Manchester United Faces Lawsuit Over HR Data Breach, Set to Pay £100,000 in Damages

A lawyer spearheading the lawsuit claims that a group of Manchester United employees indicated they are suing the football team for an HR data breach.

The club may have to pay out a sum of £100,000 in damages after it unintentionally sent 167 employees’ pay stubs to all of the temporary caterers and hospitality workers.

In an event that occurred in 2018, the employees’ names, residences, earnings information, and national insurance numbers were all contained in a single file that was given to the staff.

The club stated that procedures had been adjusted to guarantee that the incident did not occur again and that managers “regret” it. At the time, the issue was reported to the Information Commissioner’s Office as a data protection breach.

The club was persuaded to settle the lawsuit by Jonathan Whittle, a senior manager and chartered legal executive at Chesterfield-based Your Lawyers, which represents 32 of the 167 staff.

This is a “clear and serious breach of data protection laws,” he told the Manchester Evening News, and it needs to be rectified right away. On average, each claimant is requesting £3,000.

“We take the data privacy of our employees very seriously and regret this isolated breach, which occurred in 2018,” a Manchester United spokesman told the newspaper. We notified the Information Commissioner’s Office and put safeguards in place to ensure it doesn’t happen again, but they didn’t take any further action.

“As the HR function within an organization manages considerable amounts of personal data relating to prospective, current, and former staff, it is crucial that employers understand their responsibilities and liabilities under data protection laws and that they manage human resource data responsibly,” stated Becky White, senior data protection and privacy solicitor at Harper James.

The incident also serves as a reminder that, in order to lessen the chance of another avoidable data breach happening, organizations must put in place appropriate policies and procedures regarding email practices, especially when sending bulk emails, and encourage their staff to follow best practices.

“To help staff members better understand their role in protecting any personal information the business collects and processes, businesses and HR teams should make sure they have strong data protection policies in place and that regular security and data protection awareness training is offered.”