English Court of Appeal Rules on Compensation for Data Breaches

The English Court of Appeal has handed down an important judgment in Farley v. Paymaster (Equiniti) on when compensation may be claimed for nonmaterial damage such as distress or anxiety arising from GDPR and DPA breaches. The case concerned misaddressed annual pension benefit statements sent to current and former Sussex police officers. The High Court had previously struck out the claims on the basis that there was no evidence the statements were opened or read by third parties.

The Court of Appeal confirmed that disclosure is not essential for a GDPR infringement, and that claimants could recover compensation for fear of the consequences of an infringement if that fear is objectively well-founded rather than hypothetical. According to Cooley, Ann Bevitt and Morgan McCormack note the ruling marks an update to Farley v Equiniti and clarifies the scope of recoverable nonmaterial damage for data breaches. The decision emphasises that the fear of loss can underpin a compensatable claim when it is grounded in objective factors.