Court of Appeal eases way for low-value compensation claims in pensions data breach case

What was the case about?

A pensions administrator sent the annual benefit statements of over 400 Sussex police officers to the wrong addresses because the relevant members’ data was out of date. The benefit statements contained the member’s name, date of birth, NI number, and salary / pension information, and an indication that they were a police officer.

The claimants alleged this was a misuse of their personal data and an infringement of the UK’s data privacy law (the UK GDPR). They sought compensation in respect of that breach.

The UK GDPR allows individuals affected by a data breach to claim compensation in respect of “non-material damage”, such as distress, arising from that breach, as well as claims relating to “material damage”, such as financial losses. Prior to this appeal, it had widely been thought that claims for compensation in respect of “non-material damage” could only be brought if the damage passed a “threshold of seriousness” test. This meant it was more difficult for individuals to bring claims for compensation following a data breach.

In addition, all but 14 of the claimants’ claims had been struck-out by the High Court in 2024, on the basis that they had not put forward a claim that their annual benefit statement had been opened by a third party, and the High Court considered that was a necessary step to bring a claim for compensation in these circumstances.

What did the Court of Appeal decide?

On appeal, the Court of Appeal has decided that:

• Under the GDPR, claims for compensation in relation to “non-material damage” do not need to pass a “threshold of seriousness” test. This aligns the position in the UK with that in the EU, and means that, while those claims still need to be proved, it will be easier for individuals to bring low value claims for compensation
• Compensation in respect of “non-material damage” is not limited to distress. It can include other negative emotions suffered as a result of a data breach (perhaps stress or anxiety). However, “fleeting or transient subjective reactions” such as annoyance or irritation will not be enough
• In principle, compensation is payable in respect of an individual’s “fear of the consequences of” a data breach, such as the misuse of their personal data by a third party, as long as that fear is “objectively well-founded” and not “purely hypothetical or speculative”. That fear also needs to be proven by the claimant

The Court of Appeal also overturned an aspect of the High Court’s decision, covered in our previous speedbrief, which held that claims for compensation can only be brought where there is evidence that incorrectly addressed correspondence had been opened by a third party. Claims for compensation can instead be brought on the basis that personal data was sent to the wrong person.

What will happen next?

While the Court of Appeal’s decision has made it easier to bring low value claims following a data breach, compensation is not available merely as a result of the “loss of control” of data, and individuals will still need to prove that they suffered distress or anxiety as a result of a data breach.

We would be surprised if the defendant in this case does not apply for permission to appeal the decision to the UK’s Supreme Court. For now, however, the Court of Appeal has eased the way for low-value compensation claims following personal data breaches.

While there are technical difficulties with bringing a class action claim in the UK following a data breach on an “opt-out” basis, pension trustees, administrators and other controllers may still be subject to individual claims (or perhaps “opt-in” group claims) which allege “non-material damage” arising from the breach. Those claims can be difficult to respond to in a cost proportionate way: the costs of defending them can outweigh their potential value, but in the social media age defendants need to be wary of being seen as an “easy target” for compensation claims in respect of a data breach which has affected a large number of individuals.