Data claims must be proved: lessons from the Court of Appeal on non-material damage

Ever since Lloyd v Google [2021] stemmed the flow of mass data protection litigation, potential claimants have sought new ways to bring claims against controllers that, by accident or design, have ‘mishandled’ individuals’ their data. The recent Court of Appeal (CoA) judgment in Farley & Ors v Paymaster (1836) Limited t/a Equiniti [2025] clarifies important points on when and how individuals can claim for non-material damage and the risk that individual claims may be found to be an abuse of process. 

What was the case about? 

In 2019, Equiniti, a pension administrator, mistakenly posted the annual benefit statements (ABS) of over 400 police officers to the wrong individuals. The officers then collectively sought damages for breach of statutory duty under the UK GDPR and the Data Protection Act 2018 (together DP Law) and/or misuse of private information. 

In February 2024, the High Court struck out all but 14 of those claims on the basis that, as the relevant ABSs had not been opened and read by a third party, there was no reasonable basis for a claim. 

Key elements of the CoA judgment 

Largely adopting the ICO’s submissions as intervener, the CoA held that:

• processing should not be seen in an atomised way. Whether data was disclosed is not an essential ingredient of an infringement under DP Law and so the High Court was wrong to strike out the data protection claims; 
• as a point of principle, compensation for emotional responses other than distress can be recoverable under DP Law; and
• adopting EU law (an interesting point in itself, see below), there is no threshold for “seriousness” under the UK GDPR and DPA.

However, 

• the claimants still have to prove their factual allegations. Equiniti was perfectly entitled to contend that the claimants’ fears of third-party misuse were not “well-founded” and hence could not qualify as “non-material damage” for which compensation is recoverable under DP Law; and
• this means that each claimant’s case must now be assessed by the High Court (and potentially the County Court).

The Court also found that claims as a class cannot be categorised (and dismissed) as Jameel abuse of process but any individual case could still be found to be abusive when assessed by the High Court or County Court. 

Takeaways for claimants and controllers

Overall, this is a clear decision on how to assess non-material damage, the questions defendants can ask when facing potential claims and those claimants should have asked before bringing such claims. If not appealed, it will likely stand as a further key reference point for data-related claims and risk assessments. In particular:

• Warby LJ’s comprehensive review of both UK and EU case law may well become a ‘go-to’ source of reference. This also included post-Brexit CJEU jurisprudence. Given the common background to the EU and UK GDPRs and their international reach, his view that it “makes good legal sense for the court to interpret and apply the GDPR in conformity with settled CJEU jurisprudence” will help businesses navigating today’s complex digital regulatory landscape. 
• Equiniti’s role as a controller or processor was left as a live question. Taken with recent ICO enforcement against processors (see our blog here), this is a reminder that organisations will need to be clear who is doing what with data (including who will defend potential claims). Pension trustees might look again at terms with scheme administrators. 
• Controllers should take account of this case in their data privacy risks assessments, including how best to communicate with their customers/members on a large scale.

In any event, while there is clearly a high bar for abuse of process and/or cost and proportionality barriers to bringing claims, the fact that the case will be returned to the High Court or County Court means there is likely to be continued uncertainty (and risk) for claimants and/or litigation funders when considering whether to bring claims. Businesses and litigation funders will want to keep a close eye on what happens next, in particular whether, on their individual facts, the claims are held to be well-founded, and the cost consequences that follow.