Supreme Court GDPR Ruling Could Trigger Wave of Data Claims

Businesses face potential wave of trivial data privacy claims as Supreme Court hears GDPR appeal

Companies across the UK could face a surge in compensation claims for minor data protection breaches if the Supreme Court rules that individuals can recover money for emotional distress or anxiety without proving actual harm occurred.

The warning comes as the Supreme Court concludes hearings on Thursday in a long running dispute involving pensions administrator Paymaster, part of financial services group Equiniti, and 432 current and former Sussex Police officers.

The case stems from a 2019 data breach in which Paymaster mistakenly sent annual pension benefit statements to outdated addresses. The documents contained sensitive personal information for around 450 individuals, including full names, national insurance numbers, and salary details.

The police officers launched legal action to claim compensation for non material damage, such as distress and anxiety caused by the misuse of their personal details.

At the heart of the appeal is whether UK data protection law imposes a threshold of seriousness for privacy claims. High Court Judge Mr Justice Nicklin dismissed most of the claims in 2024, ruling that claimants needed to prove a third party had opened and read the letters. However, the Court of Appeal overturned that decision in 2025, finding that mailing data to an incorrect address provided sufficient grounds for a claim regardless of whether anyone opened the mail.

The Court of Appeal also held that UK General Data Protection Regulation rules do not establish a minimum threshold of seriousness for claims to proceed. Paymaster is challenging that finding before the Supreme Court.

Legal experts warn of rising litigation costs

A decision upholding the Court of Appeal ruling could leave businesses exposed to increased litigation costs from low value claims.

"On the defence side, everyone is hoping that the Supreme Court reinstates some control over trivial data protection claims. Currently such claims are a drain on business time and money and claimant firms continue to pursue them. Add to that the Court system’s challenges and finite resources, then greater clarity and control will help a lot," James Hyde, commercial disputes partner at Addleshaw Goddard, told City AM.

"If it doesn’t take the opportunity, then the Court system and business will continue to be inundated by a raft of individual and group claims based on trivial and spurious grounds," Hyde added.

Equiniti administers public sector pension schemes for the civil service, the Armed Forces, and the police. The group also provides shareholder services and manages employee share plans for approximately half of the FTSE 100, including major firms such as Barclays, Associated British Foods, and National Grid.

Tom Moore, dispute resolution lawyer at Bird & Bird, told City AM that if the appeal is refused, "we are likely to see more claims brought or threatened against businesses by data subjects", and companies will "find that any claim, no matter how trivial, can go to court without being struck out" solely because of a lack of seriousness.

The Supreme Court hearing coincides with growing concerns over corporate data security. Earlier this week, corporate data relating to Goldman Sachs and Man Group was exposed following a security incident at accounting firm EY, while online fashion store Asos suffered a breach after attackers tricked an employee into sharing login credentials.

Sussex Police declined to comment on the proceedings. Equiniti was contacted for comment.

Source: City A.M.