Farley v Paymaster – what’s next?

Background

In 2019, a pensions administrator sent the benefit statements of over 400 Sussex police officers to their former home addresses. The statements contained the members’ names, dates of birth, National Insurance numbers, salary and pension information, and an indication that they were police officers.

The claimants brought an “opt-in” group claim alleging that this was a misuse of their personal data and an infringement of the UK GDPR (the UK’s data protection law), and seeking compensation for the breach.

Journey through the courts

In 2024, the High Court dismissed the majority of the claimants’ claims, on the basis that they had not put forward a claim that their annual benefit statement had been opened by (as opposed to simply sent to) a third party.

On appeal in 2025, the Court of Appeal (CoA):

• Overturned the above aspect of the High Court’s decision, holding that claims for compensation can be brought on the basis that personal data has been sent to the wrong person: there is no need to prove that incorrectly addressed correspondence has been opened by a third party.
• Held that compensation under the UK GDPR in respect of “non-material damage” is not limited to distress. It can include other negative emotions suffered as a result of a data breach, for example stress or anxiety. However, “fleeting or transient subjective reactions” such as annoyance or irritation will not be enough.
• Stated that in principle, compensation is payable in respect of an individual’s “fear of the consequences” of a data breach, such as the misuse of their personal data by a third party, as long as that fear is “objectively well-founded” and not “purely hypothetical or speculative”. That fear also needs to be proven by the claimant.
• Held that under the UK GDPR, claims for compensation in relation to “non-material damage” do not need to pass a “threshold of seriousness” test. This will in principle make it easier for individuals to bring low-value clams for compensation.

The Court of Appeal’s decision, and whether UK GDPR claims for compensation in relation to “non-material” damage need to pass a “threshold of seriousness” test, will be considered by the UK’s Supreme Court on 7 and 8 October 2026.

Points to consider

In our briefing following the CoA’s decision, we discussed that while the CoA’s decision made it, in principle, easier to bring low value claims following a data breach, compensation is not available merely as a result of the “loss of control” of data. Individuals still need to prove that they suffered distress or anxiety as a result of a data breach. Proving that is not necessarily easy.

If the Supreme Court upholds the CoA’s decision that there is no “threshold of seriousness” test, we anticipate an increased volume of claims, or of complaints threatening those claims, alleging “non-material damage” such as distress following a data breach. This trend may be exacerbated by social media and a recent dramatic increase in data subjects using AI tools to make complaints and write lengthy and sometimes complicated requests for information (including data subject access requests) and legalistic claims for compensation. Those complaints and requests, in particular their stated timings for a response, are not always in line with data subjects’ rights.

Anecdotally, we understand that many controllers are (even with AI assistance) spending what they consider to be a disproportionate amount of time and resources responding to those requests and claims in line with their legal and regulatory obligations. Legal advice about how to respond can be key and can save time and effort for the controller, particularly noting the new right to bring data protection complaints directly to the responsible controller which may increase complaints in this area.

Controllers should also note the High Court’s recent decision in Good Law Project Ltd v Reform UK Party Ltd, which was the first to consider (in a strike-out / summary judgment application) the use of a dedicated procedure for group data breach claims to be brought by a representative body (Article 80 UK GDPR and section 187 DPA 2018). That application to strike-out was dismissed, which means that the representative group claim can now proceed through the Courts.

Further reading

Court of Appeal eases way for low-value compensation claims in pensions data breach case

The importance of marking pensions correspondence ‘private and confidential’ | Pensions Speedbriefs | Eversheds Sutherland

UK: New right to complain to organisations for UK GDPR infringement