Supreme Court to decide if Paymaster case allows trivial GDPR claims

The UK Supreme Court is currently determining whether businesses can be held liable for emotional distress claims resulting from data breaches without proof of actual harm. A ruling against the pension administrator Paymaster could trigger a surge in litigation, as the court considers if there is a minimum threshold of seriousness for such data protection claims.

The Supreme Court hearing for Paymaster

The dispute stems from a 2019 data breach where the company mistakenly mailed annual pension benefit statements—containing sensitive information like names, salaries, and national insurance numbers—to outdated addresses. The claimants are seeking compensation for non-material damage, specifically citing emotional distress and anxiety. City AM reported that the outcome of this case will decide whether the legal system will continue to be inundated by what some practitioners describe as a raft of individual and group claims based on trivial or spurious grounds.

Legal precedents and the threshold of seriousness

The central question before the justices is whether a “threshold of seriousness” exists for data privacy claims under the UK’s implementation of the GDPR. In 2024, High Court Judge Mr Justice Nicklin initially dismissed most of the claims, ruling that the individuals involved had to prove the pension statements were actually opened and read by a third party. However, the Court of Appeal overturned that decision in 2025, ruling that the mere act of sending data to an incorrect address could constitute grounds for a claim without needing evidence of third-party exposure. This current appeal by Paymaster, which trades under the parent company Equiniti, seeks to reinstate a requirement for proving tangible harm or a higher degree of seriousness.

The potential impact on corporate liability

If the Supreme Court upholds the Court of Appeal’s ruling, businesses may find themselves facing an increase in litigation for minor data errors. James Hyde, a commercial disputes partner at Addleshaw Goddard, noted that the defense side is hoping the court will restore control over these claims, which he characterized as a significant drain on business time and money. Tom Moore, a disputes resolution lawyer at Bird & Bird, added that if the appeal is refused, firms will likely find that any claim, regardless of how trivial, could proceed to court without being struck out on the basis of seriousness alone.

The implications extend far beyond this specific case. Equiniti handles shareholder services and employee stock plans for roughly half of the FTSE 100 companies, including Barclays, Associated British Foods, and National Grid. A precedent favoring the claimants could broaden the scope of liability for any organization that manages personal data, from public sector pension schemes to private retail entities.

Broader data security risks for large firms

The Supreme Court has not yet indicated when it will deliver its final verdict. Until the judgment is handed down, the question of whether emotional distress alone suffices for a successful claim remains the defining uncertainty for both data subjects and the businesses that manage their information.