How far will Farley go? Drawing the line on the threshold for GDPR compensation

Earlier this month, the Supreme Court heard Equiniti’s appeal in the Farley case, concerning compensation claims by police officers after pension statements were sent to outdated addresses. As discussed in our previous posts (here and here), the Court of Appeal reinstated the claims in August last year, reversing the High Court’s decision to strike out all but fourteen of them. 

This appeal is narrowly focused on the compensation issue: the Supreme Court must now decide whether non-material damage (e.g. distress or anxiety) must cross a threshold of seriousness to be compensable under Article 82 GDPR. Judgment may still be weeks or months away, but the hearing offers important practical takeaways for businesses.

A minimum seriousness threshold should not be taken for granted

Businesses should not assume that the Supreme Court will adopt a minimum threshold for non-material damage. In testing the legal basis for such a ‘bright line’, Lord Legatt observed that the often-quoted discussion in the Lloyd v Google case (see our post) was focused principally on the seriousness of the infringement, rather than a threshold of damage.

The hearing also underlined the difficulty of generalising about harm across a group. The Court questioned reliance on police officers’ training and experience as an indication that their alleged distress was implausible, noting that individual officers may have PTSD, anxiety, safeguarding concerns or heightened security fears.

In this context, the parties seemed to accept that Article 82 GDPR does not compensate every fleeting negative emotion. The real disagreement is whether those claims are excluded because they do not amount to “damage” at all, or because damage must cross a separate ‘de minimis’ threshold of seriousness. If the former, the focus shifts away from a universal threshold and towards the evidence showing whether the infringement actually caused damage (and, for distress-based claims, potentially whether that distress was objectively well-founded). 

In reaching a conclusion, the Court will need to clarify the relevance of CJEU case law under the UK GDPR, including Österreichische Post (which held that there is no threshold of seriousness for non-material damage, although damage must still be proved), and the scope for divergence post-Brexit. 

Small mistakes can still create significant litigation risk

If no separate threshold applies, even minor data-handling errors could result in compensation where actual damage is proved, making preventative controls more important. The claimants pointed to Equiniti’s failure to update address records and an earlier similar incident as evidence of a systemic failure.

The lesson is straightforward: get the basics right. It won’t be enough to assume that apparently innocuous information is risk-free. Organisations should review record-accuracy processes, minimise unnecessary data held across systems and address recurring errors or near misses promptly. A history of similar incidents can make an isolated administrative error look more like a systemic control failure.

Your breach response may become your best evidence

The hearing also highlighted the importance of evidence created following an incident. Equiniti pointed to matters including the recovery of misdirected statements, limited uptake of offered fraud protection, its risk assessment, the small number of complaints and the ICO taking no further action. The Justices questioned why that factual material could not be used to challenge individual claims on the evidence.

Equally, gaps in the evidence can create difficulties. The claimants stressed that an inability to establish that misdirected material was opened is not the same as knowing that it was not opened.

Businesses should therefore treat incident response as an evidence-gathering exercise as well as a remediation exercise. Clear contemporaneous records of what happened, whether information was recovered or accessed, the assessment of risk, communications with affected individuals and mitigation offered may ultimately be central to challenging alleged distress or fears of misuse.

Looking ahead

The Supreme Court’s decision should clarify whether compensation for non-material damage is subject to a threshold of seriousness or whether the requirement to establish “damage” does the limiting work itself. Until and unless there is an objective threshold to apply, businesses should not look to rely on “seriousness” as an early knock-out defence, but instead require actual or potential claimants to demonstrate that damage was actually suffered and caused by the infringement. 

Whatever the outcome, the practical message for businesses is clear: get the basics right, prevent minor errors from becoming systemic problems, consider the individuals affected and build a clear evidential record when incidents occur.

We will publish a further update once judgment is handed down.