Virgin, mystery extra line: 2 judgments for Data Protection breaches - so far!!

[BankFodder]

Okay. Here is my view as to what has happened.

There was a rogue employee who accessed your personal details – and maybe the personal details of other people to set up fake accounts and to steal the telephones.

 

[lemon_martini2]

Received and replied to. I have now to reply to Virgin's defence by May 4 stating whether I want it to go through small claims or another track and whether or not I agree to mediation(which I think should pretty much be a given to agree to).

[BankFodder]

Presumably this is in response to the DQ – but I wasn't aware that you have to file a reply to a defence in a DQ

 

[lemon_martini2]

I've sent over the details requested but I'm having another issue that I can't seem to get my brain around.

 

Having deciding to reissue the original warrant that was unable to be served in Sunderland as 'the address did not exist' I checked with the county court as to why they couldn't seize any goods when there was clearly a building at the site.

 

Apparently,this problem is well known to them.It transpires:

* The physical building on the site belongs to Virgin and contains their goods and property-this is an SR4 address.

*The registered address for service of documents and letters,including court papers is an SR43 address. This is just a mailroom within the building.

*Since the warrant was issued for the SR43 address, they were only allowed to take goods from that specific address(the mailroom)-which contains nothing except a very large mail cabinet.

 

How is it possible to have this address-within-an-address? Surely I couldn't give my address as being 1a and then when bailiffs turn up, tell them 1a only refers to the mailbox in the porch and the rest of the house is actually No.1?

[unclebulgaria67]

Many large companies have a postal address that purely relates to mail room and not their actual offices. One reason for this , is that it separates customer post from post about the running of the building/company.

[lemon_martini2]

Virgin have submitted their DQ answers and interestingly have said they are not willing for the case to go to mediation. They have also said that they will be calling only one witness. If that's not the person who received the SAR requests and processed them they can't comment on that surely? And if it's not the person who actually signed me up and set up the contract then they can't comment on that either?

 

And l was aware that they use a separate room for post-what l was querying was that if bailiffs turn up they can claim the mail room as a separate address so only goods from in that room can be taken.

Edited May 4, 2021 by lemon_martini2
Adding bits

[BankFodder]

Thank you.

Have you submitted your directions questionnaire?

The next step will be that a date will be set for a hearing and there must be an exchange of documents about 21 days before then. When we know the hearing date then we can start to prepare.

Of course based on their defence, they are trying to introduce issues which aren't all included in your claim. Quite frankly their defence is a lot of nonsense and as far as I can make out the only thing which refers to your claim is their last paragraph which disputes and puts you to proof as to the amount of money you are claiming. Other than that, their defence seems to relate to the substantive dispute – which of course you have not started to litigate on at all yet.

You will need to make sure that you start bringing together all of your documents. Identifying what you have – also identifying what you don't have an yet you believe exists. Have a look at the advice we give on preparing your court bundle.

Also, although it shouldn't come up at this point because it is not the SAR issue, I've already pointed out to you that we will need to get some very good documentary evidence of your signature changes and your practice of changing your signature every year. I'm sure you realise that this is an extremely unusual thing to do and although this issue should not come up at all in the forthcoming hearing, it may be referred to at some point and we will have to decide whether to address it or simply say that this is not one of the issues which has been raised in your claim. I favour the latter

 

[lemon_martini2]

Small update-confirmation letter from Reading Court that the first warrant(that we initially tried to execute in Sunderland) has been transferred and was issued on 4 May.Hopefully a cheque for the amount of £300 will again be winging its way to me soon...

[BankFodder]

Luvly jubbly

[lemon_martini2]

You're going to love this-letter from Oxford County Court confirming a cheque for £302 has been received from Virgin Media in response to the first warrant.

That's a payment made on a case they claim in their defence has no merit and they want thrown out, not to mention that they've now paid £600(so far!) for a £200 handset claim

 

So far we have

Claim 1 for failed SAR requests: Not defended, judgment issued, warrant executed, £302 paid.

Claim 2 for failed SAR requests: Not defended, judgment issued, warrant executed, £302 received by court.

Claim 3 for failed SAR requests: Defended.

 

 

[BankFodder]

They will probably say in relation to this latest SAR claim, that you have been sufficiently recompensed because of the previous two.

