Supreme Court hears appeal over data breach claims and threshold of seriousness

The Supreme Court is this week (7-8 October) hearing an appeal over whether a threshold of seriousness of harm applies to claims for damages following a data breach.

The background to the case of Michael Farley and 431 others v Paymaster (1836) Limited (trading as Equiniti) - as set out by the Supreme Court - is that the 432 respondents are all current or former police officers with Sussex Police and members of a pension scheme administrated in 2019 by the appellant, Paymaster.

The police officers’ annual benefit statements were mistakenly posted to addresses that were wrong because they were out of date. Sussex Police had provided Paymaster with up-to-date addresses.

The statements set out personal information including the officer’s date of birth, national insurance number, and pension-related details including the officer’s police service, salary details, and accrued and forecast pension benefits.

The police officers alleged that this was a misuse of their personal information and an infringement of the GDPR. They and others brought a collective action seeking compensation for injury to feelings, and in some cases psychiatric injury, suffered due to fear of third-party misuse of their personal data.

Fourteen of the police officers could show an arguable case that the misaddressed envelope had been opened and that their statements had been read.

Paymaster sought an order striking out all the claims.

In the High Court, Mr Justice Nicklin held that none of the police officers had any tenable case that their statements had been read. Whilst allowing the fourteen claims to go forward, the court struck out the police officers’ statements of case as disclosing no reasonable basis for a claim.

The police officers appealed the order striking out most of the individual claims in the collective action arising from the data breach.

The Court of Appeal considered three issues. First, whether the police officers had set out a reasonable basis for claiming that Paymaster’s mistake involved infringement of the GDPR (“the infringement issue”).

If so, secondly whether the police officers had stated a basis for claiming compensation under the GDPR and DPA 2018 that was reasonable, with a realistic prospect of success at a trial (“the compensation issue”).

If so, thirdly whether the claims were nonetheless an abuse of process of the kind identified in Jameel v Dow Jones Inc [2005] EWCA Civ 75 where, even if proceedings raise an arguable cause of action, they are objectively pointless and wasteful (“the Jameel issue”).

The Court of Appeal (Warby LJ, with whom King and Whipple LJJ agreed) allowed the police officers’ appeal, finding that the judge erred in law by striking out the data protection claims.

On the infringement issue, the police officers had pleaded a reasonable basis for alleging that Paymaster’s mistake involved infringement of GDPR, for which proof that the data were disclosed is not an essential ingredient.

On the compensation issue, the Court of Appeal concluded that the judge’s decision applied the wrong test.

Finally, the Court of Appeal found that the Jameel jurisdiction did not provide a reason to bypass that process and, as a class, the claims could not be categorised as Jameel abuse of process.

Paymaster appealed to the Supreme Court on the compensation issue.

The Information Commission and the Open Rights Society are intervening.

A Supreme Court panel comprising Lord Sales, Lord Leggatt, Lord Burrows, Lord Stephens and Lady Simler is hearing the case.