Michael Farley v Paymaster (1836) Ltd (Trading as Equiniti)

Hearing dates: 17 and 18 June 2025

Approved Judgment

This judgment was handed down remotely at 10am on 22 August 2025 by circulation to the parties or their representatives by e-mail and by release to the National Archives.

Introduction and summary

This is an appeal from an order striking out most of the individual claims in a collective action arising from a data breach. It raises issues about the interpretation and application of the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018 (“ DPA”).

The appellants are 432 members of a pension scheme administered by the respondent. Their annual benefit statements (“ABS”) were mistakenly posted to addresses that were wrong because they were out of date. The appellants alleged that this was a misuse of their personal information and an infringement of the GDPR. They and others brought this action seeking compensation for injury to feelings, and in some cases psychiatric injury, suffered due to fear of third-party misuse of their personal data. Fourteen of the claimants could show an arguable case that the mis-addressed envelope had been opened and their ABS had been read. But the High Court held that none of the appellants had any tenable case that this had happened to them. For that reason, whilst allowing the 14 claims to go forward the court struck out the appellants' statements of case as disclosing no reasonable basis for a claim. They now appeal against the dismissal of the data protection claims.

The appellants do not challenge the judge's conclusion that they cannot show that their ABS came to anyone's attention. They contend however that the judge was wrong to regard disclosure as an essential ingredient of a viable data protection claim. They say they have a tenable case that the mistake involved infringement of their data protection rights.

The respondent does not defend the judge's finding or reasoning on the issue of infringement but invites us to uphold the judge's decision to dismiss the claims on the basis that the claims for compensation are factually incredible, insufficient or untenable as a matter of law, or so trivial that they should be dismissed as an abuse of process of the kind identified in Jameel v Dow Jones Inc [2005] EWCA Civ 75, [2005] QB 946. These are all points which the respondent took before the court of first instance, but on which the judge did not rely. As the appellants have pointed out, the respondent needs the court's permission to argue some of them in this court. The respondent has also modified its arguments to some extent. I would however grant the necessary permission, and I understand the other members of the court agree.

The main issues can therefore be summarised as follows: (1) have the appellants set out a reasonable basis for claiming that the respondent's mistake involved infringement of the GDPR (“the infringement issue”); if so, (2) have the appellants stated a basis for claiming compensation under the GDPR and DPA that is reasonable, with a realistic prospect of success at a trial (“the compensation issue”); and if so (3) are the claims nonetheless an abuse of process of the Jameel variety (“the Jameel issue”)?

We have read and heard argument on those issues on behalf of the appellants, the respondent, and the Information Commissioner, who intervened at the prompting of the court. Having reflected on the helpful submissions of Counsel, and for the reasons given below, I have reached the following conclusions.

(1) The judge was wrong to strike out the data protection claims for the reason he gave. Each of the appellants has pleaded a reasonable basis for alleging that the respondent's mistake involved infringement of the GDPR. Proof that the data were disclosed is not an essential ingredient of an allegation of processing or infringement. The appeal on the infringement issue should therefore be allowed.

(2) As to the compensation issue:-

(a) The respondent is not entitled to judgment on the grounds that the appellants' factual allegations are simply incredible. An allegation of “distress” is not, as the respondent has submitted, an essential ingredient of a tenable claim. Nor can the claims be dismissed for failing to meet a threshold of seriousness. There is no such threshold in EU data protection law. We are not bound to hold that such a threshold exists in domestic data protection law. Nor is there any other good reason to do so. The judge's decision cannot be upheld on any of these grounds. To this extent the cross-appeal should be dismissed.

(b) The respondent is however entitled to contend that the appellants' fears of third-party misuse were not “well-founded” and hence cannot qualify as “non-material damage” for which compensation is recoverable under the GDPR. The question of whether a claim based on the fears alleged could prevail can be determined at this stage. The fate of the claims for consequent psychiatric injury appears to turn on the outcome of that issue. There are no other properly pleaded compensation claims. So the answer to this question could be decisive for at least some of the claims. But the question must be answered case by case. This is not the appropriate court to carry out that exercise. Other things being equal, the case should be remitted to the High Court which may conduct the review itself or give directions for it to be carried out in the County Court.

(3) The Jameel jurisdiction does not provide a reason to bypass that process. These claims as a class cannot be categorised as Jameel abuse although the question of whether any individual case is abusive will remain for consideration.

The background in more detail

The data breach

In late August 2019 the respondent, acting as administrator for the pension scheme covering the Sussex Police, sent ABS by post to members of the scheme. The ABS took the form of a letter headed “Private and Confidential”, with the scheme member's name, and the postal address (“the Header”). Under the subject line “Sussex Police Pension Annual Benefit Statement” the body of the letter set out further personal information including the date of birth, and national insurance number of the scheme member, and pension-related details including their police service, salary details, and their accrued and forecast pension benefits. The ABS were sent in window envelopes. Through the window could be seen the Header. On the outside of the envelope was a return address.

A substantial number of these ABS, in excess of 750, were posted to out-of-date residential addresses. The evidence is that Sussex Police had provided the respondent with up-to-date addresses which were uploaded to the respondent's database but when the ABS were produced the system “picked up a previous address” in error.

By 24 September 2019 the mistake had come to light. A substantial number of ABS had been returned to the respondent unopened. Some officers had reported not receiving theirs. In early October, Sussex Police sent a notification letter to each affected officer. This informed the officer whether or not the ABS had been returned to Equiniti or Sussex Police. It reported that “the risk of harm arising from this breach is assessed as low”, but gave advice on protective steps. Officers were offered the opportunity to sign up to a fraud protection service called CIFAS at the respondent's expense. The evidence is that 37 officers did so. The letter advised recipients that Sussex Police had notified the Information Commissioner's Office (“ICO”). At about the same time the respondent sent out letters of apology with replacement ABS.

On 17 October 2019, the ICO wrote to Sussex Police. It noted that “the breach was caused by” the respondent, described as Sussex Police's “data processor”. The respondent had been notified of changes of address but had “failed to effectively update their systems”. The ICO further noted that Sussex Police had conducted a risk assessment that concluded that the risk of data subjects suffering significant consequences was “unlikely”, that advice on identity theft was to be given to the affected data subjects and concluded that no further action was required.

Some 102 ABS were returned to the respondent unopened. It seems some may have been forwarded unopened to the scheme member. Around 60 officers were able to retrieve the ABS themselves. The majority of ABS were never recovered and it remains unknown what happened to them.

The claims

A substantial cohort of affected officers instructed solicitors who wrote a letter of claim. The respondent admitted that there had been a data breach and that the officers were “entitled to pursue the [respondent] for loss, damage and/or distress allowable at law”. The officers' solicitors provided a schedule of damages claimed by those who did not claim to have suffered personal injury, seeking £2,000 each for misuse of private information and figures between £1,064.80 and £2,606.30 for infringement of their data protection rights. By the time of the hearing below the figure had been revised downwards...