===== 5771 =====
In a formal document lodged at the Court of Session, the dealer has conceded that its failure to protect customer information broke data protection law, and that the December 2022 intrusion could not have happened otherwise.
The admission, first reported by Newsquest titles, hands the group action a significant procedural win. In principle, the dealer accepts liability to pay members who can evidence harm. Individual claims and the size of any award remain open, and the company has reserved its position on causation and quantum.
## What the attackers took
The intrusion ran on the evening of December 23, 2022. The network came down on Christmas Eve 2022 as investigators moved in. Notification to customers followed in January and February 2023, once extraction of data had been established.
What the attackers are thought to have carried off spans names, addresses, birth dates, vehicle and contact details, National Insurance numbers, passport and driving licence copies, and banking details. Some customers were told unsigned finance agreements from 2019 and earlier may also have been stolen. The firm offered two years of Experian monitoring.
## The claim runs in two jurisdictions
Filed as Robert Adamson v Arnold Clark Automobiles Limited, the action proceeds under Chapter 26A of the Rules of the Court of Session, reference GP9-26. Lord Sandison earlier approved the Scottish group after rejecting the dealer’s argument that England was the better forum, noting more than 95 per cent of proposed members lived in Scotland.
Jones Whyte, which represents over 3,000 people in the Scottish action, says the number may grow. Eligibility is understood to cover roughly 15,000 motorists. Parallel English proceedings continue, with the company’s lawyers signalling a comparable stance there.
