Supreme Court to decide whether claimants must meet a threshold of seriousness to recover compensation for non-material damage under UK data protection law.

The Supreme Court will today hear the most significant UK data protection damages case since Lloyd v Google. While many viewed Lloyd as defining the boundaries of mass data breach litigation, Farley v Paymaster goes a step further. The Court is being asked to determine the sole issue of whether there is a threshold of seriousness that claimants must meet before recovering compensation for non-material damage under the GDPR and Data Protection Act 2018.

Farley is fundamentally different from Lloyd. In Lloyd, the claimant sought to recover compensation on the basis of the alleged loss of control of personal data, without having to prove individual damage. In Farley, each claimant alleges their own non-material damage, such as distress, and in some cases psychiatric injury, arising from the breach.

If the Supreme Court upholds the Court of Appeal’s decision, it is likely to be seen as a green light for a new wave of data breach litigation. Claimants will still need to prove they have suffered damage, but defendants will find it harder to argue that claims should fail simply because the alleged harm is modest.

Whilst the value of individual claims like this may often be relatively low, when claims are aggregated the financial exposure can become significant. The greater risk for many businesses may not be damages themselves but the costs of defending large-scale group litigation, particularly where claimants are backed by litigation funders or represented under conditional fee agreements.

It would be surprising if the Supreme Court were to depart significantly from the existing CJEU jurisprudence in this area. The concept of compensation under the GDPR has been shaped by a consistent line of European authority, and Parliament chose to retain the GDPR framework following Brexit. Whilst post-Brexit CJEU decisions are not binding, there are strong arguments in favour of maintaining continuity and predictability in the interpretation of retained EU data protection rights. A departure from that approach would represent a significant development in UK data protection law, and would put the UK on a different data protection track to the rest of the EU.

Equally, the decision in the Claimants favour may encourage earlier settlements. Faced with the prospect of lengthy and expensive litigation, some data controllers may prefer to resolve claims at an early stage rather than incur substantial legal costs.

However, even if the Supreme Court finds in favour of Paymaster, that is unlikely to spell the end of mass data breach litigation. It would instead raise the bar for claimants, requiring them to demonstrate that any non-material damage is sufficiently serious or non-trivial before compensation can be recovered.

Ultimately, the case is about where the law draws the line between genuine compensable harm and ordinary human reactions to a data breach. Whatever the outcome, the Supreme Court’s decision is likely to shape the future landscape of data breach litigation in England and Wales for years to come.

We’ll be following closely and preparing an update following judgment explaining how it will impact data controllers and data subjects alike.

Alex Vakil is Head of Commercial Disputes who also advises clients on a range of contentious data matters.