Farley & Ors v Paymaster (1836) Ltd (t/a Equiniti)

Factual and Procedural Background

This appeal arises from an order striking out most individual claims in a collective action related to a data breach involving the misposting of annual benefit statements ("ABS") by the respondent, who administered a pension scheme for members including the appellants. The ABS contained personal data and were sent to outdated addresses due to a system error. The appellants claimed misuse of personal information and infringement of the GDPR and Data Protection Act 2018 ("DPA"), seeking compensation for distress and psychiatric injury caused by fear of third-party misuse. The High Court allowed 14 claims to proceed where there was an arguable case that the ABS had been opened and read, but struck out the remainder for failing to disclose a reasonable basis for claim. The appellants appeal the dismissal of their data protection claims.

Legal Issues Presented

1. Whether the appellants have set out a reasonable basis to claim that the respondent's mistake involved infringement of the GDPR ("the infringement issue").
2. If so, whether the appellants have stated a reasonable basis for claiming compensation under the GDPR and DPA with a realistic prospect of success ("the compensation issue").
3. Whether the claims constitute an abuse of process under the principles established in Jameel v Dow Jones Inc ("the Jameel issue").

Arguments of the Parties

Appellants' Arguments

• The judge erred in requiring proof of disclosure (opening and reading of ABS by a third party) as essential to a data protection claim.
• A cause of action under GDPR and DPA is complete upon infringement causing material or non-material harm.
• The appellants have pleaded a tenable case of infringement despite the absence of evidence that ABS were opened or read.
• The judge was wrong to hold that without third-party access there was no "real" processing or infringement.
• Claims for compensation based on fear of misuse of personal data are valid and the factual cases are not untenable.

Respondent's Arguments

• The judge's decision to dismiss claims should be upheld because the claims are factually incredible, legally insufficient, untenable, or trivial and thus abuse of process under Jameel.
• Claims for "loss of control" damages without proof of material damage or distress are not valid (although this point was later conceded).
• Many claims lack credibility given the nature of the breach and the claimants' emotional responses.
• Claims fail to meet any threshold of seriousness required under domestic data protection law.
• The litigation is disproportionate and a waste of court resources given the modest damages claimed.
• Each individual claim should be assessed for abuse of process; respondent submits all are abusive.

Information Commissioner's Office (ICO) Intervention

• Supported the appellants’ position that processing occurred despite no evidence of third-party access.
• Argued there is no threshold of seriousness for compensation under the GDPR.
• Suggested low value claims should be managed through case management and appropriate procedural tracks.

Table of Precedents Cited

Court's Reasoning and Analysis

The court first addressed whether the appellants had pleaded a reasonable basis that the respondent's mistake constituted "processing" under the GDPR and DPA. It found that the respondent’s activities, including recording, storing, printing, and posting ABS, constituted processing of personal data. The court rejected the necessity of proof that the data were actually disclosed or accessed by third parties to establish infringement.

Regarding compensation, the court considered whether claims based on distress or fear of misuse were tenable. It held that an allegation of distress is not an essential ingredient of a claim and rejected the existence of a threshold of seriousness for compensation under the GDPR, aligning with CJEU jurisprudence. However, the court emphasized that any fear of misuse must be objectively well-founded; mere hypothetical or speculative fears are insufficient.

The court examined the factual credibility of the claims and rejected the respondent’s submission that the claims were incredible, noting that emotional responses are matters within claimants’ own knowledge and that repetition of similar language in pleadings was not a sufficient basis for summary dismissal.

It concluded that individual claims must plead specific and reasonable bases for fearing that the ABS were opened and that misuse might occur. The court declined to determine the reasonableness of fears for all claims at this stage due to the volume and complexity, instead remitting this assessment to the High Court for case-by-case determination.

The court also considered claims for aggravation of pre-existing medical conditions caused by distress. It held these claims depend on the reasonableness of the underlying fears and thus stand or fall with the compensation claims.

The court rejected claims based solely on annoyance or irritation unconnected to fear of misuse as outside the pleaded case and likely not compensable.

On the issue of abuse of process under Jameel, the court noted that while the claims may be modest in value and have incurred significant costs, this alone does not justify striking them out. The court found that a proportionate procedure could be fashioned to adjudicate the remaining claims and that the appellants’ conduct did not amount to abuse of process. Individual claims may be assessed for abuse at a later stage.

Holding and Implications

The court ALLOWED the appeal on the infringement issue, holding that proof of third-party disclosure is not essential to establish infringement under the GDPR and DPA.

On the compensation issue, the court DISMISSED the respondent’s cross-appeal seeking dismissal on grounds of incredibility, lack of distress, or threshold of seriousness, but GRANTED permission to remit the question of whether the appellants’ fears of misuse are objectively well-founded to the High Court for individual determination.

On the abuse of process issue, the court DISMISSED the respondent’s application to strike out claims as abuse of process and held that a proportionate procedure can be arranged for the remaining claims.

The direct effect is that 14 claims survive on the basis that there is evidence that ABS were opened and read, while the remainder are struck out or remitted for further case management. No new precedent was established beyond clarifying the application of GDPR principles to data breach claims without proof of disclosure. The judgment reinforces the broad scope of "processing" under data protection law and the availability of compensation for well-founded fear of misuse, subject to case-by-case factual assessment.