Have you been subject to a hotel staff data breach? Have your personal details such as your name, address and financial account information been breached either as an employee, guest or contactor to a hotel? This article will explain the data protection laws that are in place to keep such information secure. It will also look at the personal data breach claim eligibility as well as the time limitations. We will also explore how much compensation you could receive and how our solicitors could help.
Can you claim for a hotel staff data breach?
Personal data breaches can be incredibly invasive and can cause both financial harm and psychological injuries. It can impact your mental health causing undue stress.
Contact our advisors today to find out if you have a solid basis for a claim. They may then be able to connect you with our No Win No Fee lawyers who can help begin the legal process. Get in touch by:
- Calling us on 0800 073 8801
- Start your claim online
- Use our live chat feature
Select A Section
- What Are Hotel Staff Data Breach Claims?
- Types Of Hotel Guest And Staff Data
- What Could Hotel Guests Or Staff Claim For Data Breaches?
- What Is The Limitation Period For Filing A Hotel Staff Data Breach Claim?
- How Much Compensation Will I Receive?
- Talk To Us About Hotel Staff Data Breach Claims
What Are Hotel Staff Data Breach Claims?
The UK General Data Protection Regulation 2016 (UK GDPR) and the Data Protection Act 2018 (DPA) are the two pieces of legislation that act together to establish data protection law in the UK.
Under data protection laws a data subject is an individual whose personal or personally sensitive information is processed by a data controller or processor. A data controller is usually a company that decides how and why information should be processed. So for instance a hotel.
Sometimes a data controller will outsource their processing to a processor. Both a processor and a data controller must abide by data protection laws. Failure to do this could mean a fine being issued by the Information Commissioner’s Office ICO. It is the independent public body for overseeing compliance with data protection laws.
In order to process your personal data, the data controller must have a lawful basis. Some examples of a lawful basis can include consent, contract or legal obligation, and it is important to note that one does not override another. They are all equally fair lawful bases.
Examples Of Hotel Data Breaches
Following a cyber-attack in 2014 on Starwood Hotels and Resorts Worldwide Inc, which was only discovered when Marriott took over it was estimated that 339 million guest records worldwide were affected. The Information Commissioner’s Office (ICO), took official action against the chain and issued a fine of £18.4 million for not correctly securing guests’ personal data.
While you cannot claim compensation from the ICO, they can open official investigations into organisations that are suspected to have breached data protection law and may then impose a fine on them.
Types Of Hotel Guest And Staff Data
Hotels encompass a lot of people, and subsequently their personal data. From workers to staff the hotel can store and process a lot of information, therefore they must ensure that they abide by data protection regulations.
The types of personal data that may be processed by a hotel and could be subject to a data breach can include:
- Names
- Date of birth
- Email address
- Home address
- Nationality
- Banking information
- Phone number
The ICO also identifies further information they label as special category data, which is personal data that needs extra protection due to its sensitive nature. This can include personal data such as:
- Race or ethnicity
- Political beliefs
- Religion or philosophy
- Union membership
- Health information
- Sex life or sexual orientation
Contact our advisors today for more information on what constitutes personal data.
When Could Hotel Guests Or Staff Claim For Data Breaches?
A hotel guest or a member of staff could claim for a data breach if they can prove that they suffered harm as a result of a personal data breach caused by positive wrongful conduct on the part of the hotel.
Some examples of how a hotel guest or hotel staff data breach could occur include:
- Cybercrime: If a hotel does not have adequate cybersecurity policies in line with data protection law, this could lead to a personal data breach.
- Lost or stolen devices: Hardrives, USB sticks, and laptops are all examples of devices that could easily be lost or stolen if security is not taken seriously. If a device containing personal data relating to guests or staff is stolen or lost, this could result in a personal data breach.
- Incorrect use of BCC: Blind Carbon Copy is integral in protecting personal data when sending large-scale emails. When CC is used in the place of BCC, this then exposes the email addresses of all the recipients included in the email.
If you were harmed as a result of a personal data breach caused by a data controller not abiding by data protection laws, you may have grounds for a claim. Contact our advisors today to find out if you have a valid personal data breach claim.
