Terms and Consequences: A £3,225 Liability Cap and a £29 Million Fire

Legal is one of the easier budget lines to trim in a growing business. It ships no product, wins no customers and, on most days, nothing goes wrong. Contracts get signed by whoever owns the relationship, compliance lives in a policy folder last opened at onboarding, and there is a law firm somewhere on speed dial for anything that looks serious. Hiring a lawyer of your own can wait until the business is bigger.

The catch is that the most expensive legal problems rarely look serious at the time. They arrive as a maintenance agreement, a routine purchase order, a clever marketing campaign, a disclaimer on an app store listing or a conversation between friends about who thought of what first. Nobody calls the law firm about any of those, because none of them look like legal matters until they very suddenly are.

None of the businesses below set out to break any rules. Each made an ordinary decision that nobody with a legal eye happened to see, and each later discovered what it cost: a £29 million fire claim that failed, regulatory penalties and a nine-figure settlement with a former friend. The saving from not having a lawyer in the building is easy to measure. The cost of not having one usually is not, right up until it arrives all at once.

The £3,225 clause

In 2009, a fire destroyed the factory of Benkert UK, a cigarette filter paper manufacturer in Alva, Clackmannanshire. The loss was agreed at just under £30 million. Benkert pursued Paint Dispensing Ltd, the contractor that serviced the site’s ink dispensers, arguing that a loose hose clip had let solvent vapour escape and ignite.

At first instance, the Outer House found the contractor responsible but held that the maintenance agreement capped its liability at £3,225.06, one year’s maintenance charge. The clause was hardly hidden: it was prefaced by a warning in underlined capitals. On appeal in December 2022, the Inner House went further and found the contractor not liable at all, so the cap never came into play. It also rejected Benkert’s challenge to the clause, noting that Benkert knew of it and had the bargaining strength to ask for different terms.

Contract terms decide who carries a loss long before anyone knows there will be one. A cap that reads like small print can set the ceiling on a claim worth tens of millions, and terms signed unread make that decision by default.

The £7,490 purchase order

Goodlife Foods, a producer of pre-packaged vegetarian meals, learned the same lesson on an even smaller transaction. In 2002 it bought a fire suppression system for a fryer from Hall Fire Protection for £7,490. Hall’s terms, attached to the quote and sent again with the order acknowledgement, excluded its liability while offering extra cover at additional cost.

A decade later, the fryer caught fire. Goodlife put its losses at around £6.6 million and alleged that the system had failed. In 2018, the Court of Appeal upheld the exclusion, noting that the businesses were of comparable size and that Goodlife could have bought elsewhere or insured the risk itself.

Routine supplier and maintenance contracts tend to be signed by whoever owns the relationship, on the supplier’s standard terms. Most never matter. The ones that do are often low in value, long-running and attached to the riskiest parts of the operation.

The policies nobody updated

Doorstep Dispensaree, a London pharmacy supplying medicines to care homes, received the ICO’s first fine under GDPR. In December 2019 it was fined £275,000 after documents containing patients’ health information were found in unlocked containers at its premises in Edgware. The ICO first estimated around 500,000 documents. The Tribunal later counted 73,719.

The ICO did not find that the pharmacy had acted deliberately. Most of its data protection policies simply had not been updated since before GDPR came into force, and its privacy notices fell short. Its initial response did not help: when first contacted, it denied knowledge of the matter. The fine was later cut on appeal to about £94,000, and the Court of Appeal upheld the ICO’s penalty notice in December 2024.

The data nobody thought was health data

Easylife, a UK catalogue retailer selling household products by mail order, found another way to cross the same line. It linked 122 “trigger products” to health conditions, profiled around 145,000 customers on the strength of what they had bought, and called them to sell related items. Buying one of around 80 products could flag a customer as having arthritis, followed by a call offering glucosamine patches.

