Can I sue Yahoo for leaking my data?

QI was shocked by the scale of the hack that Yahoo revealed in September. I’m now seriously worried that my personal details will be used by hackers. Do you think I could sue Yahoo? If so, how would I go about this?

AYes, Fred and the eight million other UK Yahoo users affected by this data breach could sue the company. Their best chance of success would be to use the Data Protection Act (DPA) as the basis for a claim. Under the DPA, Yahoo has a duty to ensure that the data it holds is secured against unauthorised use.

In 2014, hackers stole the personal data of around 500 million people. Yahoo says that emails and passwords were taken, but no bank account details. The attack and why it took Yahoo nearly two years to report it is under investigation by the UK’S Information Commissioner’s Office (ICO). If it rules that Yahoo breached the DPA, it opens the floodgates for people in the UK to sue the company. Victims could then use the ICO’S conclusions as evidence.

Claims under the DPA are more likely to be successful if made for distress caused, rather than for financial damage, which would be harder to prove. A Court of Appeal ruling in 2015 lets victims claim for any anxiety triggered by the theft of details.

If you don’t want to wait until the ICO’S ruling, you can tell Yahoo now that you want compensation by writing to: Yahoo UK Ltd, Level 5, 125 Shaftesbury Avenue, London, WC2H 8AD. If you can’t reach an agreement you should say that you plan to sue.

We’ll keep an eye on the situation because other legal routes in the UK are open to individuals, such as group litigation, where a number of people come together to sue a company. We’ll also follow the lawsuits against Yahoo in the US (see News, Issue 486, page 6).