What Is The Limitation Period For Filing A Hotel Staff Data Breach Claim?
Generally, personal data breach claims have a 6-year time limit unless they are against a public body such as the local council, then the time limit is reduced to 1 year.
If a hotel or other business or organisation has suffered from a data breach, that affects the rights and freedoms of a data subject, the ICO states that they must report the breach to them within 72 hours. Furthermore, they must inform the data subjects that their data has been compromised as soon as possible.
Contact our advisors today to find out how these time limits could affect your claim.
How Much Compensation Will I Receive?
When you make a hotel staff data breach claim, there are two heads of compensation you can pursue:
- Material damages: These compensate for any financial damage you may experience as a result of the breach. For example, fraudulent purchases made using your credit card, identity fraud, and damage to your credit score may be considered when calculating material damages.
- Non-material damages: These aim to compensate you for any mental health injuries you may suffer, such as stress, anxiety, and PTSD.
The potential compensation bracket amounts are established in the 16th edition of the Judicial College Guidelines (JCG) published in 2022. The below table shows compensation brackets for non-material damages:
| Injury | Compensation | Notes |
|---|---|---|
| Severe mental health damage generally (a) | £54,830 to £115,730 | The injured person has mental health problems and difficulty working and living daily life with strained relationships and a poor prognosis. |
| Moderately severe mental health damage generally (b) | £19,070 to £54,830 | Prognosis is better from above, however, there are still significant mental health problems. |
| Moderate mental health damage generally (c) | £5,860 to £19,070 | Where there has been an improvement in the individual’s mental health with an improvement over time. |
| Less severe mental health damage generally (d) | £1,540 to £5,860 | The level of the award is dependent on the length of the disability period and how much daily activities and sleep were affected. |
| Severe post-traumatic stress disorder (a) | £59,860 to £100,670 | Persistent effects prevent the injured person from working at a pre-trauma level or being able to work at all. All parts of a person’s life have had a considerable negative impact. |
| Moderately severe post-traumatic stress disorder (b) | £23,150 to £59,860 | With professional help, the individual has undergone treatment that has improved their mental health and prognosis. However, there is still a chance for disability in the forthcoming future. |
| Moderate post-traumatic stress disorder (c) | £8,180 to £23,150 | Where the injured person has recovered to a large extent and any persisting symptoms are not hugely disabling. |
| Less severe post-traumatic stress disorder (d) | £3,950 to £8,180 | Almost complete recovery within one to two years with minor symptoms lasting over any longer period. |
The Court of Appeal heard the Vidal-Hall and Others v Google Inc case. This set precedent for claiming non-material damages without the need to prove that you have suffered material damages. However, it is important to note that the figures shown above are guidelines only, and are not guaranteed sums for non-material damages.
For a free estimate of what your claim could be worth, get in touch with our team of expert advisors today.
Talk To Us About Hotel Staff Data Breach Claims
Hotel staff data breach claims can deal with complex legislation, therefore we suggest talking to our advisors about your case. If you have a strong argument for a claim, they can introduce you to our professional No Win No Fee lawyers.
Our No Win No Fee lawyers offer a type of funding arrangement known as a Conditional Fee Agreement (CFA), which stems from the Conditional Fee Agreement Order 2013. This allows you to employ a solicitor’s services with no upfront fees needed and you do not pay for the service if your claim is unsuccessful.
A No Win No Fee lawyer receives a success fee only if your claim succeeds. This is a small set amount of your compensation with a legal cap.
Talk to our advisors today to find out how one of our experienced personal data breach solicitors could help you by:
- Calling us on 0800 073 8801
- Start your claim online
- Using our live chat feature
More Helpful Guides
Please read our other useful articles:
- What Are My Rights After A Hotel Data Breach?
- Frequently Asked Questions For Data Breach
- What Are My Rights After A Loan Provider Data Breach?
- What Are My Rights After A Comparison Site Data Breach?
Or, for more helpful information:
Contact our advisors today for information on hotel staff data breach claims.