Michael Farley (formerly CR) & Ors v Paymaster (1836) Limited

This judgment is divided into the following sections:

In this action, the Claimants, over 400 current or former police officers of Sussex Police, bring claims for breach of the General Data Protection Regulation (“GDPR”) and/or Data Protection Act 2018 (“the DPA”) and/or misuse of private information. In August 2018, the pension function of Sussex Police was transferred to the Defendant who, from that date, has been the administrator of the pension scheme to which the Claimants belonged.

In late August 2019, the Defendant sent to each member of the scheme an annual pension benefit statement (“the ABS”). The ABS provided an overview of the relevant member’s accrued benefits under the pension scheme. The information contained in each ABS necessarily varied, officer by officer, but broadly it contained his/her name, date of birth, national insurance number, and details of the officer’s salary and pension details (the particular information the Claimants contend was included in the ABS is set out in [26] below). It would have been apparent to any third party reading the ABS, from the information it contained, that the intended recipient of the ABS was a police officer.

It is common ground that, unfortunately, the ABSs were sent to out-of-date addresses (i.e. an address that had previously been provided by the relevant officer as his/her address for correspondence, but which had become out of date). This error appears to have happened because of the way in which the relevant Claimant’s address details were stored and processed in the database used by the Defendant. A complaint made by the Claimants is that this was not the first time that ABSs had been sent to the wrong addresses. They say that there was another incident earlier in 2019.

The sending of the ABSs to out-of-date addresses was detected by the Defendant and notifications were sent to those affected in early October 2019. Each affected officer was offered the opportunity to sign up to CIFAS, a fraud protection service, the fees of which would be met by the Defendant. The Defendant’s evidence is that 37 people took up the offer to sign up with CIFAS (which represented around 5% of those who were affected by the ABSs being sent to the wrong address).

The potential data breach was also reported to the Information Commissioner (“the ICO”) but, on 17 October 2019, the ICO confirmed to Sussex Police that no further action needed to be taken. The reasons given by the ICO for its decision were as follows:

“- The breach was caused by your [Sussex Police’s] data processor [the Defendant]. You had notified them of the change of addresses and they failed to effectively update their systems.

- You have conducted a risk assessment and concluded that the risk of data subjects suffering significant consequences as a result of this incident is unlikely; the data disclosed is limited in nature and each data set has only been sent to one household, who can be identified.

- You have a contract with [the Defendant], which specifically states that all their staff should have received data protection training.

- You have undertaken to inform the data subjects and… have been provided with a link to the ICO’s advice regarding identity theft. This can be forwarded to those data subjects to help them take any action they regard as necessary to protect their identities…”

Nevertheless, in these proceedings, the Claimants contend that the sending of the ABS to an incorrect address was a breach of the relevant data protection legislation by the Defendant and/or misuse of their private information entitling them to compensation. The Claimants have taken no action against Sussex Police.

Following a letter of claim, dated 28 February 2020, the Defendant (in a letter dated 2 April 2020) admitted that there had been a data breach and that the Claimants were “entitled to pursue [the Defendant] for loss, damage and/or distress allowable at law”.

On 23 February 2021, the Claimants’ solicitors sent a letter to the Defendant’s solicitors proposing the issue of a single Claim Form for all the Claimants, a Master Particulars of Claim and the selection of “test cases”, albeit not as a representative action under CPR 19.6. Accompanying that letter was a Schedule identifying the “damages sought” for claims in misuse of private information and breach of data protection. Each claimant claimed damages of £2,000 for misuse of private information, and a range of £1,064.80 and £2,606.20 for the data protection claim. The basis used to calculate these figures (which, in respect of the data protection claim, were oddly precise) has not been explained.

The Claimants’ solicitors’ position is that, individually, each claim is relatively ‘low value’ and that the cohort of claims “need[s] to be pursued in a cost-effective and proportionate way”. At the hearing, Mr Campbell KC estimated that the value of a typical claim (without a claim for personal injury) would be in the region of £1,250 to £1,500 (embracing both causes of action), representing a significant discounting of the figures provided with the letter of 23 February 2021.

The Claimants’ pre-issue costs were around £1.2m. As a purely mathematical calculation, that equates to just over £2,500 per Claimant at the date of issue of the Claim Form. For most Claimants, therefore, even at the point of issuing the Claim (the very first step in the litigation) they had spent more in terms of costs than they hoped to achieve by way of an award of damages. Mr Campbell KC accepted that any individual Claimant, acting on his/her own, would have been expected to have brought that claim in the County Court and that the claim would almost certainly have been dealt with on the Small Claims Track. Nevertheless, he contends that the only practical way for the cohort of Claimants to obtain redress – and effective access to justice – was to pursue this claim on a class basis.

As a result of directions given by the Court, the parties have provided to the Court broad information about their costs. For the Claimants, in October 2022, they had incurred costs of around £1.8m. At the date of the hearing that figure had risen to just short of £2m. The Claimants’ estimated budget for a trial of lead cases was £2.549m. The Defendant’s estimated budget for a trial of lead cases was £2.7m. The Claimants have also taken out ATE insurance. The claim for misuse of private information means that, if that claim is successful, they can seek to recover the premiums for the ATE insurance from the Defendant. At the hearing, Mr Campbell KC was quite candid that the potential to recover ATE premiums was an advantage to the Claimants in advancing a misuse of private information claim, which would not have been available had the Claimants pursued a claim solely for alleged breach of data protection.

The original Claim Form in QB-2021-001497 was filed on behalf of 474 Claimants on 22 April 2021 (“the First Claim”). 28 claims have been discontinued subsequently. As at the date of the filing of the Amended Claim Form, on 15 March 2023 (see [73] below), there were 446 active Claimants. The Claimants:

“… claim damages for breach of statutory duty pursuant to the General Data Protection Regulation and the Data Protection Act 2018 and/or misuse of private information arising from the Defendant’s failures to keep the Claimants’ personal data and private information (including financial pension information) secure by posting the same to incorrect postal addresses. The Claimants bring claims for financial and non-financial loss and damage in sums to be assessed.”

On 25 March 2021, prior to the issue of the First Claim Form, the Claimants’ solicitors issued an Application Notice seeking orders that all the Claimants be anonymised and that their addresses should be withheld and, on the Claim Form, replaced with the address of their solicitors (“the Anonymity Application”). The Application Notice provided the following as justification for the orders sought:

“(a)

The Claimants are 474 serving police officers who are bringing claims following a data protection breach and misuse of their private information relating to sensitive financial information concerning their pension benefits.

(b)

Some of the Claimants are high ranking officers and others work in sensitive areas of policing.”

A witness statement from Kingsley Hayes, a solicitor in the firm of Keller Lenkner, the Claimants’ solicitors, was provided in support of the Anonymity Application, dated 25 March 2021. Mr Hayes explained the background to the Claim and how, in August 2019, ABSs were sent to out-of-date addresses. As to the justification for the orders for anonymity of the Claimants and the withholding of their addresses, Mr Hayes stated:

“17.

The Claimants, being serving police officers are fearful on a number of fronts if their names and/or personal residential addresses are put into the public domain, in the sense that a third party may be able to interrogate the court file and obtain that information.

18.

The Claimants are serving police officers who range from the rank of Police Constable through Sergeant, Inspector, Chief Inspector and Superintendent. Some of the Claimants are thus very high ranking officers. Further, some of these officers work in a range of sensitive areas with higher levels of security and vetting. These areas include firearms, counter-terrorism, intelligence, public protection, safeguarding and child protection.

19.

As police officers, all Claimants, but particularly those of higher ranks and in these sensitive areas feel that they legitimately need to protect both their identity as having been involved in a data breach concerning their sensitive financial information, and their true address details.

20.

The latter point is of obvious relevance and concern to all police officers as their private residential address ought not to be available in the public domain at all having regard to their job and function. Therefore, there is a risk that suspects, associates, victims of crime, witnesses or others involved with the relevant officer may obtain their home address. The Claimants’ knowledge that this may happen adds to their anxiety and fear for their safety.

21.

Further, it is likely that when the claim is issued at court, there may be some press interest and that could lead to the Claimants’ names and their addresses being made available to non-parties who conduct a search of the court file. This is likely to lead to reports that certain named officers have been the subject of a data leak.

22.

Importantly, bearing in mind that there are certain categories of personal data as set out … above which may be in the hands of third parties already, it is entirely conceivable that much in the same way as wrongdoers may seek to “phish” for information from victims, those wrongdoers may obtain a further piece of the jigsaw by obtaining full names, middle names, initials or true home addresses of the Claimants as contained on the court file.”

On 7 April 2021, having considered the Claimants’ evidence, but without a hearing, the Master made an order granting anonymity to all 474 Claimants and permitting them to issue the First Claim Form withholding their names (to be replaced by ciphers) and giving, as their address, the address of their solicitors (“the Anonymity Order”). Without the permission of the Court, the Anonymity Order prevented non-parties from obtaining a copy of the Claim Form which recorded the Claimants’ names and addresses. A liberty to apply was included to vary or discharge the Anonymity Order.

A complaint made by the Defendant is that when the Claim Form and anonymised Particulars of Claim were served, on 23 April 2021, there was no way to identify the Claimants. It was not until 14 May 2021 that the Claimants provided a schedule that identified the Claimants. It was not until 12 May 2021 that the Claimants’ solicitors provided the Application Notice and witness statement in support of the Anonymity Application.

