The Court of Appeal has overturned an earlier ruling that made it harder for people to bring claims after their personal data was exposed.
In a significant win for consumers, the latest judgment confirms victims don’t need to prove their data was actually read by a third party, or that they suffered serious distress or financial loss. A genuine, well-founded concern about misuse can be enough for a valid claim.
What was the case about?
The case – Farley v Paymaster (1836) Ltd – involved hundreds of current and former Sussex Police officers. Their pension scheme manager, Equiniti, accidentally sent annual benefit statements to old addresses. The letters included sensitive personal details such as names, dates of birth, National Insurance numbers, salaries, and pension information.
Although Equiniti apologised and offered to fund fraud protection services, many officers were left anxious about the possibility of identity theft or misuse of their data. Some of the claimants even said the breach aggravated existing medical conditions.
The likely value of each individual claim was estimated at £1,250 to £1,500,
Why this ruling matters
Previously, the High Court had limited these claims, saying only people who could show their letters were opened by strangers could continue. Out of 446 claimants, just 14 were allowed to proceed.
The Court of Appeal disagreed. Lord Justice Warby said:
- Victims don’t need to prove their data was opened and read to have a valid claim.
- Unlawful processing of personal data is enough to amount to a breach.
- There is no “threshold of seriousness” under UK data protection law.
- Claims should not be dismissed simply because the potential compensation may be small.
In short: organisations can’t dodge responsibility just because victims can’t prove exactly what happened to their data after a breach.
What this means for consumers
This ruling is a big step forward for data breach victims across the UK. It makes clear that:
If your personal data has been unlawfully exposed, you may have a valid claim.
You don’t need to prove your information was read by a third party.
Anxiety and fear of misuse – when based on a real risk – are enough to bring a case.
Lower-value claims still deserve to be heard, and can be pursued collectively through group actions.
The solicitor for the claimants in case said the decision would have:
“a positive impact not just for our clients, but for data breach claimants across the jurisdiction”.
In other words, the ruling doesn’t just help the police officers involved in Farley v Paymaster — it helps anyone with a data breach claim by making it easier to bring a case and harder for organisations to dismiss them.
Check if you could claim
Data breaches are becoming more common, and this ruling strengthens the rights of consumers to hold organisations accountable.
If your personal information has been exposed in a breach, you could be entitled to compensation. We can help you check your eligibility and connect you with a regulated UK law firm ready to act on your behalf.
Join the Claim connects consumers with SRA-regulated lawyers. Keep an eye out for updates on any potential claim and possible eligibility checks/registration opportunities.
