Michael Farley and 431 others (Respondents) v Paymaster (1836) Limited (trading as Equiniti) (Appellant)

Permission to Appeal granted

Case summary
Permission to Appeal
Previous proceedings
Change log

Case summary

Case ID

UKSC/2025/0185

Parties

Appellant(s)

Paymaster (1836) Limited (trading as Equiniti)

Respondent(s)

Michael Farley and 431 others

Issue

Does a threshold of seriousness apply to claims for damages under the General Data Protection Regulation (“GDPR”) and Data Protection Act 2018 (“DPA 2018”)?

Facts

The 432 respondents are all current or former police officers with Sussex Police (“the police officers”) and members of a pension scheme administrated in 2019 by the appellant (“Paymaster”). Their annual benefit statements (the “statements”) were mistakenly posted to addresses that were wrong because they were out of date. Sussex Police had provided Paymaster with up-to-date addresses. The statements set out personal information including the officer’s date of birth, national insurance number, and pension-related details including the officer’s police service, salary details, and accrued and forecast pension benefits. The police officers alleged that this was a misuse of their personal information and an infringement of the GDPR. They and others brought a collective action seeking compensation for injury to feelings, and in some cases psychiatric injury, suffered due to fear of third-party misuse of their personal data. Fourteen of the police officers could show an arguable case that the misaddressed envelope and been opened and that their statements had been read. Paymaster sought an order striking out all the claims. In the High Court, Nicklin J held that none of the police officers had any tenable case that their statements had been read. Whilst allowing the fourteen claims to go forward, the court struck out the police officers’ statements of case as disclosing no reasonable basis for a claim. The police officers appealed the order striking out most of the individual claims in the collective action arising from the data breach. The Court of Appeal considered three issues. First, whether the police officers had set out a reasonable basis for claiming that Paymaster’s mistake involved infringement of the GDPR (“the infringement issue”). If so, secondly whether the police officers had stated a basis for claiming compensation under the GDPR and DPA 2018 that is reasonable, with a realistic prospect of success at a trial (“the compensation issue”). If so, thirdly whether the claims are nonetheless an abuse of process of the kind identified in Jameel v Dow Jones Inc [2005] EWCA Civ 75 (“Jameel”) where, even if proceedings raise an arguable cause of action, they are objectively pointless and wasteful (“the Jameel issue”). The Court of Appeal (Warby LJ, with whom King and Whipple LJJ agreed) allowed the police officers’ appeal, finding that the judge erred in law by striking out the data protection claims. On the infringement issue, the police officers had pleaded a reasonable basis for alleging that Paymaster’s mistake involved infringement of GDPR, for which proof that the data were disclosed is not an essential ingredient. On the compensation issue, the judge’s decision applied the wrong test. Finally, the Jameel jurisdiction did not provide a reason to bypass that process and, as a class, the claims could not be categorised as Jameel abuse of process. Paymaster appeals to the Supreme Court on the compensation issue.