An individual suffers a data protection breach and claims compensation – often as part of a group. What kinds of consequence can they claim for? How serious do those consequences need to be for there to be a viable claim? These are pivotal issues in data protection litigation, from both commercial and legal perspectives. The Court of Appeal’s very recent judgment in the Equiniti litigation is hugely important on these fronts: see Farley and Others v Paymaster (1836) Limited (trading as Equiniti) [2025] EWCA Civ 1117.
The appeal was against Nicklin J’s decision to dismiss all but 14 of the 474 claims by current and former Sussex police officers, who sought compensation in the region of £1,250 to £1,500 per head based on Equiniti (who asserts that it acted as a processor for Sussex Police) inadvertently sending envelopes containing their pension benefit statements to outdated addresses in 2019. The 14 whose claims survived had pleaded a case (beyond mere inference) about the opening of their envelopes. Nicklin J concluded that the remaining compensation claims could not get off the ground: their claims amounted to nothing more than a ‘near miss’ (in terms of their data being misused), which was not actionable. I explained that judgment in more detail in this post.
The Court of Appeal (Warby LJ, with whom Whipple LJ and King LJ agreed) allowed the appeal brought against Nicklin J’s decision to strike out the data protection claims.
There was one fairly arid preliminary issue: where the personal data at issue was contained in envelopes that were apparently not opened by any third party, was there any “processing” for GDPR purposes? Nicklin J thought not (though Equiniti had not themselves advanced any such argument below or before the CoA and had always accepted that they had undertaken processing). The CoA – aided by analysis from the intervener, the ICO – concluded otherwise: see e.g. paras 36 and 39. Given the breadth of the term “processing”, that was clearly right.
The real heart of the appeal was recoverable damage: had the claimants pleaded a case on material or non-material damage that could in principle sound in compensation, and was it fanciful and hopeless on these facts for them to seek compensation? The CoA concluded that Nicklin J’s decision to strike out all but 14 of the claims (on the basis of “no processing”) was flawed, with the result that the strike-out application has been remitted to the High Court for case management. In other words, the fundamental issue as to the viability of these claims remains to be determined. Nicklin J’s decision is set aside, but the claims may still be struck out once the remitted strike-out application is reconsidered. In doing so, the CoA rejected the claimants’ argument that the strike out application was misconceived and that the claims should therefore proceed to trial.
Before the CoA, the amended master/generic pleading formulated the claimants’ compensation case like this: Equiniti’s alleged contravention caused the claimants to suffer “anxiety, alarm, distress and embarrassment” for fear that their personal data “may have” passed into the hands of unknown third parties; further or alternatively, they sought compensation “as a result of uncertainty” about what may have happened if envelope-opening took place (my emphasis). Basically, the claimants were saying: in order to survive strike-out, it is enough to plead anxiety (and suchlike) as to the prospect or possibility that our data was misused: see para 43.
Side-point: some of the claimants also pleaded exacerbation of pre-existing medical conditions, which the CoA was not prepared to strike-out at this stage. Recognisable psychiatric harm is categorised as personal injury, which is a compensable form of harm (whether classified as material or non-material). So if a claimant advances an “objectively well-founded” well-founded case, they could in principle advance these ‘exacerbation of medical conditions’ cases: see paras 91-92. Again, it remains to be determined whether any of the claimants in this case pass that test.
The heart of the case was whether fear of possible misuse could sound in compensation, as a matter of legal principle and on the facts of this case.
Equiniti argued, among other things, that non-material damage could only sound in compensation if it constituted “distress”. No, said the CoA: that was too formalistic; distress is a type of non-material damage, but it is not the only type, and it would be wrong to get bogged down in trying to set parameters for what was really an umbrella concept for various kinds of emotional harm: see paras 50-53. Not all “emotional responses” will sound in compensation; “fleeting or transient subjective reactions”, including e.g. annoyance or irritation, may not qualify as non-material damage: see para 50 and 95. But the test is not “does the individual’s reaction count as distress?”.
Nor is there a threshold of seriousness. On this point, the CoA found the CJEU’s rejection of a threshold of seriousness (see e.g. UI v Österreichische Post AG, as well as VB, VX, BL) logical and sufficient, and it was also clearly keen to keep the UK’s approach aligned with the EU’s: see paras 67 and 71. Nothing in Lloyd v Google (DPA 1998) or Prismall (misuse of private information) supported a threshold of seriousness for data protection claims in the UK.
But: a claimant still has to establish, on an objective standard of reasonableness, that they suffered non-material damage. See para 75, which is crucial: “in principle a claimant can recover compensation for fear of the consequences of an infringement if the alleged fear is objectively well-founded but not if the fear is (for instance) purely hypothetical or speculative”. This will now be the battleground for ‘viable compensation claim’ arguments, in this case and others.
How did the battle play out here? For litigators, a key point is to pay attention to how claims are pleaded, including (for group claims) as regards whether individual’s pleaded case sets out a sufficient basis for asserting that they suffered the consequences set out in the generic or master pleaded case. See para 84: “individual schedules can only be sufficient if they state a specific and reasonable basis for fearing that in the particular case of the appellant in question the envelope would be opened by someone and its contents read. If that much is pleaded, an individual schedule will still fall short unless it also sets out particular circumstances amounting to a reasonable basis for fearing that the information in the ABS might be misused in one of the ways set out in the draft Amended Master Particulars”.
Pleading points aside, what was the upshot in this case? Equiniti argued that, while Nicklin J’s reasoning in support of the strike-out may have been flawed, his instincts were sound: “it simply cannot be the case that police officers, used to contending with dangerous and upsetting situations, have been genuinely distressed over a pensions forecast sent to an old address” (see para 26). The CoA was not prepared to uphold a strike-out on that basis at this stage: it was certainly alive to weaknesses in these claims (see eg paras 82-83), but the claims could not be struck out simply because hindsight showed most envelopes were unlikely to have been opened, or because the claimants pleaded their upset using duplicative stock phrases. The claims might ultimately be struck out or they might ultimately fail, but the CoA was not prepared to uphold Nicklin J’s basis for the strike-out.
The Jameel abuse of process argument (low value claims not worth the candle of expensive litigation) did not salvage Nicklin J’s strike-out decision. “The modest scale of the likely recovery cannot of itself be sufficient to justify dismissal of the claim” (para 101). And it is not easy to strike out an entire cohort on this basis: “an individual claim is either abusive or it is not; it cannot amount to an abuse of process merely because it is linked with or brought in conjunction with one or more other claims, even if those other claims have features of abuse” (para 100). Again, this is not the end of the road for Jameel arguments in this case: they may have traction on the facts of any individual claimants’ particular case. But at a cohort level, this point did not suffice to shore up the decision made below.
The small claims track in the County Court may be the way forward for some claims of this kind, but – at least in this particular case – the immediate end of the road (i.e. strike-out or summary judgment) as reasoned and formulated by Nicklin J did not pass muster. Equiniti’s application will now be revisited upon remission, in light of the CoA’s analysis of where Nicklin J had gone wrong.
11KBW’s Andrew Sharland KC and Hannah Ready, instructed by Freeths, acted for Equiniti in the CoA, as they did below. Chris Knight appeared for the intervener, the ICO.
Robin Hopkins