Easylife argued it was only processing transactional data. The ICO disagreed, treating the inferences as special category health data, processed without consent, without a data protection impact assessment and without any mention in the privacy notice. In October 2022 it fined the company £1.35 million, later reduced to £250,000 by agreement on appeal, alongside a separate £130,000 fine for unsolicited marketing calls. The point at which purchase history becomes health data is exactly the kind of question that rarely gets asked until a regulator asks it first.

The disclaimer that didn’t work

HyperBeard, a California developer of children’s mobile games with titles such as KleptoCats, BunnyBuns and NomNoms, had apps reportedly downloaded more than 50 million times. Like many free apps, it earned money from advertising, and its third-party ad networks collected device identifiers from players to serve targeted ads, without the parental consent US children’s privacy law requires.

HyperBeard had posted disclaimers saying the apps were not intended for children under 13. The FTC was unmoved, given the bright cartoon characters, a children’s entertainment website, children’s books and plush toys. In 2020 the company agreed to a $4 million civil penalty, suspended to $150,000 because it could not afford the full amount, and was ordered to delete the data it had collected.

The founders’ agreement

Snapchat is the one company here that went on to become a household name, and its story is a useful example of a business that took the hint. In 2011, Stanford students launched an app called Picaboo, built around disappearing photos. Reggie Brown fell out with his co-founders that August and later sued, claiming he had been ousted and was entitled to a third of the company. Whether he had been a co-founder at all was disputed, which is precisely the kind of question a founders’ agreement exists to settle. The case settled in September 2014 for $157.5 million.

The same year, Snapchat settled US Federal Trade Commission charges that it had misled users about how completely their messages disappeared, committing to a privacy programme monitored by an independent expert for 20 years. By then it had already brought legal inside. In early 2014, as employee number 55, Chris Handman joined from Hogan Lovells as its first General Counsel, and went on to oversee policy and compliance as well as legal through the company’s 2017 IPO.

A General Counsel at fewer than 60 people is unusually early and will not be the right first move for most businesses of that size. What makes the case instructive is the trigger rather than the timing: a product built on a privacy promise, an ownership structure that had become extremely valuable, and regulators who were now paying attention.

When does an in-house hire start to make sense?

Every one of these businesses could, in theory, have instructed a law firm at any point. In practice, a law firm only sees what it is sent, charges for each look, and is almost never sent a £7,490 purchase order, a maintenance renewal or the settings on an ad network. The documents that did the damage here were never going to justify an external instruction on their own, which is precisely why they went unread.

In-house capability changes that equation. The lawyer is already part of the team, so reading the small print carries no extra cost, and they sit close enough to the business to see the marketing plan, the product settings and the founders’ arrangements before they go live rather than after something goes wrong. The circumstances that most often bring that first hire forward include:

• Contracts on other parties’ terms. A steady volume of agreements signed on the other side’s paper, particularly those tied to physical operations or critical systems.
• Regulated data or activity. Health, financial or children’s data, or a sector with an active regulator.
• Ownership events. New co-founders, investment rounds, share option schemes or an exit on the horizon.
• Growth past one person’s reach. The point at which a founder or finance director can no longer realistically read everything that gets signed or launched.

The first hire in these situations is rarely a specialist. More often it is an experienced commercial generalist who works independently across contracts, data protection, employment and corporate matters, and who becomes the person colleagues think to ask before they sign or launch. The work that used to go unread gets read, and much of the work that used to go to a law firm by default stays in the building. Set against the sums above, the cost of that hire tends to look modest.

The common thread

None of these businesses were careless in any dramatic sense. A maintenance agreement was signed without a second look. A purchase order went out on a supplier’s terms. A pharmacy’s policies drifted out of date. A retailer read its customers’ shopping baskets a little too closely. A games studio trusted a disclaimer. Friends started a company without settling who owned what. In each case the risk was visible years before it became a loss, and the cost of catching it would have been measured in hours rather than millions.