On 14 December 2022, without a hearing, I made an Order that the Court would reconsider the Anonymity Order at a hearing that had been fixed for 27-28 February 2023. I directed that if the Claimants (or any of them) contended that they should continue to be anonymised, then they must file and serve any further evidence in support by 4.30pm on 20 January 2023. The Defendant was given until 3 February 2023 to serve any evidence in response. The Order explained my reasons as follows:

“Anonymity orders are derogations from open justice which must be strictly justified. Although, on the evidence available, I consider that the Claimants may well succeed in demonstrating that there remain cogent grounds for withholding their addresses, the Court will want to look again at the justification, and evidence in support, for withholding the Claimants’ names. In this respect, attention is drawn to Various Claimants -v- Independent Parliamentary Standards Authority [2022] EMLR 4. Some Claimants may have a stronger justification for anonymity than others, and the evidence may vary between the Claimants.”

On behalf of the Claimants, Kingsley Hayes filed a witness statement dated 20 January 2023. He explained that the Claimants solicitors had reconsidered the issue of anonymity with the Claimants. As a result, the vast majority of Claimants were likely to be content to withdraw their application to be anonymised (although they maintained the application to withhold their addresses from Court documents open to public inspection). Mr Hayes explained that time was needed to take instructions from all the Claimants on the issue of anonymity.

As to the Claimants’ addresses, Mr Hayes referred to (and exhibited) guidance from the Association of Chief Police Officers, which recommended that police officers should not post their home addresses on the internet or on social media. He added:

“All, or certainly a great majority of the Claimants, regard their addresses as being confidential. If a claim form with names and addresses were made public this could provide any member of the public with a list of over 400 police officers and their addresses. … [Many] of the officers work in sensitive areas of policing and some are senior officers. Such a list could be put to nefarious use.

Making the addresses of the Claimants public would necessarily give rise to a troubling risk of harm both for the Claimants, and for their families. This is in the context of increasing anti-police sentiment, and violence against police officers.

Having spoken with officers in counterterrorism roles, we also understand that the publication of the addresses of the Claimants may well give rise to a terrorism risk. As we understand, credible intelligence has been disseminated to law enforcement that extremist groups have actively used information about police officers to plot terror attacks. The officers we have spoken with are unable to provide any further details due to issues of security and sensitivity.

The publication of the Claimants’ addresses would cause distress to many of the Claimants. Several Claimants have made clear that they would wish to discontinue their claims if their addresses are to be made public.

In addition, publication would risk aggravating the condition of those with pre-existing psychological conditions. We have served medical reports on behalf of over 30 Claimants evidencing a psychological injury as a result of the Defendant’s breach. Those reports will be made available to the Court for consideration in advance of the hearing on 27 and 28 February.

I would suggest that the real risk of the Claimants being physically targeted, in addition to distress they – and their families – would be caused, poses a strong moral argument in favour of the Court withholding the addresses of the Claimants.

Mr Hayes then provided specific information, in relation to several Claimants, as to their particular concerns as to why their address should not be available through public inspection of the records of the Court relating to the Claims.

On 31 January 2023, the Claimants’ solicitors filed witness statements from the following Claimants who sought to maintain the order for anonymity that they had been granted.

William Richmond-Coggan filed a witness statement, dated 3 February 2023, in relation to the Anonymity Application. He made several complaints about the lack of notice given to the Defendant of the original Anonymity Application and delays in receiving the evidence in support of the application and the schedule identifying the Claimants. Mr Richmond-Coggan drew attention to the fact that, in Kingsley Hayes’ witness statement of 25 March 2021, in support of the Anonymity Application, he stated that, “the Application is brought by the 474 individuals listed… who have provided instructions to [the Claimants’ solicitors] to bring a claim against the Defendant and make this application” (emphasis provided by Mr Richmond-Coggan). This, he contrasted with Mr Hayes’ statement, of 20 January 2023, in which he stated that his firm had only “identified a sample of officers who we directly spoke with” and that he had taken “targeted instructions”. Mr Richmond-Coggan suggested that this reference to instructions only having been taken from a sample of Claimants should be viewed in the context of the costs budgets filed by the Claimants. Those showed that the Claimants had incurred pre-action costs of £1,180,600 with a further £263,749 for preparing and issuing statements of case, and £120,042 for witness statements. These costs exclude VAT and disbursements, including Counsel’s fees.

More generally, Mr Richmond-Coggan stated that the Defendant “continues to have concerns about the quality of the evidence being tendered in support of anonymity, including over it being minimal, generic and not directly from the Claimants themselves”.

Particulars of Claim

With the First Claim Form, the Claimants filed what were called “Master Particulars of Claim” which set out “the common or generic claims made by the Claimants against the Defendant” (“the MPoC”).

The MPoC contended that each Claimant’s ABS contained the following information (“the Private Information”): (1) name; (2) date of birth; (3) national insurance number; (4) start date in service; (5) salary banding; (6) part time hours worked; (7) police service details; (8) value of final salary benefits; (9) average pensionable pay; (10) annual pension payable; (11) projected pension benefits including lump sum and residual annual pension; (12) death in service benefits; (13) Police Pension Scheme member reference number; and (14) Equiniti account number.

The Claimants contend that each of these pieces of Private Information is:

For the purposes of the DPA, the Claimants contend that the Defendant is a data controller rather than data processor.

Although the Claimants pursue other alleged breaches of the data protection legislation, arising from the way in which their addresses were processed by the Defendant, the principal complaint of each Claimant is about the sending of the ABSs to an out-of-date address in August 2019. This is alleged to amount to unlawful processing (“Unlawful Processing”). It is this Unlawful Processing that is alleged to have caused the Claimants non-material harm. Each Claimant alleges that the “mis-addressing” of the ABS and sending it through the postal system to “unknown third parties” constituted “a serious unjustified infringement and intrusion into each Claimant’s right to privacy” and/or a misuse of private information.

The misuse of private information claim is advanced by the Claimants in the following terms:

“11.1

The combination of the Defendants acts in (a) wrongfully mis-addressing each ABS containing the Private Information; and (b) sending each ABS through the postal service to unknown third parties constituted a serious unjustified infringement and intrusion into each Claimant’s right to privacy and/or a misuse of the Private Information as related to each Claimant

PARTICULARS

(a)

The Defendant knew that the Private Information was private and confidential and within the scope of each Claimant’s rights under Article 8 of the European Convention on Human Rights.

(b)

The Defendant disclosed the Private Information to unknown third parties, being person the Defendant knew the Claimants would not wish to have access to the Personal Information.

(c)

Each Claimant did not consent to the use of the Private Information by it being sent through the postal service to known and/or unknown third parties.

(d)

The Defendant allowed a situation to arise whereby the Claimant each lost control and autonomy over the Private Information.

11.2

Further, or in the alternative, each Claimant held a reasonable expectation that the ABS would be sent from the Defendant to him/her.

11.3

As a person in control of the Correspondence, the Defendant’s act of mis-addressing each ABS containing the Private Information and sending the Correspondence to unknown third parties, constituted a serious unjustified infringement of each Claimant’s right to respect for their correspondence. The Claimants repeat the particulars provided in the preceding sub-paragraph.”

In terms of loss and/or damage, each Claimant claimed to have suffered damage caused by the alleged “infringements”. This damage was identified as:

The MPoC stated that the Claimants intended to provide “Heads of Damage” for each Claimant. As the Defendant has complained, no application had been made to disapply CPR PD 53B §2.2 which required the Claimants to provide particulars of their claim for damages (see [85] below).

The particulars of damage and distress provided in the MPoC, in respect of the data protection claim, included the following:

“(a)

The Claimants have been caused anxiety, alarm, distress and embarrassment by the fact that the Personal Data has passed and/or may have passed into the hands of unknown third parties.

(b)

As a result, each of the Claimants seek (sic) compensation for moral and/or non-material damage.

(c)

Further, as soon as each ABS was put into the postal service bearing the wrong address, the Claimants each suffered an immediate loss of control and/or autonomy and/or a diminution in the Personal Data, including having regard to their right to determine how any Personal Data should be used, with whom it should be shared, where it is made available and when it should no longer be made available.

(d)

… unless the Defendant can provide any ABS which was physically returned unopened to the Defendant as sender, the Claimants infer that the (sic) each envelope was opened and read by an unknown third party…

(e)

The Claimants each seek as a discrete head of loss, the loss of autonomy and/or control over their ABS and the consequential distress as a result of the same. For the avoidance of doubt, all Claimants seek compensation in this regard even where it may be shown that an ABS was returned, on the basis that there was a loss of control and/or autonomy for the period between posting and physical return…

The Claimants claimed for damage and distress for similar “loss of control and/or autonomy” in respect of the misuse of private information claim.

No particulars were provided to support the inference, pleaded in sub-paragraph (d), that mis-addressed ABSs would be opened and read by unknown third parties.

Finally, the MPoC contained an apparent claim for personal injury for some of the Claimants who it was alleged had “suffered an aggravation of pre-existing medical conditions” and in respect of whom a further award of general damages was sought.

The MPoC were filed before the decision in Lloyd -v- Google LLC [2022] AC 1217. Mr Campbell KC confirmed, at the hearing, that, following the decision of the Supreme Court, the Claimants were not pursuing a claim for damages for ‘loss of control’.

Defence

The Defendant’s Defence was filed on 9 July 2021.

Reply

In a Reply, dated 24 August 2021, the Claimants:

Further Information of the claims and Individual Schedules

The Defendant made a Part 18 Request for Further Information on 9 March 2022. Following an application by the Defendant, on 27 April 2022, each Claimant was ordered to provide further information about his/her case, including providing details of his/her case on the loss and/or damage claimed. That was achieved by each Claimant being required to answer a series of questions. In response, by the end of July 2022, each Claimant filed a Schedule setting out specific information relating to his/her claim that was verified by a statement of truth (“the Individual Schedules”).

