Operation Fortress – Data Breach
First, thank you to those who have registered as a potential claimant and provided the requested details via the survey. If you wish to register and have not received a link to the survey, please email FortressEnquires@metfed.org.uk including your full name, date of birth, warrant number and preferred private email address
By way of update, the MPF are continuing to work with PMC to investigate if there are viable compensation claims arising from the ransomware attack on Digital ID, as follows:
· Specialist Counsel has been consulted.
· Communications with both the MPS and Digital ID are ongoing.
· The survey information is being reviewed and analysed. We anticipate that a follow-up survey will be circulated in due course to some officers to gather additional relevant details.
Please note that the fact of a breach does not mean there is a viable claim for compensation. To establish a claim for compensation, there must be evidence that the breach has caused damage (e.g. financial loss) or (non-trivial) distress / emotional harm.
The advice from PMC is that, whilst there is limited case law relating to claims arising out of cyber-attacks, recent data protection cases demonstrate some of the difficulties in pursuing claims for compensation. In particular, in the case of Farley v Paymaster (1836) Limited (trading as Equiniti) [2024] EWHC 383 (KB), all but 14 of the 474 claims failed on the basis that there was no evidence that the information was disclosed to anybody and it was not sufficient to infer that it had or that there was a risk of it being accessed. This case is being appealed, but the Court of Appeal judgment granting permission to appeal does envisage that cases in which non-trivial emotional harm will be caused by breaches where there is no proof of disclosure will be rare. However, we will have to wait and see what the Court of Appeal ultimately decides on these issues.
In view of the above, one of the key issues being investigated is the extent to which this evidential hurdle can be overcome. We are still at an early stage, but please bear in mind that the advice may ultimately be that not all affected members will be able to overcome this hurdle and establish a viable claim for compensation.
We will continue to update you about the progress of this matter as and when there are any material developments. In the meantime, please do not contact PMC directly.
Finally, thank you again for your patience on this matter to date. As previously explained, progress will inevitably be slow due to the complicated nature of the investigations and the complex issues which arise, as well as the number of individuals whose data has been potentially compromised. However, rest assured, if there are viable claims, the time limit within which a data breach claim can be brought is 6 years,
Matt Cane
General Secretary
Metropolitan Police Federation
