The United Kingdom’s highest court heard arguments on October 7 and 8 regarding whether individuals must prove significant harm to recover damages for data protection violations. The appeal, styled Farley and 431 others v Paymaster (1836) Limited, centers on the interpretation of the UK General Data Protection Regulation and the Data Protection Act 2018.
The case involves 432 current and former police officers enrolled in the Sussex Police pension scheme. The defendant, Equiniti, which trades as Paymaster (1836) Limited, administered the pension fund. In August 2019, the administrator mistakenly mailed annual pension statements to outdated addresses. Those documents contained sensitive personal information, including names, dates of birth, national insurance numbers, and specific pension details.
The claimants filed proceedings in the High Court alleging breaches of GDPR and misuse of private information. Justice Nicklin struck out the majority of the claims, ruling that the plaintiffs failed to provide evidence that anyone had actually opened the misdirected letters. The claimants appealed this decision, but limited their challenge to the GDPR aspect of the case.
The Court of Appeal reversed the lower court’s dismissal. Judges ruled that the data had been “processed” under GDPR definitions and determined that no specific threshold of seriousness is required for a claimant to seek damages. This ruling aligned with established European Union case law. However, the appellate court noted that an unfounded fear of misuse constitutes no damage under the regulation.
The defendant appealed directly to the Supreme Court, narrowing the dispute to the single issue of whether a threshold of seriousness applies to GDPR damages claims. The justices heard the appeal over two days in early October 2026. A final judgment has not yet been issued.
The outcome will clarify the liability standards for organizations handling personal data in the United Kingdom. If the Supreme Court upholds the lower courts’ view, entities may face financial exposure for administrative errors even without proof of actual misuse or distress. Conversely, a ruling requiring a higher threshold would limit compensation to cases where claimants can demonstrate tangible harm.
The case highlights ongoing tensions between data privacy enforcement and corporate liability limits. With no direct quotes available from the proceedings, the legal arguments remain documented only through the procedural history and the specific questions presented to the bench. The 432 officers involved represent a significant group of public sector employees whose personal financial records were exposed due to administrative failure.
The Supreme Court’s decision will impact how businesses and government agencies manage data security protocols. It also sets a precedent for future litigation involving mass data breaches where individual harm is difficult to quantify. The ruling could influence regulatory enforcement strategies and insurance coverage models for cyber risks in the public and private sectors.