No minimum threshold for data protection compensation claims confirms the Court of Appeal

The Court of Appeal’s judgment in Farley & Ors v Paymaster (1836) Ltd (t/a Equiniti) [2025] EWCA Civ 1117 held that there is no minimum level of non-material damage threshold to be met to bring a compensation claim for data protection infringement.

Background

The Court of Appeal considered a collective action brought by over 430 individuals, primarily Sussex Police officers, whose annual pension benefit statements (ABS) were sent to outdated addresses.

The ABS contained special category personal data, including national insurance numbers and employment details. The claimants alleged distress, fear of misuse, and in some cases psychiatric injury, despite few of the claimants being able to prove that the documents had been accessed by third parties.

The High Court had previously struck out all but 14 of the claims, holding that the claims under the General Data Protection Regulation (GDPR)/Data Protection Act 2018 (DPA) required proof of actual disclosure (otherwise no real processing had occurred), alternatively the claims had no real prospect of success. The High Court decision did not provide a view on whether UK law sets a seriousness threshold for data protection claims.

Brexit decision

It is worth flagging, this decision was based on the pre-Brexit data protection regime, but the Court of Appeal suggests there is no material difference between that regime and the current one.

Key issues on appeal

The Court of Appeal was asked to determine:

1. Whether the posting of ABS to outdated addresses constituted "processing" under the GDPR/DPA, even without evidence of third-party access.
2. Whether compensation could be awarded for non-material damage such as distress or fear of misuse, absent a threshold of seriousness.
3. Whether the claims were abusive under the principles established in Jameel v Dow Jones Inc i.e. proceedings may be abusive if the benefits from the claim being successful are wholly disproportionate to the costs incurred by the defendant in defending the claim.

Court of Appeal judgment – key takeaways

The Court of Appeal overturned the High Court’s decision making several important findings:

• Processing without disclosure: The act of printing and sending personal data to incorrect addresses constituted "processing" under the GDPR/DPA, regardless of whether the data was accessed or read by third parties
• No threshold of seriousness: There is no minimum seriousness threshold for compensation claims under GDPR/DPA. Minor emotional harm, such as distress or anxiety, may be compensable if such is objectively well-founded and that harm is caused by the infringement, but speculative or hypothetical fears are insufficient. This differs from a tortious claim for misuse of private information where a de minimis threshold must be met.
• Low-value claims not necessarily abusive: In clarifying whether a claim is abusive under the Jameel principles the Court of Appeal confirmed: each claim should be assessed individually and not in bulk; modest claims are not automatically abusive; all circumstances of the claim must be considered including the procedural context (e.g. a modest claim may appropriately be dealt with on a small claims track).

The decision confirms the ability to pursue compensation for data protection breaches without needing to meet a threshold of seriousness even when harm may be modest.