Keen observers of UK data breach claims will be interested in two recent decisions which further develop how mass claims are brought and if they can be brought at all. The first judgment reopens the door on whether damages can occur in postal misdirection claims. The second fires a warning shot to the practice of bringing mass data breach claims on a single claim form.
Farley v Paymaster
First Instance
This case involved annual benefit statements for approximately 450 pension members which were accidentally sent to outdated addresses by the administrator of the scheme. The pension members were current and former police officers and the statements included their name, date of birth, National Insurance number, and salary and pension details.
The High Court chose to strike out those claims where the letters been returned unopened or where there was no proof that the letters had been opened and read by someone other than the claimant[1]. Nicklin J considered there could be no claim for damages for the apprehension that a wrong had occurred. The High Court also made note of the fact that each envelope was marked as Private & Confidential and a return address was included with the statement for any misdirected post.
Fourteen claims were not struck out and were able to proceed where there was evidence that the envelope holding the benefit statement had been opened and read. In most cases, this had been by a family member who still resided at the old address and where there was no suggestion of further unauthorised use of the information.
Although the Judge considered that the remaining claims appeared to be "very far from being serious cases", they were not struck out due to the real prospect of a demonstration that the envelope was opened and read by a third party. The question of whether the remaining claims could surpass the seriousness threshold was one of fact and could only truly be settled at trial.
Permission to Appeal
In essence, the High Court found there had not been any "real processing" unless the statement had been opened or read by a third party and struck out the majority of the claims.
However, the Court of Appeal[2] has granted leave for these claimants to appeal the High Court's decision. In doing so, the Court of Appeal recognised that "in principle an individual may establish that personal data have been processed in breach of their data protection rights without proving that the information or data have in fact been read or otherwise communicated to anyone" with the example given of the transfer of data from a secure location to an insecure location, or transfer of personal data to a foreign jurisdiction. This in itself may be considered "processing" and the claimants therefore would have a real prospect of success on this argument.
Commentary
The appeal allows the claimants a further bite of the cherry but they will still need to convince the Court, if the matter does not settle, of the actual damage that was caused by the wrongful processing of mis-addressing the letter.
It also has wider implications for any controller dealing with the question of whether Articles 33 and 34 UK GDPR are triggered where personal data is placed into an incorrect envelope or sent to the wrong address. Those controllers who might have assumed that a risk was unlikely, given the sealed envelope directed for the addressee only, may have to assess risks differently depending on the outcome of Farley.
Adams & ORS V Ministry of Defence
This is not a data breach case but a mass claim brought in the same manner as many modern data breach claims are. In Adams, three groups of ex-military members filed claims for three types of military related injuries[3]. Two of these injuries were being pursued through the use of an "omnibus" Claim Form, where multiple claimants are added to a single claim. In this instance the action related to 45 claimants.
Omnibus claim forms have seemingly found favour within the claimant community when bringing low value claims; omnibus claim forms avoid the costs and complications of the Court-approved Group Litigation Order process, which is an extremely restrictive regime when bringing representative/class actions. They also avoid the alternative of issuing individual claims which incur individual court fees and are at the mercy of low value claim costs restrictions.
The question at issue in Adams was whether the claims could remain under an omnibus Claim Form or if a different procedural avenue should be pursued. This issue dealt with the interpretation of CPR 7.3 ("A claimant may use single claim from to start all claims which can be conveniently disposed of on the same proceedings") and CPR 19.1 ("Any number of claimants or defendants may be joined as parties to a claim").
What proved instrumental was the idea of convenience and how its interpretation played such a crucial role in determining its application – referred to as the 'acid test' by the Court. In the Morris case,[4] the Appeal Court found that there is no rule to exclude the aggregation of claims and that the application of convenience will be decided on a case by case basis subject to the specific facts of each case.
In the Adams case, the Court ultimately chose not to upset the status quo.
However, it is fair to say that the Court did not have sympathy for the procedural issues and court administration difficulties that the omnbus claim form approach is taking. The postscript to the judgment was such a clear indication that the door may be closing on where omnibus claim forms can be used, that we have repeated it here verbatim.
"26. Omnibus Claim Forms are topical at the moment. When such orders were made in this cohort of claims, the judges concerned did not have the benefit of argument nor the benefit of the cases cited above, which have given valuable guidance on the subject. As a result of the decisions in Abbott and Morris, omnibus Claim Forms and CPR r.7.3 are the subject of consideration by the Civil Procedure Rule Committee. In these circumstances, we make just one further, short observation.
27. Where it appears at the outset that claims which are sought to be joined to an omnibus Claim Form will not, via trial of lead cases, be dispositive or at least largely dispositive of the cohort, that is a relevant factor in deciding whether to issue an omnibus Claim Form. To put that differently, if it can be anticipated that a stage will be reached where the cases in the cohort will all require individual determination, then a court may be hesitant to approve the use of an omnibus Claim Form because of the practical difficulties that may be encountered and as are exemplified by this case. To put that differently again, the convenience of such a claim Form may be short lived."
Therefore, the use of single claims forms by multiple claimants is likely to become more challenging and it will be interesting to see the output from the Civil Procedure Rule Committee. For the moment, however, this judgment ought to have an immediate impact on the viability of omnibus claim forms in data breach claims.
[1] In Farley and 473 others v Paymaster (1836) Limited (trading as Equiniti) [2024] EWHC 383 (KB)
[2] [2024] EWCA Civ 781
[3] [2024] EWHC 1966 (KB)
[4] Morris and Ryan & Ors v Williams & CO Solicitors (A Firm) 2024 EWCA Civ 376
