SC hearing 7-8 October 2026
This week, the UK Supreme Court heard argument in Farley v Paymaster on whether a claim for non-material damage under Article 82 of the GDPR must meet a threshold of seriousness before compensation can be recovered.
Section 168(1) of the DPA 2018 provides that, for the purposes of Article 82, ‘non-material damage’ includes distress.
The claimants are 432 current and former Sussex Police officers who are members of a pension scheme administered by Paymaster (1836) Limited (trading as Equiniti). In 2019, their annual benefit statements were posted to out-of-date addresses.
The High Court struck out most of the claims because the claimants could not show that their statements had been opened and read by a third party.
The Court of Appeal ([2025] EWCA Civ 1117) allowed the claimants’ appeal. It held that proof of disclosure is not an essential ingredient of a data protection claim, and that the claims could not be dismissed for failing to meet a threshold of seriousness.
It is the threshold of seriousness issue that is now before the Supreme Court.
The decision should be read against a consistent line of CJEU case law from 2023 and 2024. Beginning with UI v Österreichische Post (C-300/21), the CJEU has held that Article 82 precludes national rules that make compensation for non-material damage conditional on the damage reaching a certain degree of seriousness. Whilst that decision does not bind the English courts, the courts may have regard to it.
Equiniti (the appellant) argues that a threshold of seriousness should apply, so that non-material damage below the level of distress, or damage of similar seriousness, is not compensable; mere displeasure or dissatisfaction would therefore fall outside Article 82. In response to a question from the Court, counsel confirmed that the proposed threshold equates to the domestic de minimis principle.
The claimants (the respondents) contend that the test applied by the Court of Appeal is correct: an emotional response must be well-founded and properly regarded as resulting from the breach, so that, for example, irrational fear would not be compensable. They argue that the CJEU’s interpretation of Article 82 is well-reasoned and forms part of a consistent and settled line of authority, and that divergent interpretations of the GDPR would undermine legal certainty, particularly given data flows between the UK and the EU. Among their policy arguments, the claimants noted that divergence from the EU approach could have implications for the UK’s adequacy status.
Judgment was reserved. The Supreme Court’s ruling is likely to be significant for controllers, processors and claimants, particularly in relation to how low-value, multi-claimant data claims are managed. We will report on the Supreme Court’s judgment once it is handed down.