Michael Farley & Anor v Paymaster (1836) Limited (trading as Equiniti)

“Processing” under the General Data Protection Regulation has a broad meaning. A data protection claim may therefore arise from operations performed on personal data, including admitted automated processing and the production and posting of documents, without proof that an unauthorised third party read the data.

Under Article 82, compensation requires material or non-material damage caused by an infringement, but neither distress nor a minimum threshold of seriousness is an essential element. Fear of future third-party misuse may constitute non-material damage only where it is objectively well-founded in the claimant’s particular circumstances. A hypothetical or speculative risk is insufficient. Low-value claims are not, without more, a Jameel abuse; their merits and proportionate procedure must be assessed individually.

The appellants were 432 members of a police pension scheme. The respondent mistakenly sent their annual benefit statements, which contained personal and pension information, to former residential addresses. Most statements were not recovered and the appellants did not contend that their own statements had been opened or read by a third party.

Nicklin J struck out all but 14 claims, holding that disclosure to, or reading by, a third party was essential to a viable data protection claim: [2024] EWHC 383 (KB). The appellants appealed. The respondent sought to uphold the result by summary judgment or as a Jameel abuse, contending that the alleged emotional harm was incredible, legally insufficient, below a seriousness threshold, or based on irrational fears.

The central issues were whether the pleaded conduct involved processing and infringement, whether fear of third-party misuse could found compensation, and whether the individual claims should nevertheless be dismissed as abusive.

1. Appeal allowed. The judge erred in treating third-party disclosure as indispensable. The respondent admitted operations which were processing of personal data, and there was no basis for striking out the allegations concerning the production and posting of the annual benefit statements. Processing under Article 4(2) of the General Data Protection Regulation is broad. Disclosure is one illustrative operation, not a necessary condition of processing or infringement.

2. Compensation under Article 82. A claimant must prove material or non-material damage caused by an infringement. Non-material damage is not confined to distress. Section 168(1) of the Data Protection Act 2018 confirms that distress is included, rather than limiting the wider Article 82 concept. There is no minimum seriousness or de minimis threshold for damage which otherwise qualifies as non-material damage. The court declined to depart from the settled, albeit post-completion-date, CJEU jurisprudence.

3. Well-founded fear. Fear of future misuse of personal data can in principle be compensable non-material damage. It must, however, be objectively well-founded when assessed by what the claimant knew or ought then to have known, rather than by hindsight. Each claimant must plead and prove a reasonable basis both for fearing that the statement would be opened and read, and for fearing consequential misuse. The generic pleading could not supply that foundation. The same conclusion governs psychiatric harm consequential upon such fear.

4. Remittal. It was inappropriate for the Court of Appeal to conduct the necessary claimant-by-claimant review of thousands of pages of schedules. The question whether each pleaded fear was objectively well-founded was remitted to the High Court, which could determine the appropriate forum and directions. Claims for irritation or annoyance at the breach itself, notification, or handling of it were outside the pleaded master case absent amendment.

5. Jameel. The cross-appeal on abuse was dismissed. Abuse must be assessed by reference to each individual claim. A modest likely award and collective presentation do not alone justify striking out an otherwise viable claim. Proportionate case management and costs powers should ordinarily be considered before that last resort. Whether any individual surviving claim is abusive remains for consideration on remittal.

• Court of Appeal (Civil Division): Allowed the claimants’ appeal, dismissed the respondent’s cross-appeal on the pleaded grounds, and remitted the individual assessment of compensation claims and any individual abuse issue.
• High Court of Justice, King’s Bench Division, Media and Communications List: Nicklin J struck out all but 14 claims on the basis that the annual benefit statement had to have been opened and read by a third party: [2024] EWHC 383 (KB). That basis for striking out was rejected.