Although the amount of detail provided varied, each Individual Schedule sets out the relevant Claimant’s claim on whether s/he:

By way of example, the Individual Schedule filed on behalf of the First Claimant:

In this judgment, it is not necessary to analyse each of the Individual Schedules. Some common themes emerge; for example, the fear that the relevant Claimant would be a victim of identity theft. The evidence filed by the Claimants has not demonstrated that the apprehended risk of identity theft has materialised. Some of the Claimants have, in their Individual Schedules, raised concerns over receipt of spam emails or suspicious financial transactions, but given that neither email nor financial information was contained in the ABS, it is difficult to see how that could be attributed to any misuse of information from the ABS by a third party. Substantially, the claim for each Claimant is very much put on the distress/anxiety caused by the apprehension that s/he might be a victim of identity theft.

On 25 July 2022, the Claimants’ solicitors wrote to the Defendant’s solicitors to advise that:

“… during the course of [the] exercise [to provided the Individual Schedules], it has become apparent that approximately 75 Claimants (“the Medical Claimants”) require a medical examination by a psychologist. The data breach has caused the Medical Claimants to suffer to the extent that warrants the referral to a medical expert. We are in the process of making the necessary referral to experts for the Medical Claimants and will be in receipt of CPR Part 35 compliant medical reports in due course.”

The Claimants’ solicitors stated that, by their calculations, the limitation period for any personal injury claims, would expire on 30 August 2022. They sought the Defendant’s agreement to a standstill agreement in respect of these further personal injury claims.

On 5 August 2022, the proposal of a standstill agreement was rejected by the Defendant’s solicitors.

On 8 August 2022, the Claimants’ solicitors wrote again to the Defendant’s solicitors. The letter included the following, under the heading “Medical Claimants”:

“You are no doubt aware that the Claimants have sought to manage this claim at proportionate cost throughout. The Claimants’ stated intention throughout has been to have these claims managed by way of a mechanism akin to group litigation. We have maintained this to be the most proportionate way of managing the claim as a whole. To that end elements of individual work were deliberately restricted so as to keep costs to a minimum and to provide you with the necessary claim information in the form of Schedule of Information (“SOI”). This wouldn’t have required a deep dive, and the associated cost, into detailed distress and medical information for each Claimant.

However, your client has disagreed with the Claimants’ proposed mechanism throughout this claim. You sought individually particularised statements of case for each and every Claimant in this action and that is what the Master ordered. As part of that costly exercise, we have had to take full and complete instructions in order to answer the questions set by the Master, at your behest. Full and complete instructions from every Claimant have been taken. As a result of that exercise, it is clear that there is (sic) significant levels of aggravation amongst the Claimant cohort and must now be investigated.

The exercise that you have requested throughout this litigation has been completed and it has escalated costs and potentially damages significantly. You cannot reasonably now complain that these instructions should have been taken at the start of the claim when you do not like the results of your client’s own submissions. Essentially, your client has made its bed and now it must lie in it.

Contrary to your point that we are only now asserting personal injury claims, we would ask you to re-read the Claimants’ letter of claim dated 28 February 2020 in which it was stated... that ‘… it may be appropriate in certain individuals’ cases to consider the psychological and psychiatric impact of the personal data breach’. Further, in … the Master Particulars of Claim it was stated that ‘Further, certain of the Claimants have suffered an aggravation of pre-existing medical conditions and seek general damages as a result.’

Arguably, those Claimants now advancing ‘medical claims’ fall under that paragraph. However, it is only out of an abundance of caution and in circumstances where you may seek to argue otherwise and take a limitation point that we had hoped that the parties could co-operate in agreeing a standstill agreement. Such a course would further the parties’ obligations to co-operate with each other, save costs and be in accordance with the overriding objective. However if, as it seems, you wish to take the point, we will have to act accordingly in order to protect the Claimants’ position…

We will now start work to prepare to issue a further claim form for the medical Claimants with the associated cost of the Court fee…”

In a further letter, dated 19 August 2022, the Claimants’ solicitors indicated that they intended to issue a protective Claim Form for the Medical Claimants (as previously described) “shortly”.

On 31 August 2022, a sub-set of 63 Claimants in the First Claim issued a further Claim Form seeking damages for personal injury alleged to have been occasioned by the sending of the ABS to the wrong address (“the Second Claim”). No application was made to amend the existing MPoC or Individual Schedules. This Claim Form in the Second Claim was issued, as the Claimants’ solicitors had indicated in correspondence, to protect the relevant Claimant from any arguable defence of limitation that might be raised. Before service of the Claim Form, by amendment, the number of Claimants in the Second Claim was reduced to 42 (see [50] below).

On 10 October 2022, the Defendant’s solicitors sought confirmation whether a further claim had been issued, as threatened by the Claimants. The Claimants’ solicitors did not tell the Defendant’s solicitors that the Second Claim had been issued. That failure has not properly been explained by the Claimants.

By Application Notice dated 6 September 2022, the Claimants in the Second Claim applied for, and by Order dated 21 December 2022, were granted by the Master an anonymity order in similar terms to that granted in the First Claim (“the Second Anonymity Order”). That Application was made without notice to the Defendant.

On 21 December 2022, the Claimants’ solicitors wrote to the Defendant indicating that the deadline for service of the Claim Form in the Second Claim was 30 December 2022. This was the first that the Defendant knew of the Second Claim. The letter stated that the Claimants “[did] not propose to seek an extension for service of the [Claim Form in the Second Claim] but would be grateful if you could confirm whether you are amenable to an extension of time for service of the supporting medical evidence”. The Defendant’s solicitors refused that request.

The Claimants’ solicitors purported to serve the Claim Form by email on 30 December 2022. In doing so, they relied upon a prior indication by the Defendant’s solicitors, in a letter dated 11 March 2021, that they were authorised to accept service of the proceedings, and would accept service by email providing certain conditions were met. Before it was served, the Claim Form was amended to remove several Claimants, leaving the Second Claim being pursued by 42 Claimants. The Claim Form in the Second Claim was accompanied by medical reports for some, but not all, of the remaining Claimants. The Claim Form indicated that Particulars of Claim in the Second Claim were “to follow”.

By email, at 12.29 on 30 December 2022, after purported service of the Claim Form in the Second Claim, the Defendant’s solicitors advised the Claimants’ solicitors that they did not accept service of the Claim Form in the Second Claim by email. Also, on 30 December 2022, the Claimants in the Second Claim issued an Application Notice seeking an extension of time for the service of medical evidence for the remaining Claimants. This Application did not include an application for an extension of time for service of Particulars of Claim. Under CPR 7.4(2), Particulars of Claim must be served on a defendant no later than the latest time for serving a Claim Form (i.e. 30 December 2022).

“Draft” Master Particulars of Claim in the Second Claim, dated 17 January 2023, were apparently provided to the Defendant on 6 February 2023. By 16 February 2023, medical reports for all Claimants in the Second Claim had been served. The Claimants in the Second Claim subsequently made an Application for an extension of time for service of the Particulars of Claim (see [66] below).

This statement of case in the Second Claim largely repeated the claims made in the First Claim, but also expressly adopted a claim for personal injury alleged to have been caused by the alleged breach of data protection/misuse of private information. Brief details of the alleged psychological injury claim of each Claimant were included in a Schedule attached to the Master Particulars of Claim, which also identified the medical report from a clinical psychologist relied upon by each Claimant.

Again, taking an example of one of the expert reports filed in support of a claim for personal injury, the 48^th Claimant (Scott Walters) has relied upon a report from Dr Rosalie Hughes, Consultant Clinical Psychologist, dated 30 November 2022. Dr Hughes states that, in her opinion, the data breach had caused exacerbations of pre-existing psychological symptoms.

Dismissal Application

On 17 October 2022, the Defendant issued an Application Notice seeking to strike out the Claimants’ claims and/or for summary judgment (“the Dismissal Application”). The Dismissal Application was released to be heard by a Judge of the Media & Communications List, on 9 November 2022, and fixed for hearing on 27-28 February 2023.

The grounds of the Dismissal Application were as follows:

The Dismissal Application was supported by witness statements, on behalf of the Defendant, from William Richmond-Coggan and Adam Green, both dated 17 October 2022. In answer, the Claimants have filed a witness statement from Kingsley Hayes, dated 9 December 2022. Exhibited to Mr Hayes’ statement were separate statements from eight Claimants. In response, the Defendant filed a further witness statement from Mr Richmond-Coggan, dated 13 January 2023.

As part of the evidence filed by the Defendant, examples of the envelope in which the ABSs were sent have been provided together with specimen letters. From an unopened letter, all that could have been seen would have been, through the window of the envelope, the name of the addressee together with the out-of-date address and, printed on the outside of the envelope, the words “Private and Confidential” and a return address of the Defendant. Scrutiny of an unopened envelope would give no indication that an intended recipient was a police officer. Mr Sharland KC submitted that the only piece of information visible from an unopened letter, that the Claimants contend is private and/or personal data, is the relevant Claimant’s name. He argues that this is de minimis and incapable of supporting a claim for misuse of private information and/or data protection.

In the few cases, where the relevant Claimant has positive evidence that the ABS was opened, Mr Sharland KC submits that the initial pages of the letter included no personal information beyond the name of the intended recipient and his/her reference number. By way of example, the first page of the ABS contained the following:

“SUSSEX POLICE PENSION ANNUAL BENEFIT STATEMENT

A Benefit Statement is attached showing the details that we hold about you and the pension benefits you are accruing under the Police Pension as at [date]. If the information we hold about you is wrong, this could affect the way we calculate your pension when you come to claim it.

