Supreme Court Weighs Limits On Data Breach Claims
The Supreme Court is considering whether compensation claims for data protection breaches must meet a minimum level of seriousness, in a case that could affect how businesses handle demands for damages as lawyers warn that AI is making complaints easier to produce.
What Is The Court Deciding?
The court heard arguments in Farley v Paymaster on 7–8 October, and its judgment is awaited. Its central question is whether a “threshold of seriousness” applies to damages claims under the General Data Protection Regulation, or GDPR, and the Data Protection Act 2018.
In practical terms, that means the judges must decide whether someone who suffers genuine but minor harm from a breach can receive compensation, or whether the harm must first reach a minimum level. This is different from deciding that every mistake involving personal information deserves a payout.
How Did The Case Begin?
The dispute concerns pension statements sent to outdated addresses in 2019 by Paymaster, which trades as Equiniti. The 432 respondents are current or former Sussex Police officers whose statements included dates of birth, National Insurance numbers, salary information and pension details.
Sussex Police had supplied updated addresses, but the statements actually went to previous ones. The officers then sought compensation for the emotional effects of fearing their information could be misused, with some also even alleging psychiatric injury.
The High Court initially dismissed most claims because the individuals couldn’t show that their statements had been opened and read. However, the Court of Appeal overturned that decision in August 2025, finding that proof of disclosure was not essential to a data protection claim.
Why Does The Distinction Matter?
Data protection law covers how information is collected, organised, stored and used, so a failure can occur before somebody else reads it. However, establishing that an organisation handled information incorrectly is separate from showing that the mistake caused harm for which compensation is available.
The Court of Appeal found that no minimum seriousness threshold applied, but it didn’t award compensation to everyone. For example, claims still required individual assessment, including whether fears about possible misuse were objectively justified rather than speculative.
That distinction is really central to the appeal because Equiniti wants a threshold excluding trivial harm, while the opposing argument is that requiring proof of actual harm already provides a safeguard against unsupported demands.
What Are The Competing Arguments?
Equiniti’s argument is that minor annoyance shouldn’t lead to compensation, particularly where the cost of pursuing a claim is out of proportion to the harm involved. It also questions how much distress this incident actually caused, pointing out that the statements were sent to a limited number of households and that few officers took up its offer of fraud protection.
It seems the regulator agrees that an upset reaction does not automatically justify a payout, stating that “Not all emotional responses to an infringement of the GDPR will constitute recoverable non-material damage”. However, it argues that people who can show they suffered harm should not also have to prove that it reached a particular level of seriousness.
With that approach, courts would examine the evidence behind each claim and use existing procedures to keep the time and costs appropriate to its value. Equiniti’s objections would therefore be considered when assessing the claims, rather than treated as proof that the officers had no grounds to seek compensation.
The wider concern is that one failure could affect thousands of people while causing only modest harm to each. A minimum seriousness threshold could prevent those individuals from receiving compensation, even where the same mistake had consequences across a large group.
Where Does AI Fit In?
Although the case isn’t about AI, it comes at a time when lawyers are warning that businesses are spending more time dealing with AI-generated complaints. Letters containing incorrect legal references or irrelevant arguments can make it harder to identify what’s actually gone wrong and whether the person has a valid claim.
The regulator received 76,743 data protection complaints in 2025/26, up from 42,315 the previous year. It should be noted that these were actually complaints made directly to the regulator, not compensation claims brought in court, and there’s no breakdown showing exactly how many involved AI.
AI can also help people explain genuine concerns that they might otherwise struggle to put into words. Businesses therefore need to examine what happened and the evidence of harm, rather than dismissing a complaint simply because it appears to have been generated by a chatbot.
What Does This Mean For Your Business?
For businesses, the starting point is to reduce avoidable errors through reliable address updates, clear responsibilities between organisations and their service providers, and checks before sensitive information is sent. This case shows how an ordinary administrative failure can generate years of litigation, even when the extent of any disclosure remains disputed.
When a complaint arrives, staff should preserve relevant records, establish what happened and separate the alleged breach from the harm being claimed. A long, apparently AI-generated letter still needs careful assessment, but its length does not establish its legal strength. Appropriate specialist advice can help businesses respond proportionately without dismissing genuine concerns or accepting unsupported demands.
The eventual judgment may change which compensation claims succeed, but it won’t remove the need to protect personal information. Businesses should follow the ruling while continuing to investigate incidents, support affected people and correct underlying weaknesses. Sound complaint handling depends on evidence and fair treatment, whatever technology someone uses to write their claim.
