The Protection of Personal Information Act (which is best described as the Data Privacy Act and not a flower) permits a data subject to institute a civil action for damages where there has been a breach of the Act.

A court may award an amount that is just and equitable including payment of damages as compensation for patrimonial and non-patrimonial loss suffered by the data subject as a result of the breach, and also aggravated damages determined in the discretion of the court.

Aggravated damages are not defined in the Act and are a concept generally unknown in South African common law.

Are aggravated damages punitive or compensatory in their nature and what would a data subject claimant need to establish to be awarded aggravated damages?

As a general principle of South African law, damages that are awarded are compensatory and not punitive. Damages are the monetary surrogate of the loss suffered by a person with the object of eliminating as fully as possible their past as well as future loss.

In cases where there is an unlawful and intentional personality infringement such as defamation, aggravated damages may, in effect, be awarded.

In the new constitutional order, we do have a concept of constitutional damages which would contain a punitive element. But the Constitutional Court has been hesitant to award those damages in many cases finding that substantial delictual damages are a powerful vindication of the plaintiff’s rights requiring no further vindication by way of an additional award of constitutional damages.

The legislature, in providing for the award of aggravated damages in the Data Privacy Act, in addition to “payment of damages as compensation for patrimonial and non-patrimonial loss,” obviously contemplates damages beyond those normally awarded.

But the legislature chose not to use the terminology of exemplary or punitive damages.

Other jurisdictions, such as the United Kingdom, do have concepts of and distinguish between exemplary damages which are a punitive measure of damages, and aggravated damages which remain compensatory. In the United Kingdom aggravated damages compensate the victim of a wrong for mental distress in circumstances in which the injury has been caused or increased by the manner in which the defendant committed the wrong or by the defendant’s conduct subsequent to the wrong.

It requires, as pre-conditions of an award of aggravated damages: exceptional or contumelious conduct or motive on the part of the defendant committing the wrong and mental distress sustained by the plaintiff as a result.

On the face of it, there is no reason not to import those requirements when interpreting the concept of aggravated damages in the Act because of the intention under the Act to protect a personality interest of the claimant and injury to dignity and privacy which arises where there is a breach of data privacy.

Aggravated damages then awarded may compensate where the loss the claimant actually suffered is exacerbated or aggravated by the conduct of the defendant to ensure that they are compensated in full measure.  In the same way, defamation damages are aggravated by outrageous conduct or evil motive of the defamer.

The English common law makes aggravated damages available where there are “… aggravating features about the case which would result in the plaintiff not receiving sufficient compensation for the injuries suffered if the award were restricted to a basic award.”

It is regrettable that the legislature has not, in its drafting, made it clear whether aggravated damages may incorporate any punitive element.  The election not to use terminology such as exemplary or punitive suggests not.

In the United Kingdom, for example, punitive damages are awarded only where the defendant’s conduct showed a deliberate and outrageous disregard of the plaintiff’s rights and the other remedies awarded (for example criminal and administrative sanction) would be inadequate to punish the defendant for its conduct.

The United States’ consideration of the appropriateness of a punitive-damages award includes consideration of: the reprehensibility of the conduct being punished; the reasonableness of the relationship between harm and the award; and the difference between the award and the civil penalties authorised in comparable cases.

Whether or not our courts ultimately determine that aggravated damages are punitive rather than compensatory, the ability to award such damages creates a significantly new liability exposure for all responsible parties under the Act and their insurers.

Insurers underwriting cyber liability and related Data Privacy Act liability should consider the degree of exposure, specifically to the insured and the insured risk, and underwrite accordingly.