High Court partly dismisses data protection breach and misuse of private information claims after pension statements sent to wrong addresses

In Farley (formerly CR) and others v Paymaster (1836) Ltd [2024], the High Court partially dismissed a claim for misuse of private information and breach of the data protection law when annual pension benefit statements containing personal details of about 450 current and former police officers were sent in error to out-of-date addresses by the defendant administrator.

Nicklin J dismissed the claims in relation to those claimants who had not adduced evidence that their statement and been opened and read by someone other than the claimant, holding that they should be struck out or summarily dismissed as disclosing no reasonable grounds for bringing the claim. He allowed the remaining 14 claims to proceed.

The judge decided:

• That to have a viable claim for misuse of private information or data protection, a claimant would need to show that they had a real prospect of demonstrating that the statement was opened and read by a third party.
• If the claimant had ultimately received their statement unopened or it had been returned unopened to the sender, they could not have such a claim.
• They could not advance a claim on the basis that their privacy had been "in danger" or "at risk".
• The allegation in respect of data protection was essentially that the data was processed unlawfully when it was sent to the wrong address, and that this caused the claimants to suffer non-material damage. Nicklin J found there had not been any "real processing" unless the statement had been opened or read by a third party.

Just 14 out of over 450 claims will proceed to trial. The question of whether the 14 claimants could surmount a threshold of seriousness (were one found to apply in data protection claims) was factual and could only fairly be resolved at trial. In addition, so long as the administrator defendant continued to dispute liability on the basis that it was a data processor rather than a data controller, there remained a common issue between the 14 claims that needed to be resolved.

This is an interesting case for employers and they should note the outcome of the future court judgment in respect of the 14 claimants whose cases are being pursued.