Action for You

Please read the enclosed notes and check carefully that the details on the Benefit Statement are correct as far as you can tell. You need to:

•

tell us of any mistakes; please send an email to us at the above address. Revised Benefit Statements will not be issued to reflect amendments to address, National Insurance number, title, marital status or spelling errors. These amendments will be reflected in your next Annual Benefit Statement. Where it is necessary to re-issue a statement we will endeavour to send this to you within 8 weeks of your email.

•

ask us if you are unsure about any of the details; experience has shown that it is better to put things right now rather than waiting until retirement. If you have any queries or are not sure about what some of the details contained on the Benefit Statement mean, please contact us using the above email address;

•

keep the Benefit Statement; including any details or comments that you have made on it or have attached to it until you reach retirement (or leave the Scheme).

Action for us

As pension scheme administrators, we want to maintain your records properly and ensure that we calculate your pension correctly. If you find any errors in the Benefit Statement, we will correct them. We will send you a Benefit Statement annually so that you can see how your pension benefits are growing and to check the details we hold.”

The detailed pension information, which contained the bulk of the information in respect of which the Claimants maintain a claim for misuse of private information and/or data protection was found in an enclosure. Mr Sharland KC argued that a person, who opened the ABS by mistake, would have immediately appreciated (a) the broad nature of the document before s/he reached any of the personal data of the relevant Claimant, and, more importantly (b) that it was not meant for him/her.

Based on the evidence filed for the hearing, in his skeleton argument, Mr Sharland KC provided the following summary of the claims:

As noted already, the majority of the Claimants have relied on an inferential case that their ABS was opened (and read) by a third party (see [33]-[34 above). It is necessary to look more closely at the claims of the 14 Claimants who have advanced a positive case that their ABS was opened (and read) by a third party. Those are the claims bought by the 14^th, 75^th, 109^th, 111^th, 155^th, 200^th, 247^th, 253^rd, 258^th, 307^th, 342^nd, 359^th, 386^th and 472^nd Claimants. The information provided in the Individual Schedules for these Claimants includes the following:

As to the claims for damages advanced by the Claimants, Mr Sharland KC extracted the following summary from the Individual Schedules:

Striking Out Application

On 12 January 2023, the Defendant issued an Application Notice seeking an order striking out the Second Claim on the grounds that the Claimants in the Second Claim had failed to serve Particulars of Claim by the deadline imposed by CPR 7.4(2) (“the Striking Out Application”).

The Striking Out Application was referred to me. Without a hearing, I made an Order, on 17 January 2023, listing the Striking Out Application to be heard at the hearing that had been fixed for 27-28 February 2023, and gave directions for evidence to be filed by the parties. I also directed that:

In compliance with that Order, the Claimants filed a further witness statement from Mr Hayes, dated 24 January 2023. He stated that the decision to issue the Second Claim was to protect the relevant Claimants from any argument by the Defendant that their claims were time barred, and explained:

“The Claimants’ primary position is that these 42 Claimants [in the Second Claim] are entitled to pursue claims for damages for personal injury as part of the [First Claim]. If the Court agrees, or that is now accepted by the Defendant, then the Claimants would be content for the [Second Claim] to be stayed. However, if the Court concludes that these Claimants are not entitled to claim damages for personal injury as part of the [First Claim], then the Claimants would wish to pursue the [Second Claim] and the Defendant’s application to strike out the [Second Claim] would need to be determined…”

Application by the Claimants in the Second Claim

On 24 January 2023, the Claimants in the Second Claim issued an Application Notice seeking orders that:

In relation to this procedural thicket, the Claimants submitted:

Despite the observations made in the Order of 17 January 2023 questioning why the Claimants had not simply sought permission to amend the First Claim, no such application was made by the Claimants prior to the hearing on 27-28 February 2023. At the hearing, the Claimants faintly pursued their suggestion that they be granted permission to amend the Particulars of Claim in the First Claim to enable the Claimants in the Second Claim to pursue a claim for personal injury (see [67(2)] above). I refused to do so. The Court of Appeal has deprecated first instance courts dealing with applications to amend ‘on the hoof’: see Sayn-Wittgenstein-Sayn -v- HM Juan Carlos Alfonso Victor María de Borbón y Borbón [2023] 1 WLR 1162 [63]. The Claimants had had sufficient time in advance of the hearing on 27-28 February 2023 to propose draft amendments to the MPoC in the First Claim to the Defendant and, if consent were not forthcoming, to issue the necessary Application Notice to seek permission to amend. By the time of the hearing, they had not done so.

The Claimants’ position in relation to the Second Claim remains difficult to understand. Mr Campbell KC referred me to Chandra -v- Brooke North [2013] EWCA Civ 1559 [69] as providing the Court of Appeal’s suggestion that, where a claimant seeks permission to amend in circumstances where the amendment sought might arguably time barred, the prudent course is to issue a second claim prior to expiry of the limitation period. No one can quarrel with the good sense of that recommendation. However, here, the Claimants did not issue an application to amend the First Claim either before issuing the Second Claim or at any time before the hearing on 27-28 February 2023. In circumstances where a second claim is issued, protectively, it is as a fall back to guard against any adverse ruling of the Court refusing permission to amend the first claim.

At the hearing, I was unable to understand the stance adopted by the Claimants. Objectively judged, even if there was a risk of the limitation period for any claim for personal injury expiring, the Claimants appeared to me to have what appeared to be an unanswerable argument that the amendments sought would fall within CPR 17.4(2). The Claimants in the Second Claim were simply advancing a claim that they had additionally been caused personal injury as a result of the sending of the mis-addressed ABSs. The underlying facts in the First Claim remained the same. Yet, by the time of the hearing, they had not taken the step of issuing an application seeking permission to amend.

At the hearing, the Defendant did not challenge the contention that, if required, the Claimants could rely upon CPR 17.4(2) in relation to any application to amend the First Claim. Challenged that this was not a particularly constructive approach, the Defendant submitted that it was not required to assist the Claimants in formulating their claims, or for that matter, to assist in sparing the Court from interminable procedural wranglings by proposing a pragmatic solution. The Defendant’s position was the Court should simply rule on the Applications that were in front of it. In the circumstances of this case, that was not a helpful stance to adopt.

So that the Court could deal with the real issue between the parties in relation to the claim for personal injury, I made an Order, at the hearing, that, by 4.30pm on 2 March 2023, the relevant Claimants in the First Claim should file and serve any Application to amend their claim so as to include a claim for personal injury. The Defendant was required to confirm in writing, by 17 March 2023, whether it consented to any Application to amend made by the Claimants.

Anonymity Orders discharged

As a result of the change of the Claimants’ stance on the issue of anonymity, only 9 Claimants sought to maintain the Anonymity Order in their claims (see [22] above). In consequence, pending determination of the issue whether the Anonymity Order should be maintained in the case of those Claimants, I made an order discharging the Anonymity Order, save for those Claimants who wished to argue that anonymity should be maintained in their case. The Claimants were directed to file an Amended Claim Form providing the names of the Claimants who had previously been anonymised and in respect of whom the Anonymity Order had been discharged. An Amended Claim Form was duly filed on 15 March 2023. Since then, it has been available for public inspection under CPR 5.4C(1) and the Schedule attached lists the names of all Claimants in respect of whom the Anonymity Order has been discharged.

Further Applications and evidence in respect of other derogations from open justice

At the hearing on 27-28 February 2023, the Claimants indicated that they (or most of them) wished to maintain that their addresses should be withheld from the Claim Form and other documents required to be filed with the Court that were open to public inspection. At the hearing, the Claimants also sought restrictions on third party access to the Individual Schedules pursuant to CPR 5.4C(4), largely because public access to the Individual Schedules would frustrate the Applications of those Claimants who were seeking orders to restrict public access. I made orders:

Following the hearing and in accordance with directions given by the Court, on 5 May 2023, the Claimants issued a further Application Notice seeking derogations from open justice in two categories of Claimant:

Each Claimant who sought orders in either or both of these categories filed a witness statement in support of the Application. In addition, Kingsley Hayes, of the Claimants’ solicitors also provided a witness statement, dated 5 May 2023. Mr Hayes’ witness statement provides a helpful summary of the Claimants’ individual witness statements:

“… to assist the Court and by way of overview, the following features concerning the current position of the Claimants are common to many of the statements:

(a)

Many Claimants refer to receiving guidance or recommendations from the Force to prevent their home addresses being identified, and all Claimants outline the various measures they take to retain the confidentiality of their home addresses. Examples of such steps taken by some Claimants include:

(i)

Using their maiden name at work;

(ii)

Moving to a different area to that in which they police;

(iii)

Removing their details from the electoral roll; and

(iv)

Not having a social media presence.

(b)

Almost all Claimants refer to the current very high anti-police sentiment amongst the public, noting that violence against police officers is on the rise.

(c)

The vast majority of Claimants refer to encountering dangerous individuals due to the nature of their role. A significant number refer to receiving threats in the course of their duties and/or being aware of threats made to colleagues. Several note that such threats are less worrying whilst their home address is not publicly identifiable.

In addition, the statements refer to the potential consequences to Claimants of not being granted the order sought. Some of these potential consequences are outlined below:

(a)

Relocation: Some Claimants detail that they would be forced to move homes were their address and details in the schedule to become accessible to the public (see for example the [exhibited] statement at pp.25-29). Other Claimants note that, where credible threats have previously been identified to officers’ home addresses, the Force has acted to place markers on their address or even re-locate them.