They will try to merge the three actions together as if they were one. In exactly the same way that they are trying to merge this latest SAR claim with the whole problem of the mystery handset.

It will be very important not to allow them to stray into that territory.

It's essential to keep to your agenda which is their breach of this SAR and the distress that you are suffering as a result of this particular breach. Distress caused by anything else including the setting up of the mystery handset account are completely different and they mustn't be allowed to try and bring them into the equation

[lemon_martini2]

We have a development and I'm afraid I don't have the specialist knowledge to know quite what it means,so some help untangling the legalese to work out what it's saying and what the next move is would be muchly appreciated:

 

I have received a General Form of Judgment or Order from Exeter County Court stating:

 

'The court noting:

*The Guidance of the Lord Chief Justice dated 23rd March 2020 paragraph 6 that hearings requiring the physical presence of parties(the claimant/defendant etc.) and their representatives and others should only take place if a remote hearing is not possible and if suitable arrangements can be made to ensure safety

*The Protocol regarding remote hearings dated 20th March 2020 paragraph 1 that the Covid-19 current pandemic necessitates the use of remote hearings wherever possible and that this protocol applies to hearings of all kinds including trials,applications and those in which litigants in person are involved in the County Court

And the court informing 

*The parties that the relevant rules of court are contained in Civil Procedure Rules("CPR")Part 3.3 which are available at https://www.justice.gov.uk/courts/procedure-rules/civil/rules/part03 and CPR part 27 and in particular 27.4,27.9,27.20 and 27.11 which are available at https://www.justice.gov.uk/courts/procedure-rules/civil/rules/part27 

 

It is ordered without a hearing that:

1.The claim is allocated to the small claims track

2.Pursuant to the power to do so in CPR Part 27.4(1)(e),the court gives notice to the parties that it considers the claim suitable for determination on the papers without a hearing as permitted under CPR Part 27.10 if all parties agree to this

3.The parties must notify the court by email to [email protected] and every other party by 4pm on 4 June 2021

3a.If they agree to a paper determination,in which case the court may determine the claim without a hearing pursuant to CPR Part 27.10,but before agreeing,be aware that if a party agrees to this,then pursuant to CPR Part 27.11(5),no application can be made to set aside the judgment of the court and the outcome can only be challenged by appeal under CPR Part 52,which requires the permission of the court.

3b.If they do not agree with a paper determination,then they must state their reasons,after which a judge will decide without a hearing whether the claim is suitable for some form of determination at a hearing where the parties are present remotely(eg by telephone,Skype for business or some other similar platform)or whether the claim should be deferred until after the Covid-19 restrictions have altered sufficiently to permit a hearing at which the parties attend in court.

4.Because this order has been made without a hearing,any party may apply pursuant to CPR Part 3.3(5) to have this order set aside,varied or stayed.A party wishing to make an application must send up or deliver the application to the court,together with any appropriate fee to arrive within seven days of service of this order.

 

 

 

[BankFodder]

It basically means that the court is saying that the case is suitable to be heard simply on the papers – and that means that there will be no representations from either side other than what has been submitted on paper and the court make a decision based on the documents before it at the time.

This would allow you to submit further documents – such as a reply to the defence – and for the judge to make the decision based on that.

Personally I think a remote hearing is probably a better idea but let's think about it.

[BankFodder]

Please could you have a look at this draft response to the order which you have posted above.

Please comment on it – is it accurate? Is there anything else of significance to add? Is there something that should be taken away? Would you be happy to sign this off as a statement of truth?

 

Quote

Case name XXXX

claim number XXXX

in Exeter County Court

 

 

Re: the order of the court dated XXX – Request for Remote Hearing

 

The claimant respectfully requests the court to reconsider its order of the XXX date that the above claim in respect of the defendant's breach of statutory duty is suitable for determination on the papers, and to substitute the order with an order that the case be heard by a remote hearing.

The claimant respectfully requests the court to enter judgement for the claimant and in which case the remote hearing should be concerned simply with the question of quantum which is the only issue in the claimant's particulars of claim which the defendant has challenged.

The claim

Breach of Statutory Duty: The claimant has brought the claim because the defendant has failed to respond to a statutory request dated XXX for disclosure of data under the Data Protection Act and which sets a statutory time limit of 30 days for compliance.

