Michael Farley (formerly CR) & Ors v Paymaster (1836) Limited

A viable claim for misuse of private information or data protection requires a real prospect that the misdirected document was opened and read by a third party. Mere risk, apprehension or temporary loss of control is insufficient where the document was returned unopened. A bare inference that a letter marked private and confidential was read by a third party is inadequate without supporting facts.

Claims supported by evidence that the document was opened and read may proceed, subject to proof of the relevant privacy interest, damage and any applicable seriousness threshold. The court declined to decide whether data protection claims involve such a threshold. Jameel abuse requires an exceptional case in which no proportionate procedure can be fashioned.

More than 400 current or former Sussex Police officers claimed damages against the administrator of their pension scheme following the posting of annual benefit statements to out-of-date addresses. The claims alleged misuse of private information and breach of the GDPR and Data Protection Act 2018, including distress and alleged personal injury.

The defendant applied for striking out, summary judgment and dismissal for abuse of process. A related claim for personal injury was issued protectively by a sub-group. The court also considered anonymity, withholding of addresses and restrictions on access to individual schedules.

1. Disposition. Except for 14 claims in which there was evidence that the annual benefit statement had been opened, the claims were struck out or dismissed. The remaining 14 claims were not dismissed as abusive. Anonymity was maintained for nine claimants, and the claimants’ addresses could continue to be withheld. A blanket restriction on third-party access to all individual schedules was refused.
2. Misuse and data protection. A claimant must have a real prospect of showing that the statement was opened and read by a third party. Where private information was thereby disclosed, the defendant’s negligent sending of the statement to the wrong address could constitute misuse. The case was closer to TLT than to cases involving hacking or cyber-attacks, where the defendant had not itself misused the information.
3. Returned documents. Where a statement was returned unopened, there was no viable claim. A near miss or apprehended tortious wrong does not ordinarily support recovery. Without third-party access, there was no interference with the relevant Article 8 privacy interest and no real processing of the personal data for the pleaded purpose.
4. Inference. Inferences require an evidential foundation and cannot be based on speculation. A letter addressed to a named recipient and marked private and confidential will not ordinarily support an inference that it was opened by an unauthorised third party. The few positive examples did not establish a general inference.
5. Remaining claims. The 14 claims had a real prospect of success, although the claimants still had to prove that the statements were read, the extent of the reading, the seriousness of any misuse and the damage suffered. These matters required a trial. The court deliberately expressed no concluded view on whether data protection claims in England and Wales contain a seriousness threshold.
6. Jameel abuse. The power is exceptional. The question was whether a proportionate procedure could be devised, not simply whether likely damages were modest compared with costs. With only 14 claims remaining, a preliminary determination of common liability issues followed, if necessary, by transfer to the County Court for damages, was a possible proportionate course.
7. Open justice. Derogations require clear and cogent evidence and must be necessary and proportionate. Individual evidence alone was insufficient to justify withholding addresses, but the police force’s policy concerning officers’ home addresses, combined with the nature of the litigation, justified that limited order. A blanket restriction on all schedules was disproportionate.