(b)

Barrier to justice: A high number of Claimants state that they would consider discontinuing their claims should their address and schedules be compromised, in order to protect their personal safety.

(c)

Injury: Those Claimants seeking damages for personal injury in this claim have opined that non-protection of their addresses and schedules may exacerbate and/or revive their injuries.

(d)

Professional restrictions/interference: Several Claimants note that disclosure would prevent them from moving into more sensitive areas of policing. Others currently working in such sensitive areas worry about being taken off active duty, or moved to an alternative unit, thereby undermining operations.

(e)

Career progression: Some Claimants have raised the issue that by reason of having to make their addresses or Claimant Schedules accessible, that would either deter them from applying for sensitive roles or may mean that any application might be declined, thus frustrating their ability to progress within the Force.”

Each Claimant, in his/her witness statement, has explained why an order should be made in these terms in his/her favour. The reasons differ, Claimant by Claimant, but some themes emerged from this evidence. A common justification, advanced in support of a 5.4C Order, was that, apart from close family and immediate colleagues, the officer’s role within the police was not public knowledge. Some officers stated that they would be “worried and frustrated” if their role in the police did become public knowledge. Some suggested that it might lead to their being “targeted by criminals”, others that such knowledge would put the officer and his/her family “at grave risk of harm”.

Finally, the Claimants have filed a witness statement from the Data Protection Officer at Sussex Police, Martin Brazier, also dated 5 May 2023. Mr Brazier states that Sussex Police issues guidance regarding the steps that its officers can take in order to protect their identities. He exhibits the guidance that is provided to officers and states:

“This advice is given to ensure that members of the public cannot identify officers outside of work and so that officers can preserve the confidentiality of their addresses. Unfortunately, there are people who would seek to do harm to police officers and indeed their families. Someone who has been arrested by an officer, or who has come into contact with them, may seek a confrontation. It is one thing when this happens at a police station, but another if it happens at the home address of the officer where their family resides…”

Mr Brazier adds that the threat level to the UK Police Service remains “substantial”. Guidance is given that: “Police officers are considered legitimate, accessible and symbolic targets for attack by Islamist and Extreme Right-Wing terrorists…” Mr Brazier states that he is aware of Facebook groups that are dedicated to identifying police officers and harassing them. The names of police officers are, he says, routinely redacted when documents are provided, for example in response to subject access requests under the data protection legislation and when documents are provided in Court proceedings. Mr Brazier states that if a police officer’s home address were to be made publicly available, that might affect the officer’s ability to move into more sensitive areas of policing with increased vetting requirements.

Mr Hayes, in his witness statement, stated that the Claimants were not seeking a “blanket restriction” on public access to the Individual Schedules. He suggested that they were seeking only a requirement that any third party wishing to obtain a copy from the records of the Court should be required to make an application. “The order sought thereby attempts to go no further than establishing a simple and limited safeguard against access by nefarious parties for malevolent purposes, and in order to protect the safety of the Claimants.”

Application to amend the MPoC in the First Claim to advance the personal injury claims

Further to the Order made at the hearing (see [72] above), the Claimants duly issued an Application Notice on 2 March 2023 seeking (if necessary) permission to amend the First Claim to enable the relevant Claimants to advance a claim for personal injury (“the Application to Amend”).

On 17 March 2023, the Defendant’s solicitors confirmed that, subject to receiving some points of clarification, the Defendant consented to the Application to Amend.

Subject to hearing the parties’ further submissions, it would appear that the consequence of this is that the Second Claim has been rendered otiose. I shall deal with the consequential orders in relation to this Second Claim when this judgment is handed down.

Striking out

The Court can strike out a statement of case (in whole or in part) if it appears that it discloses no reasonable grounds for bringing the claim: CPR 3.4(2)(a). PD 3A §1.2 provides examples of cases where the Court may conclude that Particulars of Claim fall within CPR 3.4(2)(a), including where the Particulars of Claim “contain a coherent set of facts but those facts, even if true, do not disclose any legally recognisable claim against the defendant”.

For Media & Communications claims, CPR PD 53B §2.1 provides:

“2.1

Statements of case should be confined to the information necessary to inform the other party of the nature of the case that they have to meet. Such information should be set out concisely and in a manner proportionate to the subject matter of the claim…

2.2

A claimant must in the particulars of claim give full details of the facts and matters on which they rely in support of any claim for damages.

…

8.1

In a claim for misuse of private information, the claimant must specify in the particulars of claim … the use … of the information by the defendant which the claimant claims was … a misuse…”

A striking out application requires analysis of the statement of case, without reference to evidence. Unless demonstrably and patently hopeless, the Court proceeds on the assumption that the relevant factual averments will be established by evidence at trial. The Court should not be deterred from deciding a point of law; if it has all the necessary materials, it should “grasp the nettle”. Where a statement of case is found to be defective, the Court should consider whether the defects might be cured by an amendment and, if it might be, the Court should consider whether to give the party concerned an opportunity to amend: Morgan -v- Associated Newspapers Ltd [2018] EWHC 3960 (QB) [39]; Duchess of Sussex -v- Associated Newspapers Ltd [2020] EWHC 1058 (QB) [33(2)]; Duke of Sussex -v- Associated Newspapers Ltd [2023] EWHC 3120 (KB) [35].

Summary Judgment

There is no real dispute between the parties as to the principles that apply when the Court is deciding a summary judgment application. I can take those principles from Lawrence -v- Associated Newspapers Ltd [2024] EMLR 3 [77]:

Misuse of private information

The tort of misuse of private information has a two-stage test. First whether the claimant has a reasonable expectation of privacy in the relevant information; and second whether that expectation is outweighed by any countervailing interest: ZXC -v- Bloomberg [2022] AC 1158 [47]. The question whether there is a reasonable expectation of privacy is a broad one, which takes account of all the circumstances of the case: Murray -v- Express Newspapers plc [2009] Ch 481 [36].

The ‘misuse’ relied upon to found a claim must “attain a certain level of seriousness”: ZXC [45] and In re JR38 [2016] AC 1131 [87] (approving the articulation of this principle by Laws LJ in R (Wood) -v- Commissioner of Police of the Metropolis [2010] 1 WLR 123 [20]-[22]). In Underwood -v- Bounty UK Ltd [2022] EWHC 888 (QB), the claimants’ claims were dismissed on other grounds, but I did find that the information obtained was trivial (name, gender and date of birth) and did not meet the level of seriousness to sustain a claim for misuse of private information: [53].

In this case, the Defendant does not contend that there is a justification for misaddressing the ABSs. It contends that, unless the contents of the ABSs have been read by (and published to) a third party, there has been no ‘misuse’. As a fall-back, the Defendant also argues that, even if an ABS was read by a third party, that cannot constitute ‘misuse’ under the tort.

The issue of what constitutes ‘misuse’, for the purposes of the tort, has arisen in several decisions. Mr Campbell KC has referred to the Court of Appeal’s decision in TLT -v- Secretary of State for the Home Department [2018] 4 WLR 101 [50] as establishing that liability for misuse of private information may arise as a result of ‘human error’. In a similar vein, Saini J observed in Warren -v- DSG Retail Limited [2021] EMLR 25 [27] that the ‘misuse’, relied upon to found the action:

“… may include unintentional use, but it still requires a ‘use’: that is, a positive action. In the language of Article 8 ECHR (the basis for the MPI tort), there must be an ‘interference’ by the defendant, which falls to be justified.”

I accept that principle, as far as it goes, but TLT was a case in which the claimants had established, at trial, that a spreadsheet containing their private information had been published on a website and, on the evidence, had been downloaded 27 times by 22 different IP addresses. In other words, that there had been an interference with the privacy interests of the claimants caused by the negligent act of publication of the spreadsheet containing the claimants’ private information to the various third parties who had downloaded the document.

Warren was a cyber-attack case, where personal data was obtained by hackers from the defendant’s computer systems. Striking out the claim for misuse of private information, Saini J found that there had been no ‘misuse’ of the claimants’ personal information by the defendant; it had been the victim in the cyber-attack. The Judge held that misuse of private information could not be maintained in respect of what was, in essence, a complaint about alleged inadequate data security: it was, he noted, “an unconvincing attempt to shoehorn the facts of the data breach into the tort of MPI”: [27].

Saini J returned to consider this point in another cyber-attack case: Smith -v- Talktalk Telecom Group plc [2022] 1 WLR 5213. The Judge held:

In Stadler -v- Currys Group Limited [2022] EWHC 160 (QB), the Court dismissed claims for breach of confidence and misuse of private information arising from the Defendant’s resale of a television set which had not been adequately ‘wiped’ to remove some of the Claimant’s data stored on it. HHJ Lewis held [58]:

“In passing the Smart TV to a third party the defendant was not making use of the data or information that is the subject of this claim. In fact, there is no evidence that the defendant had any actual knowledge of the information in question or made use of it. It follows that there cannot have been any unauthorised use (or misuse) of the information by the defendant. It would be artificial to characterise the disposal of the Smart TV as a misuse of the information itself. At best, it could be said that in failing to wipe the device, the defendant was responsible for breaching a duty of data security, but this is insufficient on the facts of this case to make out claims for either BOC or MOPI.”

In my judgment, based on these authorities, if a Claimant in this case can show that, as a result of his/her ABS having been read by a third party, information over which s/he has an expectation of privacy has been disclosed/published, then (subject to satisfying the threshold of seriousness) s/he has an arguable case for misuse of private information. This is not like a data breach case where a third party has unlawfully obtained the information as a result of hacking or a cyber-attack. This case is much closer on the facts to TLT. Where a Claimant can demonstrate publication of the private information in an ABS, that has arisen from the Defendant’s act of sending the ABS to the wrong address, then that can, in my judgment, provide the element of ‘misuse’ for the tort. I therefore reject the Defendant’s fall-back argument (see [90] above).

