Farley (formerly CR) and others v Paymaster (1836) Ltd [2024] EWHC 383 (KB)
Background
Over 400 Police officers pursued a claim against Paymaster (1836) Ltd (Defendant) for breach of the UK GDPR, Data Protection Act 2018, and the misuse of their private information.
In August 2018, the pension function of Sussex Police was transferred over to the Defendant. From this date, the Defendant was the administrator of the pension scheme. In August 2019, the Defendant sent an annual pension benefit statement (ABS) to each member of the scheme. Each ABS contained:
- the officer’s name;
- date of birth;
- national insurance number;
- details of salary; and
- pension details.
The Defendant had failed to update their database with the Claimants’ current addresses and as a result, the ABSs were sent to the wrong addresses.
Most Claimants relied on an inferential case that their ABS was opened (and read) by a third party. Only 14 Claimants pleaded a positive case that the envelope containing his/her ABS was opened by a third party. Of these 14:
- In 11 cases, the ABS was said to have been opened by a relative before being passed on to the relevant Claimant;
- In 1 case, the ABS is said to have been received by another Police officer; and
- In 2 cases, it is alleged that the ABS was opened or read by someone other than a family member or colleague.
The Defendant applied for summary judgment and/or strike out. The Defendant’s primary submission was that without evidence that the ABS had been opened and read by a third party, the claim for both misuse of private information and breach of data protection had no real prospect of success.
The Claimant submitted that the mere act of wrongly addressing the ABS is an actionable “misuse” of private information and/or unlawful processing. Whether or not the misaddressed ABS was opened and read by a third party is a matter that only goes to the quantum of damages.
What was the decision?
The Judge clarified that to have a viable claim for misuse of private information and/or breach of data protection legislation, each Claimant would need to show that they had a real prospect of demonstrating that the ABS was opened and read by a third party.
As set out above, the majority of Claimants tried to rely on an inferential case that their ABS was opened and read by a third party. The Judge did not agree with this approach. He took the view that simply because there was some evidence that some of the ABSs were opened by third parties, this was not enough to rely on an inference that all were, especially in circumstances where a large amount of the ABSs were actually returned to the relevant Claimants unopened.
The Judge went on to clarify that these Claimants would not be able to advance a claim that until returned, their personal data was in danger or at risk. The Judge made it clear that to be entitled to any remedy, a Claimant would need to demonstrate that they were a victim of a tortious wrong. A near miss, even if it causes significant distress, would not be sufficient. Therefore, without the contents of the ABS coming to the attention of a third party, the Claimants would not have a viable claim for misuse of private information and/or a civil claim for data protection.
As a result of the above, the Judge struck out the majority of the cases. The only claims permitted to continue were the 14 claims in which the Claimants had advanced a positive case that their ABS was opened and read by a third party.
Comment
This is a very important reminder of the high evidential hurdle when bringing a data breach claim and/or a claim for the misuse of private information. Claimants need to prove that their personal data has been accessed by an unauthorised third party. It is not enough to simply rely on an inference.
How can Nelsons help
Ruby Ashby is a Senior Associate in our expert Dispute Resolution team, specialising in data breach claims, inheritance and Trust disputes and defamation claims.
If you need any advice, please do not hesitate to contact Ruby or another member of the team in Derby, Leicester, or Nottingham on 0800 024 1976 or via our online enquiry form.