 

The court’s order

On the XXX date, the above claim was allocated to the small claims track and the Court gave notice that it considered that the claim is suitable for determination on the papers and without hearing.

In the same order at paragraph 3b. the court invited the parties to make their objections to the court’s finding that the case is suitable for determination on the papers.

 

The claimant’s objections

The defence document does not address the claim

The defendant’s defence document has not addressed the claim either generally or in its detail.

In particular, the defence does not address or deny the claimant's allegation of breach of statutory duty at all.

The failure by the defence to address or deny the claimant's allegation of breach of statutory duty can be taken to be an admission, particularly in light of the fact that they have chosen only to challenge the amount claimed.

Furthermore the defence document makes references to matters not contained in the claim at all and are wholly irrelevant to the claimant’s allegation that the defendant has committed a statutory breach of duty.

The defence document was apparently drafted on 6 March 2021 a full 10 days before the claim was even issued in the County Court.

The defence was drafted by John Boumphrey who is believed to be a barrister-at-law.

The defence was eventually signed as a statement of truth on 15 April 2021 by an unidentified solicitor but it is not clear how the unidentified solicitor signatory was able to sign a statement of truth referring to a defence document which had been drafted by barrister John Boumphrey even before John Boumphrey and the unidentified solicitor could have seen the claimant’s particulars of claim.

It would appear that neither barrister John Boumphrey who drafted the defence or the unidentified solicitor who signed the defence as a statement of truth had ever had sight of the claimant’s particulars of claim at the time that they constructed their defence.

The only reference to the claimant’s particulars of claim are two oblique references contained at paragraph 1 and paragraph 11 of the defence document. Paragraph 11 appears to be an objection to the amount claimed by the claimant.

 

 

Seriousness of the issue

Breach of Statutory Duty: The claim against the defendant concerns a breach of statutory duty which is a serious matter and which requires the defendant to make their own representations because a finding against them would then mean that they have a statutory duty to inform the Information Commissioner’s office.

The claimant has already obtained two previous judgements against the defendant for similar breaches of statutory duty in respect of separate failings to satisfy Subject Access Requests under the Data Protection Act.

Both of these judgements were obtained without any engagement from the defendant and the judgement sums have been satisfied by the defendant without any objection from them.

It is believed that in neither of the above two cases has the defendant complied with their duty to inform the Information Commissioner about their statutory breaches.

It is clear from the defendant’s own disregard for the statutory rights of its customers and of data subjects generally, and of their failure to inform the Information Commissioner of their statutory breaches that they have scant regard for the duties imposed by the Data Protection Act.

It is submitted that this on its own means that the matter is not suitable for a hearing on the papers.

Despite the issue of a court claim, the defendant has still made no attempt to comply with the claimant’s request for statutory disclosure of his personal data.

The serial nature of the defendant’s statutory breaches and continuing failure to disclose data have increased the level of distress experienced by the claimant.

It is respectfully pointed out that distress is a recoverable head of damage under data protection legislation and it is significant that the defendant has not challenged this principle in their defence.
In fact the defendants have themselves acknowledged in paragraph 1 of their defence that the size of the claimant's claim is for a very modest sum.

The casual handling of the claimant statutory request together with the casual and incomprehensible way that they have treated this claim – even to the extent constructing a response even before they were aware of the particulars of claim has added to the difficulty.

 

The Defendant's Request to Strike out the Claim
The Defendant has sent the court a letter dated 25 May 2021 asking the court to strike out the judgement.
The claimant has already provided the court with a response to this letter and a further copy is attached to these objections.

In conclusion

For these reasons amongst others, the claimant respectfully requests that this claim be listed for a remote hearing.

 

In compliance with the order of the court, I have sent a copy of this document to the defendant using their email address XXX@XXX on XXX date.

Statement of truth

 

 

[BankFodder]

I'm having slight second thoughts about pointing out the conflict between their paragraph 11 and paragraph 1.

Please don't send anything off yet but we certainly do need to have your comments on this.

 

[lemon_martini2]

Many thanks-I've had a look through and it seems pretty comprehensive and focused. The time and effort put in by you is muchly appreciated.

 

A couple of clarifications so I know exactly what I'm talking about-

*Is quantum the amount of money being claimed?