That leads me on to a further, and important, point. In this case, each Claimant’s claim of misuse of private information depends upon his/her ABS having ended up in the hands of (at least) one third party who, it is contended, would have opened the letter, and read the contents. For almost all Claimants, that case is purely inferential.

The Defendant contends that – absent an averment in the statement of case (and ultimately proof) that the ABS was read by any third party, a claim for misuse of private information either fails to disclose a cause of action or has no real prospect of success. For that element of publication of the ABS to a third party, the Defendant relies – by analogy – upon principles from the law of defamation which establish that there is no presumption that a letter – sent in the post – will be read by anyone other than the addressee. The authors of Gatley (13^th edition, 2022, Sweet & Maxwell) give the following summary of the principles of publication in §7-017 (footnotes, omitted or expanded):

“As a general rule, when a letter is addressed to a particular person, the writer is not responsible except for a publication to that person. However, if in the circumstances of the case the writer knows that the letter will be opened and read by some person other than the person to whom he addresses it, he will be liable for the publication to that person. As it was put by Swinfen Eady LJ in Huth -v- Huth [1915] 3 KB 32, 43 if:

‘a person sends a letter to, say, a merchant at his office, knowing that the merchant has a staff of clerks who in the ordinary course of business open all letters sent to the merchant’s office, that would clearly be a publication if the letter were opened and perused by a clerk in that way, even although that letter were most carefully sealed.’

By analogy with the cases in the next paragraph, it is submitted that the true rule is that the defendant will be liable if he has reason to know that the letter may be opened in the ordinary course of business by someone other than the addressee and, probably in modern business conditions, such knowledge will generally be imputed to him, unless the letter carries some clear indication (e.g. by being marked ‘personal’ or ‘private and confidential’) to show that this should not take place. There may also be cases in which the defendant has reason to know that a letter sent to a private address may be opened by someone other than the addressee, though in practice this may be less likely than in the case of a letter sent to a business address. Such a case might arise, e.g. if the writer knew that the addressee was illiterate or blind.

In Theaker -v- Richardson [1962] 1 WLR 151, where the defendant put a letter intended for the plaintiff into an envelope similar to one which would contain an election address and delivered it by hand and the plaintiff’s husband picked it up and opened it, there was evidence on which the jury could find, as they did, that the defendant anticipated that someone other than the plaintiff might open and read the letter, and that it was a natural and probable consequence of the defendant’s act that the plaintiff’s husband would open and read it. There was accordingly held to have been publication. The appearance of the communication is significant in this case: it should certainly not be taken as supporting the view that one must assume that spouses open each other’s letters. On the other hand in Huth -v- Huth, where the defendant sent through the post in an unclosed envelope a written communication defamatory of the plaintiff which was taken out and read by the plaintiff’s butler out of curiosity, the Court of Appeal held that there was no evidence of publication, for there was no evidence that, to the defendant’s knowledge, the letter would in the ordinary course be likely to be opened by the butler, or by any other person at the plaintiff’s house, before it was delivered to her.”

As to the scope for drawing inferences about publication, the principles are stated as follows in §34-007 (footnotes, omitted or expanded):

“It is not necessary in all cases to prove that the libellous matter was actually seen and read by some identified third party. If it is a matter of reasonable inference that this happened, a prima facie case of publication will be established. Thus, proof that a libellous letter was sent through the post is prima facie evidence of publication to the person to whom it was addressed… There is no presumption that a letter in an unsealed envelope will be read by anyone other than the addressee: Huth -v- Huth. It is always open to a claimant to seek to prove that in the particular case it was a natural and probable consequence of sending the letter, sealed or unsealed, that it would be opened and read by a third party: see Theaker -v- Richardson. Or that the defendant knew that a letter addressed to the claimant was likely to be opened by his clerk or secretary, and that is what happened: Gomersall -v- Davies (1898) 14 TLR 430.”

Closely linked to the question of what amounts to ‘misuse’ under the tort is the issue of whether English law permits recovery under the tort simply for ‘loss of control’. In Lloyd -v- Google, although strictly obiter (as no claim for misuse of private information had been pursued), the Supreme Court considered the decisions in Gulati -v- MGN Ltd (both at first instance ([2016] FSR 12) and on appeal to the Court of Appeal ([2017] QB 149) and noted:

Data protection

There are two issues of dispute between the parties in relation to the data protection claim. First, what amounts to damage sufficient to sustain the cause of action; and second, whether the law in England & Wales imposes a threshold of seriousness for that damage in data protection claims. The parties have also provided submissions, after the hearing, on the ECJ decision in UI -v- Österreichische Post AG [2023] 1 WLR 3702.

‘Damage’ in data protection cases

In Lloyd -v- Google LLC [2022] AC 1217, the Supreme Court held that, under s.13 Data Protection Act 1998, ‘damage’ was limited to material damage (i.e. financial loss or psychological injury) and distress. The Supreme Court rejected the claimant’s ‘loss of control’ argument; that an individual was entitled to recover compensation under s.13 without proof of material damage or distress whenever a data controller had failed to comply with any requirements of the Act: [112]-[113].

The Claimants do not dispute this principle. In their written submissions, the Claimants submitted that they “are not seeking damages for ‘loss of control’ without proof that it caused distress”. The Claimants maintain that each has suffered non-material damage in any event. That arises from (a) the inferential case that the misaddressed envelopes have been opened by third parties and the contents of the ABS read by them; and (in any event) (b) distress (or equivalent emotions) caused by not knowing what has happened to the misaddressed ABSs.

Threshold of seriousness

A threshold of seriousness applies to claims for misuse of private information (see [89] above). Does such a threshold apply to data protection claims? The point was briefly considered by the Court of Appeal in Vidal-Hall -v- Google Inc [2016] QB 1003. The appeal principally concerned the proper interpretation of s.13(2) Data Protection Act 1998, and whether a claimant could maintain a claim for damages without proof of pecuniary loss. The Court of Appeal held that, having regard to the objective of the EU Parliament and Council Directive 95/46/EC, “damage” in Article 23 of the Directive included both material and non-material damage. In consequence, s.13(2) of the 1998 Act, by restricting claims for damages for distress to instances where the claimant could demonstrate pecuniary or material loss, had not properly given effect to the Directive in English law. The Court of Appeal explained:

Mr Sharland KC has also submitted that, in Lloyd -v- Google, Lord Leggatt appeared to accept that there was a threshold of seriousness in data protection cases, when he observed ([153]):

“On the claimant’s own case there is a threshold of seriousness which must be crossed before a breach of the DPA 1998 will give rise to an entitlement to compensation under section 13. I cannot see that the facts which the claimant aims to prove in each individual case are sufficient to surmount this threshold. If (contrary to the conclusion I have reached) those facts disclose ‘damage’ within the meaning of section 13 at all, I think it impossible to characterise such damage as more than trivial. What gives the appearance of substance to the claim is the allegation that Google secretly tracked the internet activity of millions of Apple iPhone users for several months and used the data obtained for commercial purposes. But on analysis the claimant is seeking to recover damages without attempting to prove that this allegation is true in the case of any individual for whom damages are claimed. Without proof of some unlawful processing of an individual’s personal data beyond the bare minimum required to bring them within the definition of the represented class, a claim on behalf of that individual has no prospect of meeting the threshold for an award of damages.”

The ECJ decision in UI -v- Österreichische Post AG

Since the original hearing, the Court of Justice of the European Union gave its judgment in the case of UI -v- Österreichische Post AG, which bore on the issues of (1) the proper interpretation of “damage” under the General Data Protection Regulation (“GDPR”); and (2) whether a threshold of seriousness was appropriate in the assessment of non-material damage.

On these issues, the ECJ held:

At the hearing, the parties had made submissions to the Court based on the Advocate General’s Opinion in the case. The Defendant relied upon this in support of its submission that damages are not available for loss of control/autonomy. The Claimants contended that it supported their submission that there was no threshold of seriousness in data protection claims. Both sides have provided further written submissions as to the impact of the ECJ decision, which they are agreed is not binding on the Court but is a decision to which the Court may “have regard”: s.6(2) European Union (Withdrawal) Act 2018

The Claimants submitted that the ECJ rejected the concept of a threshold of seriousness and, in doing so, has not accepted the Advocate General’s view that compensation should not be payable where the impact of a breach of data protection amounted to no more than “annoyance or upset” or a “mere feeling of displeasure due to another person’s failure to comply with the law”.

The Defendant submitted that the Court should not follow the ECJ’s decision on the point as to a threshold of seriousness. Mr Sharland KC argued that the ECJ’s key motivation for the decision was to avoid a lack of ‘coherence’ between the member states if each were to apply its own threshold of seriousness. He argues that no such consideration would apply when considering simply the law in England & Wales and that, in this jurisdiction (in the cases cited in [104]-[105] above), a threshold of seriousness has been recognised to apply to data protection claims.

Jameel abuse of process

There is no significant difference between the parties as to the principles governing Jameel abuse of process applications, which were summarised in Higinbotham -v- Teekhungam [2018] EWHC 1880 (QB) [44]:

The jurisdiction to dismiss cases as Jameel abusive is one that should be reserved for “exceptional cases” where the Court is satisfied that it is impossible to fashion a procedure whereby the claim can be resolved in a proportionate way: Tewari -v- Khetarpal [2022] EWHC 2066 (QB) [77].

