The Court of Appeal has delivered its verdict on a case involving a large pensions administrator mistakenly sending out Annual Benefit Statements (ABS) for Sussex Police to outdated residential addresses.
Michael Farley & Others v Paymaster (1836) Ltd (trading as Equiniti) [2025] EWCA Civ 1117 brought 432 Sussex Police officers together to bring a claim against Equiniti for breach of data protection. In a landmark decision, the court overturned a previous decision to throw out all but 14 of the claims with the court of appeal advising the act of sending personal data to the wrong address, regardless of whether it was opened or not, constituted unlawful processing.
In 2019 Equiniti, acting as administrator for the Sussex Police pension scheme, mistakenly sent Annual Benefit Statements (ABS) to outdated residential addresses. These statements contained personal data including names, dates of birth, national insurance numbers, and pension details. Although many of the misaddressed envelopes were returned unopened, the breach caused widespread concern among affected officers, some of whom reported anxiety and psychiatric symptoms stemming from fears of identity theft and misuse of their data.
Farley and others, alleging breaches of statutory duty under the General Data Protection Regulation (GDPR) and Data Protection Act (DPA), brought a claim against Equiniti but The High Court, in a decision by Mr Justice Nicklin in February 2024, struck out all but 14 claims, reasoning that without proof the ABS had been opened and read by third parties, there was no viable claim. The claimants appealed, arguing that disclosure is not a necessary element of a data protection infringement and that emotional harm arising from fear of misuse should be compensable.
The Court of Appeal allowed the appeal in part. The court held that the High Court had erred in requiring proof of third-party access to establish a claim. Processing, as defined under Article 4(2) of the GDPR, includes operations such as recording, storing, and sending data they said, even if no unauthorised party accessed it. Sending personal data to the wrong address therefore constituted a breach.
The case affirms that emotional harm may be compensable even in the absence of actual misuse, provided the claimant’s fears are reasonable. The judgment also highlights the need for careful case management in collective actions to ensure proportionality and procedural fairness.
Michael Farley & Anor v Paymaster (1836) Limited (trading as Equiniti) [2025] EWCA Civ 1117
One Response
The Farley v Paymaster (Equiniti) decision is a significant shift in the balance between data subjects and data controllers, and one that many organisations will find challenging to navigate. The Court of Appeal’s confirmation that there is no minimum threshold of seriousness, and that objectively well-founded fear alone can justify compensation, lowers the bar for claimants and will inevitably encourage more group actions.
From a compliance and risk management perspective, this ruling reinforces the need for organisations to treat even minor data handling errors with utmost seriousness. It will no longer be sufficient to rely on the argument that no third party accessed the data, or that the distress suffered was too trivial.
At Compliance Direct Solutions, we see this as a wake-up call for businesses to re-evaluate their technical and organisational safeguards, their incident response protocols, and—crucially—their litigation preparedness. The judgment also highlights the importance of documenting risk assessments and remedial steps so that, where fears are raised, organisations can demonstrate both proportionality and diligence.
While the evidential hurdle of proving an “objectively justified” fear remains, claimants and their representatives are increasingly adept at framing such arguments. For data controllers, the focus must therefore be on proactive risk minimisation and early resolution strategies to avoid the disproportionate costs of defending mass low-value claims.