*What is a recoverable head of damage?

 

And two points-

Where it refers to the 'claimant has brought the claim because the defendant has failed to respond to a statutory request' would it be worth modifying it to emphasize that they have actually failed to respond to X number of statutory requests on multiple dates or just confine it to the one claim that is being defended?

 

And would it be worth including with  'It is believed that in neither of the above two cases has the defendant complied with their duty to inform the Information Commissioner about their statutory breaches' that the Information Commissioner has actually ordered Virgin to either tell me how they will put things right or explain how they have met their data protection obligations and they have failed to comply with this instruction?

 

In other news, I have received confirmation that the case has been allocated to Exeter Crown Court(good news as Virgin wanted it at Leeds), and the cheque received at court on May 11 and just waiting to be cleared has still not put in an appearance, so I shall get in touch with them tomorrow and see where it has wandered off to... 

[BankFodder]

Quantum is exactly that, the amount of money which is being claimed.
Recoverable head of damage = category of damage. The law doesn't allow some categories of damage to be compensated. You probably heard of "consequential loss" – where you have to weigh in for a central heating repairer who doesn't show up and as a result you are unable to attend an appointment and so you lose a job for you are unable to enter into a contract. Those are  consequential losses and they're not recoverable.
Damages for distress are not normally recoverable unless you can show that that distress has resulted in some foreseeable economic loss – which is not the case here.

However, since the case in a few years ago involving Google, the court held damages for distress caused by a data protection breach were recoverable even though they were not associated with any discernible economic loss.
This actually brought the UK into line with Europe in terms of assessing whether compensation should be available for pure distress.



I'm anxious to keep the narrative/issue focused on this particular SAR breach. I think that there has been sufficient reference to the other breaches and we don't want to labour the point and make it part of this litigation. I've referred to the fact that they are serial breachers but I don't want them eventually trying to tell the judge that you had enough money already on the previous two breaches and you don't deserve any more for a third.

 

In terms of the action from the ICO, – you may already have told us about it on this thread, but maybe you could just explain it again.

He said that the ICO has ordered virgin to give you some explanations. Did the ICO find out about this because of your contact with them or because of virgin's contact?

Maybe you could just go through the chain of events

[BankFodder]

I've made some edits to the document which I posted above.

Your objections have to be emailed to the court and to the defendant by 4 June. I think we should leave it as late as possible but I always feel a bit worried about sending it on the final day.

What email address are you going to use for virgin?

[lemon_martini2]

In January I contacted ICO about the Data Breach-on Feb 11, they replied stating that they had ordered Virgin to 'either tell me how they will put things right or explain how they have met their data protection obligations'- so far they have failed to comply.

 

Meanwhile I have been emailed from Virgin's legal team a copy of a letter that they have sent to the presiding judge.

They are attempting to have the claim struck out as an abuse of process:

 

Their grounds are that the warrant for the transferred claim from Sunderland was issued and on May 5 they issued a cheque for the amount. 

 

According to them, this was the first notification of claim that their legal department received(!) and when they checked the details of the particulars of claim realized that this new claim was dealing with exactly the same matters (failure to satisfy the SAR demand) and accordingly 'respectfully request the claim be struck out as the Defendant submits that the Claimant has issued a claim for the same matter on two occasions'.

[BankFodder]

Please will you post up a copy of this letter in pdf format

[lemon_martini2]

It came by email only. output.pdf

[BankFodder]

 

In respect of their failure to comply with the order from the ICO, please will you write to the ICO immediately and complain that despite the order made by the ICO dated XXX, virgin have failed to comply either with the instruction to put things right or with their data protection obligations.
Please do that immediately so that we have a copy for the court.
 

In respect of the letter asking for the strikeout, I think we have to respond to that immediately – but we will also attach a copy of it to the objections which we are preparing in order to ask for a remote hearing.

 

[BankFodder]

Okay, please have a look at this – lots of dates et cetera to fill in. Needs to be very careful not to confuse dates and to make sure that it all makes sense and represents what actually happened.

We will need to send this off PDQ – probably tomorrow or Thursday morning.
I think in view of this we will need to send the objections off by the end of the week as well.

 

Quote

Response to the defendant’s request to strike out claim number XXX.