In Alsaifi -v- Trinity Mirror plc [2018] EWHC 1954 (QB) [45], I held:

Although Jameel was a defamation case, there is no dispute between the parties that the Jameel jurisdiction is not limited to defamation claims and that it extends to all civil claims, including misuse of private information and data protection: see Higinbotham [45]; Vidal-Hall [134]-[136] (Sullivan was, principally, a breach of copyright claim).

Mr Campbell KC has relied upon the group nature of the claims that are being pursued. In Municipio de Mariana -v- BHP Group (UK) Ltd [2022] 1 WLR 4691, another case that shows that the Jameel jurisdiction is of universal application, the Court of Appeal provided the following guidance in the context of multi-party group litigation:

Anonymity and derogations from open justice

Pursuant to CPR PD16 a Claim Form must include:

A Claim Form is one of the documents that is publicly available (subject to certain conditions) from the records of the Court as of right (i.e. without requiring permission of the Court): CPR 5.4C(1).

The default position, under the CPR, is therefore that the name and address of a party to civil litigation is required to be publicly available. These requirements are an important dimension of open justice and transparency. The Court has the power to permit derogation from this default position under CPR PD 16 §2.3 and CPR 39.2(4). As these are derogations from the principles of open justice, the following principles apply (drawn from Practice Guidance (Interim Non-Disclosure Orders) [2012] 1 WLR 1003 (“the Practice Guidance”) [9]-[13] and [16]):

Anonymity orders are usually justified on one of two bases: maintenance of the administration of justice and harm to other legitimate interests. The first category of case is where, without the relevant order being made, the administration of justice would be frustrated. Examples of this type of justification for derogations from open justice would include cases involving trade secrets or other confidential information. In such cases, if no derogations from open justice were granted, the proceedings themselves would destroy that which the claimant was seeking to protect, thereby frustrating the administration of justice: Lupu -v- Rakoff [2020] EMLR 6 [28]-[30]:

“Restrictions on open justice to protect the legitimate interests of others raise more difficult issues. The starting point is the recognition that open justice (and probably of greater practical significance, the privilege that attaches to media reports of proceedings in open court) will frequently lead to some interference with the legitimate interests of parties and witnesses. Media reports of proceedings in open court can have an adverse impact on the rights and interests of others, but, ordinarily, ’the collateral impact that this process has on those affected is part of the price to be paid for open justice and the freedom of the press to report fairly and accurately on judicial proceedings held in public’: Khuja -v- Times Newspapers Ltd [2019] AC 161 [34(2)] per Lord Sumption.”

Consistent with the requirement to establish the necessity for any derogation from open justice with convincing evidence, the Court will scrutinise with care any application that the Court should withhold the name of a party or other details about the claim (including the party’s address) from the public. Mere assertion that a party may suffer some harm is unlikely to discharge the burden to justify the order.

In Various Claimants -v- Independent Parliamentary Standards Authority [2022] EMLR 4, the Claimants sought an order relieving them from the requirements to provide their names and addresses on the Claim Form. In support of their application, they relied upon hostility in some sectors of the community towards Members of Parliament and their staff. The application was refused because the evidence put forward by the Claimants failed to demonstrate a credible risk that, if the Claimants were named (and their addresses provided), they would be exposed to some risk of harm. I noted [52]:

“There might exist a very small number of people whose attitude towards MPs (and those who work for them) is so hostile that they might conceivably be moved to offer some threat of physical violence to them, but this risk is remote. The Claimants have not put forward any credible and specific evidence that one or more Claimants is at particular risk of any such threat. The civil justice system and the principles of open justice cannot be calibrated upon the risk of irrational actions of a handful of people engaging in what would be likely to amount to criminal behaviour. If it did, most litigation in this country would have to be conducted behind closed doors and under a cloak of almost total anonymity. As a democracy, we put our faith and confidence in our belief that people will abide by the law. We deal with those who do not, not by cowering in the shadows, but by taking action against them as and when required.”

This principle was recently endorsed by Swift J in R (IAB) -v- Secretary of State for the Home Department [2023] EWHC 2930 (Admin) [28]-[29] (affirmed on appeal: [2024] EWCA Civ 66).

Warby LJ provided a distillation of the principles concerning anonymity orders and other derogations from open justice in R (Marandi) -v- Westminster Magistrates’ Court [2023] 2 Cr App R 15 [43]:

“(1)

The starting point is the common law principle of open justice, authoritatively expounded in Scott -v- Scott and subsequent authorities at the highest level. The judge was right to begin here. The summary of the common law principles which he adopted from the argument of Mr Bentham is not materially different from the summary in the Judicial College Guide, approved in R (Rai) -v- Winchester Crown Court [2021] EMLR 21. 

(2)

The general principles that (a) justice is administered in public and (b) everything said in court is reportable both encompass the mention of names. As a rule, ‘[t]he public has a right to know, not only what is going on in our courts, but also who the principal actors are’: R (C) -v- Secretary of State for Justice [2016] 1 WLR 444 [36] (Baroness Hale). In this case, it is clear that but for the claimant’s late request for a derogation from these principles the NCA would have named him in open court. Its decision to do otherwise was a purely executive act which has no bearing on the propriety of the judge’s decisions to grant and then lift anonymity. Those were decisions about what the law required. It would have been irrelevant if the NCA had consented to an anonymity order, as parties cannot waive or give up the rights of the public: see the Practice Guidance [16]. 

(3)

When considering the application for derogation in this case the judge was right to identify and apply a test of necessity. Under the common law as it existed prior to the entry into force of the Human Rights Act 1998, anonymity could only be justified where this was strictly necessary ‘in the interests of justice’: see Khuja [14]. This was and remains an exception of narrow scope: see the tests cited in Clifford -v-Millicom [2023] ICR 663 [31]-[32]. It has never been suggested that this case meets that standard. The claimant’s case rests on the common law privacy right derived from Article 8, to which the Supreme Court referred in Khuja. But in that context too the applicant for anonymity has to show that this is necessary in pursuit of the legitimate aim on which he relies. 

(4)

The threshold question is whether the measure in question – here, allowing the disclosure of the claimant’s name and consequent publicity – would amount to an interference with the claimant’s right to respect for his private and family life. This requires proof that the effects would attain a ‘certain level of seriousness’: ZXC -v- Bloomberg LP [2022] AC 1158 [55], Javadov -v- Westminster Magistrates’ Court [2022] 1 WLR 1952 [39]…

(5)

The next stage is the balancing exercise. Both the judge’s decisions expressly turned on whether it was ‘necessary and proportionate’ to grant anonymity. That language clearly reflects a Convention analysis and the balancing process which the judge was required to undertake. The question implicit in the judge’s reasoning process is whether the consequences of disclosure would be so serious an interference with the claimant’s rights that it was necessary and proportionate to interfere with the ordinary rule of open justice. It is clear enough, in my view, that he was engaging in a process of evaluating the claimant’s case against the weighty imperatives of open justice. 

(6)

It is in that context that the judge rightly addressed the question of whether the claimant had adduced ‘clear and cogent evidence’. He was considering whether it had been shown that the balance fell in favour of anonymity. The cases all show that this question is not to be answered on the basis of ‘rival generalities’ but instead by a close examination of the weight to be given to the specific rights that are at stake on the facts of the case. That is why ‘clear and cogent evidence’ is needed. This requirement reflects both the older common law authorities and the more modern cases. In Scott -v- Scott at p.438 Viscount Haldane held that the court had no power to depart from open justice ‘unless it be strictly necessary’; the applicant ‘must make out his case strictly, and bring it up to the standard which the underlying principle requires’. Rai is authority that the same is true of a case that relies on Article 8. The Practice Guidance is to the same effect and cites many modern authorities in support of that proposition. These include JIH -v- News Group Newspapers Ltd [2011] 1 WLR 1645 where, in an often-cited passage, Lord Neuberger of Abbotsbury said at [22]: 

‘Where, as here, the basis for any claimed restriction ultimately rests on a judicial assessment, it is therefore essential that (a) the judge is first satisfied that the facts and circumstances of the case are sufficiently strong to justify encroaching on the open justice rule …’ …”

Turning to the Claimants’ recent application for a 5.4C Order, the MPoC, as a statement of case, is publicly available under CPR 5.4C(1). The status of the Individual Schedules, and whether they fall within the definition of a “statement of case” for the purposes of CPR 5.4C(1) is less clear. On the one hand, it might be contended that the Individual Schedules do not fall within CPR 5.4C(1) because they are “documents filed with or attached to the statement of case, or intended by the party whose statement it is to be served with it”. On the other hand, the Individual Schedules were ordered to be provided following the Defendant’s Application for Part 18 Further Information. Part 18 Further Information does fall within the definition of a statement of case (whether provided voluntarily or pursuant to a Court order): CPR 2.3(1).

If the Individual Schedules do not fall within the definition of “statement of case”, then a third party wanting to obtain a copy of an Individual Schedule would have to make an application under CPR 5.4C(2). The power to restrict third-party access to documents from the Court’s records, under CPR 5.4C(4), is limited to the categories of document available as of right under CPR 5.4C(1): ABC Ltd -v- Y Ltd [2012] 1 WLR 532 [9]. An order prospectively prohibiting third-party access to other documents on the Court file without the permission of the Court is otiose. Third parties can only obtain such documents with the permission of the Court under CPR 5.4C(2). When considering an application under that rule, the Court has power to impose conditions on such access, including directions that part(s) of the documents should be redacted before copies are provided to third parties: see Re Mobile Voicemail Interception Litigation [2012] 1 WLR 2545.

