Businesses could face flood of ‘trivial’ compensation claims over GDPR worries
Businesses could face a “raft” of “trivial” data protection claims if the Supreme Court rules compensation can be won for emotional distress or anxiety caused by data breaches without needing to prove any harm actually occurred, in a hearing set to conclude on Thursday.
The case was originally brought by 432 current and former police officers from the Sussex Police Force against the force’s pensions administrator, financial outsourcing firm Paymaster, following a data protection breach in 2019.
The police cohort brought the claim to recover financial compensation for non-material damage – such as distress or anxiety – over the misuse of their data in the breach which saw Paymaster mistakenly mail annual pension benefits statements containing sensitive data including names, national insurance numbers, and salaries, of approximately 450 current and former police officers to out-of-date addresses.
The Supreme Court has been asked to decide whether or not there is a threshold of seriousness in data privacy claims that can be measured. The Court of Appeal previously said there is none, but Paymaster, trading under its parent company, Equiniti, is challenging that.
In 2024, High Court Judge Mr Justice Nicklin dismissed most of the claims and ruled that claimants had to prove the pensions statement was opened and read by a third-party. However, in 2025 the Court of Appeal overturned the decision, ruling that sending data to the wrong address can be grounds for a claim without needing proof it was read by a third party.
The court had ruled there is no minimum so-called ‘threshold of seriousness’ for data protection claims under the UK’s data protection law, the GDPR.
Claims ‘are a drain on business time and money’
If the Supreme Court refuses Paymaster’s appeal, businesses could feel the fallout.
“On the defence side, everyone is hoping that the Supreme Court reinstates some control over trivial data protection claims. Currently such claims are a drain on business time and money and claimant firms continue to pursue them. Add to that the Court system’s challenges and finite resources, then greater clarity and control will help a lot,” James Hyde, commercial disputes partner at Addleshaw Goddard told City AM.
“If it doesn’t take the opportunity, then the Court system and business will continue to be inundated by a raft of individual and group claims based on trivial and spurious grounds,” Hyde said.
As well as administering pension schemes for public sector organisations including the police, the civil service, and the Armed Forces, Equiniti also handles shareholder services and employee stock plans for roughly half of the FTSE 100 companies including Barclays, Associated British Foods, and National Grid.
Tom Moore, disputes resolution lawyer at Bird & Bird told City AM if the appeal is refused, “we are likely to see more claims brought or threatened against businesses by data subjects”, and firms will “find that any claim, no matter how trivial, can go to court without being struck out” on the basis of seriousness alone.
This comes in the same week it was revealed Goldman Sachs and Man Group’s corporate data was exposed in a data breach at Big Four giant EY earlier this year, and retailer Asos was struck by a group of hackers who duped an employee by posing as a “trusted” contact.
Sussex Police declined to comment. Equiniti was contacted for comment.