A matter before the Supreme Court (7th – 8th October 2026) is set to resolve one of the most consequential questions in UK data protection litigation: must a claimant's distress reach a minimum threshold of seriousness before they can recover damages under the GDPR?

Background

In August 2019, Paymaster – a pension and share-registration administrator – sent annual benefit statements to 432 current and former Sussex Police officers at outdated addresses. Those statements contained sensitive personal data, including names, dates of birth, National Insurance numbers, police service details, salary information, and accrued and forecast pension benefits.

The Information Commissioner's Office ("ICO") investigated the incident but concluded that no further action was required, assessing the risk of significant consequences as unlikely (many statements were returned unread). Nevertheless, the officers brought data protection claims for anxiety, distress, and loss of control over their personal information pursuant to Article 82 of the UK GDPR and section 168 of the DPA 2018. 

Decisions of the lower courts 

At first instance, the claims were struck out. The trial judge held that the claimants had no tenable case that the statements had actually been opened and read, and that mere mis-posting did not give rise to an actionable claim on the facts as pleaded.

The Court of Appeal ([2025] EWCA Civ 1117) reversed that decision, holding that disclosure to a third party was not essential to establish a breach of the data protection rules. Crucially, it also held that there is no seriousness threshold under Article 82 of the UK GDPR – although it acknowledged that individual claims could still fail where alleged fears of misuse were not well-founded. Equiniti appealed to the Supreme Court.

The question of de minimus

The Supreme Court must determine whether Article 82 of the UK GDPR and section 168 of the DPA 2018 require a claimant to demonstrate that any non-material damage suffered (such as distress or loss of autonomy) crosses a minimum threshold of seriousness before compensation can be awarded, commonly known as a ‘de minimus’ threshold. 

The arguments before the Supreme Court

Paymaster (represented by Mr Sharland KC of 11 KBW) contends that Article 82 distinguishes between a mere infringement and actual damage, that Recital 85 of the GDPR contemplates compensation for significant economic or social disadvantage, and that trivial emotional reactions should not give rise to compensation. It relies on the de minimis principle, proportionality, the potential litigation burden of mass claims, and comparative Commonwealth case law.

Mr Farley and others (represented by Oliver Campbell KC of St Johns’s Buildings) argue that Article 82 sets out only three requirements – an infringement, damage (material or non-material), and causation – and that importing an additional seriousness threshold would read words into the legislation and undermine the principle of full and effective compensation enshrined in Recital 146. They point to a consistent line of post-Brexit Court of Justice of the European Union ("CJEU") decisions confirming that no minimum level of seriousness is required, whilst accepting that actual damage and causation must still be proved.

The ICO (represented by Christopher Knight KC of 11 KBW) and the Open Rights Group (represented by Julianne Kerr Morrison of Monckton Chambers) intervene in written submissions only in support of the claimants. They argue that low-value claims should be managed using ordinary procedural tools rather than excluded by an undefined substantive threshold. They also warn that restricting recovery could weaken compliance incentives, impede group redress for widespread low-level harm, and risk divergence from EU law – with potential implications for the UK's adequacy status.

Potential outcomes and significance

The judgment will materially affect mass data-breach litigation, the treatment of minor distress claims, and the balance between individual redress and controller exposure.

If the Supreme Court upholds the Court of Appeal decision, low-level distress claims will remain in principle recoverable, though claimants will still need to demonstrate actual, causally connected harm. 

If it allows Paymaster’s appeal, a de minimis threshold will be introduced, making early strike-out significantly more viable for defendants facing large cohorts of low-value claims.

The decision is awaited with considerable interest by data protection practitioners, insurers, and any organisation that handles personal data at scale. 

We will report further when judgment is handed down.