(In addition to a request that the matter be heard by means of a remote hearing – said request to follow shortly)

 

I am writing in response to the defendant’s request to strike out claim number XXX.

I object to the defendant's request.

the defendant has already filed a defence without any reference to a dismissal of the claim so clearly they must believe that the claim has some substance.
The defendant’s account of the events and the actions which have been taken against them in respect of their various breaches of the data protection rules, are completely confused and inaccurate.

It is difficult to come to any conclusion other than the fact that the defendants data processing is in chaos and that itself is  a breach of one of the Data Protection Principles.

It is significant that the defendant’s application to strike out is not signed as a statement of truth by a solicitor who identifies herself as Nicola Smith.
It is noted also that the defendants request to strike out does not comply with the proper procedure in that it has not been made by way of an application notice and it is believed that no fee has been paid.

Separately I will be submitting objections to the court’s order of the XXX date that the case be heard on the papers and I shall be requesting a remote hearing.

However, the current claim – number XXXX is a third and completely separate data protection breach in which the defendant failed to comply with a subject access request dated XXX date.

The claimant takes this opportunity to remark that it is objectionable that the defendant now claims that they satisfied a warrant simply because of the economics of the matter.

This amounts to an abuse of process to suggest that there was a judgement against them but which was unfairly granted and that they simply didn’t object because it was more cost efficient to go along with it.

There exists a proper procedure for challenging unfair judgements and that procedure is not simply to pay some money to make it go away.

It is hoped that the court will express its displeasure at this treatment of the court process.

The claimant also takes this opportunity to point out that in respect of the data breaches of XXX date and XXX date in respect of which claim numbers XXX and XXX were issued in respect of which judgements were granted, the claimant then submitted those judgements to the Information Commissioner’s Office as part of a formal complaint.

The information Commissioner on XXX date ordered the defendants to contact the claimant and to explain to him how they intended to put things right by meeting their obligations – or else to explain to the claimant how they had already met their data protection obligations.

To date, the defendants have failed to comply with the order of the Information Commissioner and another complaint has been made to the information Commissioner in respect of the defendant’s continuing disobedience to the order.

I am confident that when the court receives the disclosure bundle which I am currently assembling, that the court will see a logical paper trail in respect of three serial breaches of the data protection regulations, together with comprehensive attempts to communicate and to comply with pre-action protocols.

For these reasons, claim number XXX should not be stuck out and in fact should be the subject of a remote hearing on a date to be decided by the court.

 

Statement of truth

 

 

It should be sent using the same type of heading et cetera as their letter – but you won't be signing it love and kisses – Nicola. She seems to be on rather casual terms with the court.

https://www.linkedin.com/in/nicola-c-e-smith-81836036/?originalSubdomain=uk

Sign it as a statement of truth

also, the paragraphs need to be numbered so once we have got it right, it needs to be put into a Microsoft Word document with paragraph numbering. The same with the objections.

As usual, check it for typos or nonsense because it has all been dictated using software and I haven't really checked it very closely

Edited May 27, 2021 by BankFodder
Edits in red

[BankFodder]

I think I should also point out that you really do need to have the whole story very clear – and be able to show very easily and convincingly how confuse they have become about the whole thing.
I am quite sure that it is virgin which is in disarray and eventually they will have lots of egg on their face – but bear in mind that as it is you who are asking for the remote hearing – which I think is absolutely the correct course of action – if it turns out that your account of the chain of events is at all flawed, then there is a risk that they could ask the court to exercise its exceptional discretion to award costs against you.
On the other hand, they are making such a mess of everything, that as long as you have got all your ducks in a row and your documentation is very clear and tells the story without any doubt, then I think you are equally in an excellent position to ask the judge to award litigant in person costs to you on the basis that virgin's disorganisation has created unnecessary litigation and unnecessary inconvenience to you and to the court.

 

 

Assuming that you are able to obtain a remote hearing – and I expect that you will – then you will need to organise your court bundle very carefully and effectively it will fall into three files – one for each SAR.
But of course, you must be very careful not to allow this most recent data breach to be drawn into a general discussion about all of their data breaches. Each one is separate. They must not be connected – especially when it comes to assessing damages.

[BankFodder]

@lemon_martini2

Will you manage to get the response to their strike out request off today?