GDPR Damages Claim in Simple Procedure Reaches Sheriff Appeal Court with Success for Party Litigant Against East Dunbartonshire Council.
A peek at the future of data protection litigation in Scotland.
I was absolutely delighted to see this success for a party litigant who challenged East Dunbartonshire Council over inaccurate data recorded in a report concerning his daughter.
The full decision is here. 👉 East Dunbartonshire Council v Paul Paton [2026] SAC (Civ) 17
Without going into a full analysis of what happened as the decision speaks for itself, the summary is that the claimant raised a simple procedure action against the Council to rectify inaccurate records & seek damages under the GDPR and was successful.
I have to assume from the appeal decision that the claimant originally sought an order to rectify the records plus damages. I believe this to be the case, as it states that as soon as the claim was raised the Council conceded that the records should be rectified and they did so but, then went on to challenge the damages part of the claim.
The damages part was challenged by the Council on the basis that they thought the father was not entitled to make the request nor claim for damages as their position was that he was not the data subject.
The Sheriff saw it different and in favour of the claimant and awarded damages to the claimant. East Dunbartonshire Council then raised the appeal to the Sheriff Appeal Court.
In the decision, we can see that the SAC were quite happy wading through a number of case authorities from England and the CJEU to determine how they should answer the question of who's personal data it was. They concluded that the data was sufficiently linked to the claimant and given his parental responsibilities he was entitled to request rectification & pursue damages.
The Future of GDPR & Data Protection Claims in Scotland.
GDPR & data protection litigation is still in its infancy in Scotland. England & Wales being miles ahead in many respects. But, we are likely to see a massive uptick in these claims in Scottish courts due to both the ICO's reformed stance towards complaints after the Data Use & Access Act 2025 coming into force and as people's awareness grows of their robust rights under the GDPR.
In fact, given the ICO's reformed stance, I, myself will be bypassing the ICO altogether & resorting to going straight to the courts for any future data issues. To be fair, they weren't a whole lot of use prior to this anyways. The ICO's spreadsheet ticking culture has worsened, not strengthened individuals data rights.
The other aspect of this case that is fabulous for Scots everywhere is the growing acceptance that these low value GDPR claims belong in Simple Procedure despite the technical & sometimes complex interpretations of data protection law involved.
Why should an individual have to worry about significant costs against them simply for exercising basic data rights? Especially when the opposition may be a large company or a public authority with vast resources? Provided claims are less than £3000 in simple procedure, expenses are capped.
Look at my current claim, INV-SM11-25, wherein the opposition, a public authority, have already spent £17,367 on legal expenses even before a hearing has been set?!? This is an inequality of arms that is not congruent with an individual's right to privacy and protection of their data rights - unless the individual has some form of protection to redress the balance in this respect. ⚖️
If you plan on heading to court any time soon for a GDPR claim in Scotland, keep this latest Sheriff Appeal Court decision under your arm for the inevitable “forum challenge” by the opposition. These claims belong in simple procedure if they are low value - don't let them tell you any different and the Sheriff Courts are slowly accepting this same view.
I plan to write a lot more on how to tackle these claims in Sheriff Court soon. I have already written some basic articles explaining the procedure and will be adding more shortly.
See the following articles…
👉 Data Protection Compliance Order Claims in Simple Procedure in Sheriff Courts in Scotland.
👉 s.167 Compliance Order Under the Data Protection Act 2018.
We also need to keep an eye on Farley v Paymaster which is currently at the Supreme Court to check if the court has an appetite for divergence from the EU on the threshhold for damages in Article 82 GDPR damages claims. Hearing is set for October 2026.