financial losses.	Severe	Up to £250,000 plus	The claimant experiences multiple forms of severe psychological harm and financial impact, such as lost earnings.
General Psychiatric Damage	Severe	£66,920 to £141,240	Marked problems and a very poor prognosis. Bracket will consider factors like future vulnerability, effect on relationships, and the ability to cope with work.
	Moderately Severe	£23,270 to £66,920	The claimant will suffer significantly with the factors listed above, such as impact on relationship with family and friends, but their prognosis will be more optimistic.
	Moderate	£7,150 to £23,270	Although claimant may have had problems seen in the above brackets, there will be a marked improvement and a good prognosis.
	Less Severe	£1,880 to £7,150	The amount awarded here will depend on how long the claimant was affected, together with extent of impact on daily activities and sleep.
Post-Traumatic Stress Disorder (PTSD)	Severe	£73,050 to £122,850	PTSD symptoms in this bracket will be permanent and affect every aspect of the claimant's life badly. They will not be able to work or at least have the capacity to function as they did before the trauma.
	Moderately Severe	£28,250 to £73,050	Prognosis is better due to some recovery (with professional support). However, the PTSD will likely still be a source of significant disability for foreseeable future.
	Moderate	£9,980 to £28,250	Where the claimant has largely recovered. Any ongoing PTSD symptoms won't be seen as grossly disabling.
	Less Severe	£4,820 to £9,980	Only minor symptoms will continue after an almost complete recovery within 1 to 2 years.

Material Losses In An Email Data Breach Claim

Material damage is the financial loss linked to the data breach.

For example:

Any income you’ve lost because of the time you had to take off from work
The cost of moving or investing in extra home security
Access to therapy if you suffered psychological harm due to the breach

These losses will need to be proven, so you should supply financial records such as wage slips and bank records.

To find out if you could claim compensation for an internal email data breach, why not speak to us today?

★★★★★

Chat With Us Today

✓ 100% No Win No Fee

✓ Our expert solicitors have over 30 years of experience

✓ Call for a free no-obligation consultation

Start Your Claim Call Us Free

What Steps To Take After An Email Data Breach To Make A Claim?

After an email data breach, there are several practical steps that you could take to ensure your safety, strengthen your evidence, and secure your legal position. As such, you could take the following measures:

- Step 1 – Confirm That A Data Breach Has Occurred. You should check for notifications from your organisation that your personal data was involved in a data breach; this will typically be via letter or email.
- Step 2 – Get Medical Attention If Needed. If the data breach causes you mental distress, it’s always best to seek medical treatment. Not only can this help your recovery, but it will also help to create official medical records of the harm you suffered due to a data breach.
- Step 3 – Gather Evidence Of The Breach. You should keep a record of the breach notification, screenshots of suspicious activity, and the findings of an ICO investigation concerning the data breach.
- Step 4 – Document The Impact Of The Breach. You should keep a symptoms diary to record your day-to-day mental distress caused by the breach. This should also detail any treatment you received, and any financial losses caused by the breach, such as lost earnings and therapy costs.
- Step 5 – Seek Legal Advice About Making A Claim – By connecting with a specialist data breach solicitor, you could obtain expert advice about your claim’s prospects and compensation estimate. Most firms offer free consultations, so there’s typically no obligation.

To discuss your personal experience with one of our advisors, please contact us today.

Can I Make An Email Data Breach Claim On A No Win No Fee Basis?

Call our advisors now for a free case assessment. If they can see that you have good grounds, they could connect you to a No Win No Fee solicitor to manage your data breach compensation claim.

Our solicitors use a specific type of No Win No Fee contract called a Conditional Fee Agreement (CFA).

The CFA means that:

There’s no requirement to pay any solicitor fees upfront or as the claim progresses.
If the claim is lost, you aren’t charged a solicitor’s fee.

Should you win, your solicitor will deduct a success fee from your compensation for their services. This is taken as a capped percentage, meaning you keep the majority of the compensation.

To see if you could be represented by one of our No Win No Fee solicitors for your internal email data breach claim, you can:

Call us on 0161 509 2856 to discuss your case.
Use our 24/7 online chat service.
Contact us here to arrange a callback.

Frequently Asked Questions

To discover more about internal email data breach claims, please see some common questions and answers below. For further help and assistance, please feel free to get in touch with our advisory team.

What Is An Internal Email Data Breach?

An internal email data breach is a security incident involving the accidental or unlawful sharing of personal data within an organisation through email. For instance, an employee of a company could accidentally attach an email containing the sensitive medical information of a staff member to a mass email.

Do Organisations Have To Report An Internal Email Data Breach?

Yes, organisations must report an internal email data breach to the Information Commissioner’s Office (ICO) within 72 hours if it poses a risk to individuals’ rights and freedoms. If the breach is unlikely to result in a risk, it does not need to be reported to the ICO; however, it may need to be documented internally.

Can You Claim Compensation For An Internal Email Data Breach?

Yes, you could claim compensation for an internal email data breach if the breach resulted from an organisation’s failure to follow data protection laws; you must have suffered financial loss and/or psychological harm as a result, such as stress or depression.

What Personal Data Is Commonly Exposed In Email Breaches?

Commonly exposed personal data in email breaches typically includes names, contact details, addresses, financial information, employment records, national insurance numbers, disciplinary reports, and medical information.

To ask further questions about internal email data breach claims, please don’t hesitate to get in touch with our team.

Learn More About Claiming For Email Data Breaches

Here are a few external links that might be useful:

Advice on getting help with stress from the NHS.
Details on how to make a complaint to the ICO.
How to find out what data an organisation has about you.

Please let us know if you’ve any further questions about internal email data breach claims.

Meet the Team

Gemma Shields

Chartered Legal Executive | Road Traffic Accident Claims Specialist

Gemma Shields is a CILEx qualified legal professional with over a decade of experience in road traffic accident claims, including pedestrian, cyclist and motorcyclist cases. She provides clear, compassionate legal support to clients across England and Wales.

Can You Claim For An Internal Email Data Breach?

Chat With Us Today

Jump To A Section