Not every data breach results in compensation. But can a business defeat a claim simply by arguing that the breach, or the harm caused, was too trivial?
That is the issue at the heart of the Court of Appeal's decision in Farley & Ors v Paymaster (1836) Ltd (trading as Equiniti) [2025] EWCA Civ 1117, and one which is now before the Supreme Court.
What happened?
The case involves 432 current and former Sussex Police officers. Their pension administrator, Paymaster, mistakenly sent annual benefit statements to out-of-date addresses, despite having been provided with updated details. The statements contained personal information including dates of birth, National Insurance numbers, salary and pension information.
The High Court struck out most of the resulting claims, but the Court of Appeal overturned that decision.
Importantly, the Court of Appeal held that an individual does not necessarily have to show that their personal data was actually seen or read by somebody else before there can be an infringement of data protection law. The handling of the data itself may amount to the relevant "processing".
Is there a "too trivial" threshold?
This is where the decision becomes particularly interesting for businesses.
The Court of Appeal rejected the argument that there is a minimum threshold of seriousness which must be crossed before non-material damage can be claimed.
But that does not mean that every technical breach of data protection law results in compensation.
A claimant must still prove that they suffered compensable damage and that the damage was caused by the infringement. Where that damage is said to be fear that personal data might be misused, whether that fear is sufficiently well-founded will depend on the particular facts.
Why does this matter for businesses?
The practical message is that businesses should be cautious about dismissing apparently minor data incidents on the basis that they are simply "too trivial" to result in a claim.
Equally, the decision does not give claimants an automatic right to compensation whenever something goes wrong. There remains an important distinction between establishing an infringement and proving that the infringement caused compensable damage.
For businesses dealing with threatened data breach claims, that distinction is likely to be important when assessing both liability and the commercial merits of defending or settling a claim.
And watch this space...
The position may not be settled for long. The Supreme Court has heard Paymaster's appeal on the question of whether a threshold of seriousness applies to damages claims under the GDPR and Data Protection Act 2018. Its judgment could have significant consequences for both businesses defending lower-value data breach claims and individuals bringing them.
The information on this site about legal matters is provided as a general guide only. Although we try to ensure that all of the information on this site is accurate and up to date, this cannot be guaranteed. The information on this site should not be relied upon or construed as constituting legal advice and Howes Percival LLP disclaims liability in relation to its use. You should seek appropriate legal advice before taking or refraining from taking any action.
