Skip to content
Sign in
Defense & Security · Europe

Arnold Clark accepts possible compensation liability in Scottish data case

Arnold Clark accepted that it may have to compensate members of a Scottish group action who prove they were harmed by the company’s data breach. The company admitted that a failure to protect customer data led to the December 2022 cyber attack, while individual claims and compensation amounts remain undecided.

AI-assisted synthesis · Based on 2 outlets' reporting · Article text read from 1 of 2 outletsHow it's made

View timeline · 9 entries
2 outletsLatest reporting 3 min read
Coverage: Too few ratedL 0 · C 1 · R 0 · 1 unrated
Updat3 graphic: Europe
Updat3 graphic · Map data: Natural Earth Natural Earth (public domain)

What happened

Key facts

  • Arnold Clark admitted that its failure to protect customer data led to the December 2022 cyber attack (per glasgowtimes.co.uk).
  • Arnold Clark accepted in a document lodged at the Court of Session that it may have to compensate group-action members who prove harm (per glasgowtimes.co.uk).
  • Individual claims, whether the breach caused each claimant’s loss, and any compensation amounts remain undecided, and Arnold Clark reserved its position on those issues (per glasgowtimes.co.uk, eastrennews.co.uk).
  • The Scottish group action is being brought under Chapter 26A of the Rules of the Court of Session (per glasgowtimes.co.uk).
  • Jones Whyte represents more than 3,000 people in the Scottish proceedings and is part of the claimant steering group (per glasgowtimes.co.uk).
  • Jones Whyte said customers who were with Arnold Clark before December 2022 and believe their information was affected should contact the firm, noting that time limits apply (per glasgowtimes.co.uk).
  • Arnold Clark customers were contacted in January and February 2023 after the company found attackers had extracted personal data (per glasgowtimes.co.uk).

The brief

Arnold Clark has accepted that it may have to compensate members of a Scottish group action who can prove they suffered harm in a data breach case at the Court of Session. The company admitted that its failure to protect customer data led to the December 2022 cyber attack, according to the Glasgow Times.

In a document lodged with the court, Arnold Clark accepted potential compensation liability for group-action members who establish harm. That does not settle individual claims: the company reserved its position on whether the breach caused each claimant’s loss and on any compensation amounts. Those questions remain undecided.

The case is being brought under Chapter 26A of the Rules of the Court of Session. Jones Whyte, a Glasgow law firm, represents more than 3,000 people in the Scottish proceedings and is part of the claimant steering group. The case is titled Robert Adamson v Arnold Clark Automobiles Limited, with reference GP9-26.

The Glasgow Times reports that the attack occurred on the evening of December 23, 2022. Arnold Clark contacted customers in January and February 2023 after finding that attackers had extracted personal data. Some customers were told that unsigned copies of finance agreements dated 2019 and earlier may have been stolen.

Jones Whyte said customers who had been with Arnold Clark before December 2022 and believe their information was affected should contact the firm, adding that time limits apply. The firm also said more clients may be able to join the action.

Its partner and head of group actions, Dominic Ritchie, called the court development significant for thousands of people affected by the cyber attack. East Renfrewshire News’s headline also says Arnold Clark admitted data-protection failures led to a major cyber attack.

The next decisions concern whether individual claimants can establish harm and whether they can connect their losses to the breach; the court outcome and any compensation awards remain unresolved.

Why it matters

  • More than 3,000 people are represented in the Scottish proceedings, and the case could determine whether members who prove harm can receive compensation.
  • The key mechanism for an individual claim remains proof of harm and whether the breach caused that claimant’s loss; compensation amounts have not been decided.
  • Customers were contacted after personal data was extracted, and some were told that older, unsigned finance agreements may have been stolen.

What to watch next

  • Whether individual group-action members establish that the breach caused them harm.
  • Whether Arnold Clark changes or maintains its reserved position on individual claims and compensation amounts.
  • Whether more eligible customers join the action through Jones Whyte, which said additional clients may be able to join.

How it's being covered

Coverage analysisShow details
2 source articles · 2 unique outlets
Outlet political mix: Too few rated· 1 Center · 1 unrated
Where the outlets are based: Europe 100%
Outlet political mix
Too few rated
Left
Center
Right
0 outlets
1 outlet
0 outlets
The marker shows coverage balance: each unique outlet counts once. 1 unrated outlet is not included.
Geography
Where the outlets covering this story are based.
2 unique outletsDominant coverage: Europe
Limited coverage
  • Coverage is currently limited to 2 outlets.
How we measure coverage

How outlets' accounts compare

Updat3 does not yet have enough full reports to compare how outlets framed this story.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. Arnold Clark founded his car business in Glasgow.
    Background · compiled and fact-checked by Updat3
  2. The European Union adopted the Data Protection Directive.
    Background · compiled and fact-checked by Updat3
  3. Parliament passed the Data Protection Act, implementing the EU Data Protection Directive in UK law.
    Background · compiled and fact-checked by Updat3
  4. The European Union adopted the General Data Protection Regulation.
    Background · compiled and fact-checked by Updat3
  5. In the United Kingdom, the Data Protection Act 2018 received royal assent on 23 May 2018 and supplemented the GDPR; after the UK’s departure from the EU, the retained version became known as the UK GDPR.
    Background · from our historical context
  6. The General Data Protection Regulation became applicable across the European Union.
    Background · compiled and fact-checked by Updat3
  7. Scotland’s collective-litigation framework was added to the Rules of the Court of Session through Chapter 26A, which came into force on 31 July 2020.
    Background · from our historical context
  8. Attackers accessed Arnold Clark systems and extracted customers’ personal information.
    Background · compiled and fact-checked by Updat3
  9. Arnold Clark began contacting customers about personal data extracted in the cyber attack.
    Background · compiled and fact-checked by Updat3

How we got here

In December 2022, attackers accessed systems at Arnold Clark, the Scottish car retailer, and extracted personal information; the company contacted affected customers in January and February 2023. The legal framework for claims over personal-data security was set by the European Union’s General Data Protection Regulation, adopted on 27 April 2016 and applicable from 25 May 2018.

Article 5 requires personal data to be processed securely, while Article 32 requires controllers to use appropriate technical and organisational measures to protect it. Article 82 provides a right to compensation for material or non-material damage caused by an infringement.

Original sources

2 articles from 2 outlets

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.