In previous blogs (which can be read here and here). This case was discussed. That decision has now been appealed.
Background: the data breach
The case arose from a 2019 incident in which annual pension benefit statements (ABS) for Sussex Police officers were sent to out-of-date addresses due to an administrative error by Paymaster, the scheme administrator. The ABS contained sensitive personal information, including names, dates of birth, NI numbers, salary details, and pension forecasts.
Over 750 officers were affected. While some ABS were returned unopened, many were never recovered, leaving uncertainty about whether private information had been accessed by third parties.
The claims
A large group of officers (eventually 432 appellants) sought compensation under the GDPR and Data Protection Act 2018, arguing that the error amounted to unlawful processing of their personal data. They claimed damages for:
- Distress, anxiety, and fear that their data might have been misused;
- In some cases, psychiatric injury or exacerbation of existing conditions; and
- Initially, “loss of control” damages (later abandoned following the Supreme Court’s decision in this case.
At first instance, the High Court struck out all but 14 claims, holding that without proof the ABS were opened and read by a third party, there was no viable claim.
The Appeal
The Court of Appeal disagreed with the High Court on several key points:
- Disclosure not required for infringement
- The Court held that proof of disclosure to a third party is not an essential ingredient of a GDPR breach.
- Misaddressing and posting the ABS was itself “processing” and could amount to an infringement.
- No threshold of seriousness in data protection law
- The Court rejected the argument that only “serious” distress or damage is actionable.
- European Court of Justice case law makes clear that even minor non-material harm (such as anxiety or embarrassment) can be found a claim, but would still be subject to the Claimant still proving such harm.
- Fear of misuse can be compensated — if well-founded
- The Court accepted that fear of future misuse of data may qualify as non-material damage, but Courts must test whether the fear is reasonable and well-founded on a case-by-case basis.
- No blanket strike-out as Jameel abuse
- The respondent argued the claims were too trivial and disproportionate to justify litigation. The Court rejected this, ruling the cases could not be dismissed wholesale as an abuse of process, though individual weak claims may still be struck out later.
What happens next?
The claims will be remitted to the lower Court for further review of individual cases. Each claimant’s allegations of distress or psychiatric injury will need to be assessed on their own merits.
Why This Matters
This judgment is important for several reasons:
- Data breach claims survive without proof of third-party access. A mistake in handling data can be enough to establish infringement.
- Compensation claims remain viable for low-level emotional harm. English courts will not impose a seriousness threshold that limits recovery.
- Fear of misuse is recognised — but not automatically. Courts will look closely at whether the fear is rational and justifiable in the circumstances.
- Collective actions remain challenging. While claims are not struck out as trivial, case-by-case scrutiny will limit mass payouts.
How can we help?
Kevin Modiri is a Partner in our expert Dispute Resolution team, specialising in civil disputes, insolvency, inheritance disputes, data breach claims and defamation claims.
If you have any questions concerning the subjects discussed in this article, please do not hesitate to contact Kevin or another member of the team in Derby, Leicester, or Nottingham on 0800 024 1976 or via our online enquiry form.
Contact us