On 22nd August 2025, the Court of Appeal overturned a High Court decision and handed down a landmark judgment in Farley & Ors v Paymaster (1836) Limited (trading as Equiniti).
The case concerned a large-scale data breach in which over 750 annual benefit statements of Sussex Police officers were mistakenly sent to outdated addresses. The information in each statement varied but broadly contained the officer's name, date of birth, national insurance number, and details of their salary and pension.
More than 450 officers brought claims under the GDPR and Data Protection Act 2018, alleging distress, fear of misuse, and in some cases psychiatric injury.
The High Court had previously struck out most claims, holding that compensation was only available if the claimant could show that unauthorised third parties actually accessed their data and that claims below a “threshold of seriousness” were not legally viable. Only 14 claims survived.
The Court of Appeal has now overturned that position, holding that data protection rights are breached by unlawful processing alone, and found that even minor errors in handling personal data can now lead to liability.
The Court of Appeal also dismissed the argument that claims meet a threshold of seriousness and ruled that there is no minimum level of harm that must be crossed before compensation can be awarded.
The judgment has clarified that unlawful processing alone is enough for a claim, and also importantly, the court rejected the idea that low-value cases do not deserve to be heard and should be managed proportionally.
There may now be an increase in these types of claim.
See link to judgment here:
https://www.judiciary.uk/judgments/farley-and-others-v-paymaster-1836-limited-trading-as-equiniti/
