Can 'trivial' data breach claims be blocked? UK court to say

The UK Supreme Court has heard an appeal that could decide whether people whose personal data is mishandled can sue over it at all when the harm seems small. In Farley and others v Paymaster (1836) Ltd, heard on 7 and 8 October 2026, five justices were asked one question: does a "threshold of seriousness" apply to claims for damages under UK data protection law? Judgment is reserved, and the court has not said when it will rule.

"Organisations are being inundated with trivial data privacy related claims."
— James Hyde, disputes partner, Addleshaw Goddard

Pension letters sent to the wrong doors

The facts are mundane, which is rather the point. In 2019 Paymaster, which trades as Equiniti and administered a police pension scheme, posted annual benefit statements for current and former Sussex Police officers to out-of-date addresses, even though the force had supplied the correct ones. The statements included dates of birth, National Insurance numbers and pension details such as salary and forecast benefits.

The case is brought by Michael Farley and 431 others, 432 officers in all, seeking compensation for distress and, in some cases, psychiatric injury from fear that their details might be misused. In February 2024 the High Court struck out most of the claims, keeping only 14 where there was an arguable case that an envelope had been opened and read. The Court of Appeal disagreed, ruling that the judge had applied the wrong test and that there is no threshold of seriousness for data protection damages claims.

Equiniti is appealing that point only. The bench was Lord Sales, Lord Leggatt, Lord Burrows, Lord Stephens and Lady Simler.

Trivial breach or mass harm?

Equiniti's case, as reported by Computer Weekly, is that this was a "trivial, one-off breach" that "should not be taking up valuable court time and incurring huge levels of costs". It points out that more than 90% of the officers did not take up a fraud-prevention service it offered.

The officers argue that a seriousness threshold is out of step with the GDPR and that people should be able to claim even modest sums. They have notable support. The Information Commission, the data protection watchdog still known to most people as the ICO, intervened to argue there should be no threshold, as did the Open Rights Group, which warned that one would block redress for "mass harm", where each person's loss is small but many people are affected.

The EU's top court took the officers' side of this argument in 2023, ruling that there is no seriousness threshold under the EU GDPR, though claimants must still prove they suffered some damage. Since Brexit that ruling doesn't bind UK courts, which is partly why the Supreme Court has to decide the question for itself.

Why it matters if your data has leaked

For most people, a data breach is something that happens to them by email: a notice from a retailer, a bank or a council saying their details may have been exposed. The big retail breaches of recent months have put that experience in a lot of inboxes.

The Supreme Court's answer will shape what happens next. If it backs the Court of Appeal, people whose data is mishandled keep a route to compensation even when the harm is worry rather than proven fraud, provided they can show some damage. If it introduces a threshold, low-level claims are likely to be filtered out earlier, and the ICO's complaints process becomes, for many, the main remedy.

That process is busy. Computer Weekly reports the Information Commission received more than 76,700 data protection complaints in 2025/26, up from 42,300 in 2024/25. Those are complaints to the regulator, not lawsuits, but they show how many people now feel strongly enough to do something when their data goes astray.

To be fair to the companies

The business worry is real. Lawyers acting for organisations describe a rising tide of low-value claims, and Hyde added that "Individual claims are also being fuelled by the use of AI." Defending even a weak claim costs money, and those costs land on customers and, for public bodies, on taxpayers. A clear rule would help everyone know where they stand.

But there is a counterweight. Data protection law exists partly because the harm from losing control of your information is hard to measure and easy to dismiss. A rule that every individual loss is too small to matter could mean that no one is ever compensated for the biggest breaches. Courts already have tools to throw out abusive claims and keep damages modest, and the question is whether they need another.

This is an explainer, not legal advice. If you think you have a claim, take advice from a qualified solicitor, and be wary of any firm that cold-calls you about a breach.

Mind the hype. And check the address before you hit print.

Sources: UK Supreme Court · Computer Weekly · Local Government Lawyer · Irish Legal News