Paymaster asks the Supreme Court to set a seriousness bar for data distress claims

Until the Supreme Court rules, businesses operate under the Court of Appeal's 2025 test ^[6]. If Paymaster's appeal is refused, that position stays. Only a Paymaster win would narrow it ^[4]. James Hyde, a commercial disputes partner at Addleshaw Goddard, was describing conditions today when he said: "Currently such claims are a drain on business time and money and claimant firms continue to pursue them" ^[15].

The two lower-court tests differ on who has to prove what. Mr Justice Nicklin required the claimant to show that a third party had opened and read the statement ^[5]. Under the Court of Appeal's test, an unopened envelope at an old address can still found a claim ^[6]. Paymaster's 2019 mailing went to out-of-date addresses ^[3]. On the appeal court's test, how accurate the address file is decides how many claims one mailing error can produce.

Almost everyone affected joined. Of roughly 450 officers whose statements went astray, 432 joined the claim, about 96% ^[16]. They are seeking compensation for non-material damage such as distress or anxiety ^[14]. The breach was in 2019 and the first-instance ruling came in 2024, five years later ^[17].

The warnings of a flood come from two disputes lawyers, and Hyde said which side he speaks for. "On the defence side, everyone is hoping that the Supreme Court reinstates some control over trivial data protection claims," he said ^[7]. If the court passes up the chance, he said, "the Court system and business will continue to be inundated by a raft of individual and group claims based on trivial and spurious grounds" ^[8]. Tom Moore, a disputes resolution lawyer at Bird & Bird, said that if the appeal is refused "we are likely to see more claims brought or threatened against businesses by data subjects" ^[11].

City AM did not report the sums the officers are claiming ^[14]. A board therefore has a forecast of claim volumes and no figure for what each claim costs. In my view that is enough to justify checking whether breach-response plans still assume a claimant must prove a third party read the data, because the 2025 ruling already removed that requirement ^[6]. It is not enough to justify repricing insurance cover ahead of a pending judgment.

The officers brought their claim against the administrator that sent the letters ^[2]. Sussex Police declined to comment ^[13]. Paymaster's parent, Equiniti, administers pensions for the police, the civil service and the Armed Forces ^[9]. For a business whose work is mailing personal statements to long lists, exposure under the current test grows with every out-of-date address on those lists.

The hearing was set to conclude on Thursday ^[1]. For this quarter, the risk is in the address data. After judgment, it turns on whether the court sets a seriousness threshold at all ^[4]. If Paymaster loses, Moore said, firms will "find that any claim, no matter how trivial, can go to court without being struck out" on seriousness alone ^[12].