Important recent decisions demonstrate that the landscape of data privacy claims in England and Wales has continued to become more challenging for claimants.

This important space for claims continues to be a key risk for companies and many actors supporting claimants remain focused on pursuing commercially viable structures.

However, in the context of both representative actions (such as Lloyd v. Google, which we discuss fully here) and those bringing claims in their sole names (for example, Cleary v. Marston (Holdings) and Driver v. CPS, summarised here alongside other data privacy developments), the English courts have continued the recent trend of raising obstacles to successful large-scale claims.

The most recent such case is Farley and Others v. Paymaster (1836) Limited (trading as Equiniti) [2024] EWHC 383 (KB). Nicklin J recently handed down his judgment which reiterates and reinforces the present barriers to data breach claims by individuals.

This article explains the details, examines the challenges to data breach claims highlighted by the decision, and considers what businesses can take from this trend.

The facts

The action concerns data breach claims by 474 current and former officers of the Sussex police force. Each sought damages for the misuse of their private information and breach of the UK GDPR and/ or the Data Protection Act 2018.

Equiniti (the administrator of the claimants' pension scheme) had sent out envelopes containing their pension benefit statements to the claimants' former rather than current addresses. The statements included each individual's name, date of birth, national insurance number, and details of their salary and pension, as well as their occupation as police officers.

The majority of the officers made claims based on the risk that third parties would have access to the envelopes given the misdirection. They claimed that there ought to be an inference that their envelopes had likely been opened. They claimed for distress and anxiety caused by the perceived risk of falling victim to identity theft.

The remaining officers (limited to 14) asserted that the envelopes were in fact likely to have been opened. They had provided direct evidence that the letters were opened, albeit in the majority of cases (11 of the 14) the evidence indicated that family members of the claimants had done so.

Cut off at the pass: the insufficiency of inferences

Nicklin J struck out all of the claims other than those of the 14 officers pleading on the basis that their envelopes were in fact likely to have been opened.

The judge was not convinced by the arguments for the claimants that, unless Equiniti could prove otherwise, he should draw an inference that the envelopes were opened and read by third parties. Similarly, the judge was not persuaded by arguments that the claimants ought to be compensated for being put at risk of the correspondence being opened by third parties.

Nicklin J emphasised that the envelopes were each marked as "private and confidential" and clearly stated a return address. The envelopes were not expressly addressed to police officers. He noted that the "drawing of inferences is an evidential process…to be contrasted with speculative guesswork or wishful thinking" (para 149). In these circumstances, it was not appropriate to infer that a third party would open the correspondence.

He summarised that "to have a viable claim for misuse of private information and/or data protection, each Claimant must show that s/he has a real prospect of demonstrating that the [pension statement] was opened and read by a third party. Without that, the relevant Claimant would have no real prospect of demonstrating that there had been 'misuse', an essential element of the tort of misuse of private information" (para 143). 

There may be some helpful inferences that companies could draw here in the context of cyber breaches where forensics on access or exfiltration of data is inconclusive without other aggravating factors (such as involvement of a known malicious actor). Nicklin J emphasised that near misses are not generally a basis for a claim for misuse of private information, even if the perceived risk causes "significant distress" (para 145). He noted that the law of tort does not typically allow damages for the apprehension that a tort may have been committed, drawing an analogy with a pedestrian's failure to recover damages for almost being struck by a passing lorry.

It appears that there is little prospect for success in a claim for misuse of private information unless the information in fact falls into the hands of a third party or that there is stronger circumstantial evidence to support the likely access and/or misuse of the data, although it is likely there may be less sympathy where the defendant has suffered a material security failing (rather than an accidental mislabelling of addresses).

In the absence of an evidential basis for the claimants' proposed inference, Nicklin J accordingly disposed of the majority of the claims by way of summary judgment. 

Quantification of the claims and costs of proceedings

Perhaps the most significant hurdle to individual data breach claims is the practical difficulty faced in bringing such claims in a cost-effective and proportionate manner. These do not suffer from the need to demonstrate that all members of the class have been equally affected. However, this limits the options for individual claims.

It was observed that the claimants' choice to proceed as a class enabled them to bring the action in the High Court (rather than as individual small claims in the County Court, which would not allow for the recovery of costs). Additionally, the claims in respect of misuse of private information allowed the possibility of recovering ATE premiums (which would not be recovered for claims for breach of data protection law).

However, it was clear that the claimants could not hope to recover any meaningful sums in the action.

In Farley, the claimants each quantified their claims at around £1,500 (with higher payouts expected for those who also claimed to have suffered personal injury, namely the exacerbation of existing conditions resulting from anxiety caused by the breach). Nicklin J expressed his concerns regarding the proportionality of proceedings, highlighting that the claimants had each incurred costs of around £2,500 prior to issuing their respective claims. 

Claimants accordingly face acute financial challenges as well as a difficult legal landscape in bringing successful data breach claims.

The road ahead

Those seeking to bring claims for the wrongful release of employment details appear to face a particularly high barrier to data breach claims. Serving and retired police officers may feel that there ought to be particular sensitivity regarding their occupations, but this did not influence the judgment. This is potentially a further indication of the de minimis amount that could realistically be pursued for any data-related injuries.

Nicklin J was content to allow the remaining 14 cases to proceed, on the basis that the claimants each had a real prospect of demonstrating that their respective letter was opened by a third party. However, he has already noted that some of these claims may ultimately be dismissed on the basis of failure to meet the threshold of seriousness. The court also raised the likelihood of preliminary proceedings as to whether Equiniti acted as a controller or processor of the claimants' information in terms of the GDPR, meaning extended legal costs.

Data controllers will hope that the continuing judicial scepticism towards low-value data privacy claims serves to discourage such claims in the future.

Key takeaways for businesses that act as data controllers are:

• Data privacy non-compliance and breaches remain a focus area for claimants (and claimant firms) seeking to find mechanisms for recovery – and they do not rely on active security breaches to bring these sort of claims.
• Assessing and implementing sensible protections and controls can be a powerful mitigating tool (such as the application of "private and confidential" to the envelope) – although this is more complex in a digital environment.
• Successful claims for low-impact data non-compliance remains very challenging under the courts of England and Wales – a point to remember when requests for goodwill compensation are being made in conjunction with data protection complaints.