COULD 25m PEOPLE SUE HMRC?

On reading Iain Dale's post about this, I couldn't resist looking up the relevant text of the Data Protection Act. Section 13 seems to be the most pertinent provision. It states:

"13 Compensation for failure to comply with certain requirements

1. An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
2. An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if—
   (a) the individual also suffers damage by reason of the contravention, or
   (b) the contravention relates to the processing of personal data for the special purposes.
3. In proceedings brought against a person by virtue of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned."

I'm no lawyer but, on the face of it, anyone affected by the HMRC fiasco could sue for not only "damage" (i.e. financial loss, identity theft, or what-have-you) but also "distress" (i.e. mental anguish caused by the whole sorry episode, &c). Interesting.

But what really tickled me about this was the prospect of the Government, as a defence, seeking "to prove that [it] had taken such care as in all the circumstances was reasonably required" should anyone choose to take action against them. That really would be interesting!