The Court of Appeal recently handed down its judgment in Farley and Paymaster (Trading as Equiniti), finding there is no de minimis threshold for damage in data protection claims, but that Claimants’ fears of misuse of their data must be ‘well-founded’ to constitute ‘non-material damage’ for which compensation is payable.
Background
The Appellants’ annual benefit statements for their pension (ABS) were mistakenly posted to out-of-date addresses, which they claimed was a misuse of their personal information and an infringement of GDPR. They sought compensation for injury to feelings, and in some cases psychiatric injury, suffered due to fear of third-party misuse of their personal data.
The High Court struck out all bar 14 of the claims on the basis each Claimant must demonstrate they have a ‘real prospect of demonstrating that there had been “misuse”, an essential element of the tort of misuse of private information’, and those Claimants had failed to show a real prospect of their ABS being opened and read by a third party.
Key findings
First, the Court of Appeal (CoA) found there was a reasonable basis for alleging the mistake involved an infringement of GDPR. Proof that the data were disclosed is ‘not an essential ingredient of an allegation of processing or infringement’.
Second, it considered a number of factors when determining if the basis for compensation was reasonable and had a realistic prospect of success at trial:
- Distress is not an essential element and there is no threshold of seriousness: Adopting EU case law (from the Court of Justice of the European Union, or CJEU), the CoA found that no threshold of seriousness existed in EU data protection law, and the position in England and Wales is it was not ‘bound to hold that such a threshold exists in domestic data protection law. Nor [was] there any other good reason to do so’. The CoA distinguished data protection claims from cases for misuse of private information, where the COA previously found there is a threshold for seriousness (Prismall v Google).
- Claimants’ fears must be ‘well-founded’: In principle a claimant can recover compensation for fear of the consequences of an infringement, ‘if the alleged fear is objectively well-founded but not if the fear is (for instance) purely hypothetical or speculative’. In determining whether a fear is well-founded, this must be done ‘with reference to the facts and matters that were or should have been known to the appellant at the time they experienced the stated fear’. This is a question of fact best determined by the High Court or a County Court, on a case-by-case basis. Here, the CoA found none of the claims could succeed unless the individual appellant ultimately proves a reasonable basis for fearing (1) their ABS had been or would be opened and read by a third party and (2) this would result in identity theft or another consequence they feared might follow.
- Door left open regarding limits on non-material damage: Interestingly, the CoA noted there ‘may be room for the view that fleeting or transient subjective reactions’ do not qualify as ‘non-material damage’. While the point was not addressed in detail, the COA noted that the CJEU decisions has not rejected an argument that some forms of emotional harm do not count as ‘damage’ at all.
- Stock phrases do not mean no basis for claim: The use of stock phrases in the statement of case (82 claimants were ‘baffled and frustrated’ and 53 worried about people with ‘malevolent intent’) was not sufficient to justify summary judgment (which requires the Court to be satisfied there is no real prospect of the claim succeeding). This was on the basis the stock phrases were not in witness statements, which must be in the witness’ own words, but in statements of case drafted by the solicitors.
Third, the CoA considered if the claims were, nonetheless, an abuse of process. This is based on Jameel v Dow Jones Inc which found that proceedings may be abusive, even if they raise an arguable cause of action, if they are (objectively) pointless and wasteful, in that any benefit to Claimants if successful would be extremely modest and the cost of defending the claims is wholly disproportionate to the benefit.
The CoA found that these claims, as a class, could not be categorised as Jameel abuse, but that ‘the question of whether any individual case is abusive will remain for consideration’. Referring to an Irish Supreme Court decision which noted that claims solely for mental distress, upset and anxiety ‘cannot expect anything other than very, very modest awards’, the CoA noted that (i) certain Claimants were bringing claims for psychiatric injury, and (ii) the prospect of a Claimant recovering only a ‘modest’ award is not a sufficient justification to dismiss such claims.
The CoA noted that striking out should be a ‘last resort’ taken only if there is no proportionate procedure by which its merits can be investigated. In the present case, issues of liability would have been apt for resolution in the County Court, save that 'issues of principle' provided the justification for starting and retaining the claims in the High Court. The CoA also noted the applicants could not fairly be criticised for participating in a collective action which ‘will normally achieve savings compared to the separate pursuit of hundreds of individual claims’.
Takeaways
While this decision can be seen as permitting future low value data claims, it is clear that such claims do not amount to an easy win for Claimants, not least given the requirements to establish liability, a causal link between a data incident and the alleged harm suffered, and to evidencing that harm.
It remains to be seen whether Equiniti appeal this decision to the Supreme Court.