The Defendant submitted that the Individual Schedules are statements of case, relying upon CPR 2.3(1). Although I have not received detailed submissions on this point, tentatively, I would conclude that the Individual Schedules do fall within the definition of “statements of case” within CPR 5.4C(1) because they were filed by the Claimants, pursuant to a Court order, to provide further information about their claims (see [39] above). It would follow, therefore, that, subject to the Court making an order, under CPR 5.4C(4), restricting such access, a third party is therefore entitled to obtain a copy of any Individual Schedule from the records of the Court.

Submissions

Claimants

In relation to the 9 Claimants who maintain their application to be anonymised in the claim, Mr Aslett submitted that the evidence that has now been provided by the Claimants convincingly establishes why a derogation from open justice should be granted in their cases. The common theme in the evidence is that each of these Claimants is a police officer whose identity is closely protected in his/her operational role.

As to the further application to withhold their addresses, the Claimants submit that the evidence that has now been filed demonstrates that police officers are advised to keep their home addresses confidential. The individual statements that have been provided by the Claimants expand on particular concerns that the individual Claimants have about their addresses being available from the Court’s records. They also explain why the Claimants seek a 5.4C Order.

Defendant

The Defendant has taken largely a neutral stance on the Anonymity Application. Mr Sharland KC has, however, pointed to several features of the Anonymity Application which, he submits, are unsatisfactory.

Decision

I am satisfied that the 9 Claimants who maintain the Anonymity Application should retain the anonymity previously granted by the Master. The evidence that has now been provided to the Court is clear and cogent and convincingly establishes that the nature of their work as police officers requires them to be anonymised in these proceedings.

Turning to the application to permit the Claimants to continue to withhold their addresses from the Claim Form (and other documents required to be open to public inspection on the Court file), the further evidence that the Claimants have now filed does now satisfy me that the order should continue. I do not find the evidence of the individual Claimants, as to their particular reasons for wishing to withhold their addresses, on its own, to be sufficient to justify the continuation of the withholding order. If that had been the only evidence, the Claimants would have stood in a position that was similar to the Claimants in the IPSA case. The evidence that has satisfied me that the withholding order should continue is the evidence that shows that, as a matter of policy, the Claimants have been very strongly advised by their police force to protect the confidentiality of their home addresses. That is not to say that a police officer who brought, for example, a personal injury claim following a road traffic collision, would be entitled to withhold his/her address from the Claim Form. If his/her occupation was not relevant to the issues in the case, it is difficult to see why a withholding order for the claimant’s address would be necessary. Here, however, the nature of the claim, and the issues it raises, means that it will be immediately apparent that each of the Claimants is a police officer. As such, requiring each Claimant to provide his/her address would undermine the clear policy of the Sussex Police that officers should protect their addresses. I am therefore satisfied that the limited interference with the open justice principle, by permitting the Claimants to withhold their home addresses, is necessary and proportionate and has now been established by clear evidence.

However, it must be recorded that the original Anonymity Application, in seeking anonymity for (and to withhold the addresses of) the whole cohort of 474 Claimants was unjustifiably wide. The fact that a claim is being brought on behalf of a very large number of Claimants does not lessen the obligation to provide proper evidence in support of each individual Claimant’s application. Unless there are very unusual circumstances in a particular case, there are no categories of litigant who are entitled to anonymity or other derogations from open justice. Each Claimant who wishes to seek such a derogation must demonstrate, by evidence of the required cogency, that such an order is necessary, and its terms proportionate. The fact that, in this case, as soon as the Court challenged whether the Anonymity Order could be justified for the entire cohort of Claimants, all but 9 of the Claimants withdrew their applications stands as an alarming confirmation of the lack of justification for an order which represented a very significant derogation from open justice. The continuation of the Anonymity Order for 9 Claimants, and the withholding order for the addresses of the Claimants has only been justified by the further evidence that the Claimants have filed.

There is force in the Defendant’s criticisms of the original application for the Anonymity Order. There was, in my judgment, a serious lack of rigour in the Claimants’ approach.

I am not presently prepared to grant the 5.4C Order sought by the Claimants. Despite Mr Hayes’ protestations to the contrary (see [80] above), the Claimants have, again, adopted a blanket approach that is simply inappropriate when dealing with derogations from open justice. Much of the information contained in the Individual Schedules is anodyne and, in respect of which, there can be no justification from departing from the open justice principle that a non-party is entitled to obtain an unredacted copy of the Individual Schedules.

The justification largely advanced by the Claimants for making the 5.4C Order is that, for some of the Claimants, public access to the Individual Schedule will reveal his/her operational role in the police. Even if that concern did justify the imposition of some restriction on third party access to the Individual Schedules (and I remain to be convinced by evidence that it does), it could only justify withholding the relevant part of the Individual Schedule (by permitting third parties to obtain only a redacted version of the relevant Individual Schedule). It could not justify withholding the entire document. Such an order would represent an unnecessary and/or disproportionate interference with open justice. Mr Hayes’ suggestion that a third party could apply to be granted access to any Individual Schedule is to reverse the important open justice presumption of CPR 5.4C(1). It is for a party to demonstrate that a restriction on access to documents that fall within 5.4C(1) is necessary and proportionate, not for a third party to demonstrate that s/he should be provided with the document(s).

The Claimants have simply failed to perform a focused exercise to identify the particular information, in any Individual Schedule, they contend should be withheld from public access. Instead, they have sought an order that all Individual Schedules should be withheld from public inspection under 5.4C(1). Such an order cannot be justified. Its terms would be disproportionate because it would restrict public access to information contained in the Individual Schedules in a way that the Claimants cannot (and do not seek to) justify as necessary. As such, the application is refused.

I am not prepared to spend time going through over 400 Individual Schedules, and related witness statements, to attempt to identify what restrictions any particular Claimant might be able to justify, applying the principles I have identified. It is for a Claimant seeking a derogation from open justice to demonstrate that such a restriction is necessary. There is also an element of potential confusion in the witness statements. For those Claimants who have abandoned their Anonymity Application, they have accepted that they will be identified as police officers in this claim. That is inevitable, given the parameters of the litigation. If any individual Claimant wishes now to seek a narrow and focused redaction of particular information that s/he contends should be withheld from his/her Individual Schedules available to third parties from the Court’s records, then s/he can make a further application and the Court will determine each application on its merits.

Submissions

Defendant

The Defendant’s primary submission is that, without evidence that the ABSs have been opened and read by a third party, the claims for both misuse of private information and breach of data protection have no real prospect of success. Mr Sharland KC contends that publication is an essential element of each cause of action. The purely inferential case that a letter addressed to one of the Claimants which was sent to a former address would have been opened and read by a third party has no real prospect of success.

Separately, in his submissions on behalf of the Defendant, Mr Sharland KC has made a sustained attack on the trivial nature of the claims that have been brought and the wholly disproportionate way in which the litigation has been conducted. The Defendant argues that it is wholly unreal to suggest that the mis-addressing of the ABSs could have caused police officers any real distress or upset (or caused or exacerbated psychiatric harm). He points to the levels of incurred and estimated costs for the Claimants to argue that no sensible litigant would conduct litigation on this basis, given the very modest levels of compensation that most Claimants are seeking or expect to receive. Mr Sharland KC argues that this is a case where the Court should dismiss the claims under the Jameel jurisdiction.

Claimants

Although not resiling from his inferential case as to publication of the ABSs, Mr Campbell KC submitted that “the fundamental act of putting private information in danger is sufficient [use] to fall under the concept of misuse”. In other words, that, whether or not the mis-addressed ABS was actually opened and read by a third party, the mere act of wrongly addressing the ABS is an actionable “misuse” of private information. Mr Campbell KC was clear in his submissions: “the positive misuse by the Defendant here [is] in sending to the wrong address: that is the misuse”. The tort of misuse of private information is, on the Claimant’s submissions complete at this point. What happens subsequently to the ABS – whether it is returned unopened, never resurfaces or is returned opened – is a matter that goes only to the quantum of damages.

The Claimants’ fallback position is that if they are required to demonstrate that the ABS was opened and read by a third party – or “published” to borrow from the lexicon of defamation – then the Claimants rely upon the inferential case that the ABSs would have been opened. In this respect, Mr Campbell KC relied upon the – admittedly few – examples where the Claimants can show that the envelopes were opened.

When considering the Dismissal Application, Mr Campbell KC emphasises that this is a developing area of the law and he relies on the authorities that suggest that, in such cases, it is better for the Court to allow the matter to proceed to trial so that the law can be applied to facts as found on the evidence rather than on assumed facts.

On the issue of Jameel abuse, Mr Campbell KC submitted that the Court can fashion a way of resolving these claims in a proportionate manner. He submits that test cases should be selected, a proposal he said had been made by the Claimants’ solicitors from the outset. Selection of test cases would resolve some of the core issues that are common to all the claims, e.g. the various defences that have been raised by the Defendant to the alleged breaches of data protection. He makes the powerful submission that the Defendant is contesting liability. If not conceded, that issue will need to be resolved by the Court. That, he argues, will be best achieved (at proportionate cost) by selecting a sample of test cases in which the point can be isolated and determined for the benefit of the whole cohort. He referred me to the decision in Lancaster -v- Peacock [2020] EWHC 1231 (Ch), in which Fancourt J directed that 12 sample cases be identified from a group of 156 claimants. More generally, Mr Campbell KC acknowledged the Court’s concerns as to the scale of the costs that had been incurred already, but contended that the better course was not to dismiss the claims as Jameel abusive, but to disallow some of the incurred costs.

Decision

In my judgment, to have a viable claim for misuse of private information and/or data protection, each Claimant must show that s/he has a real prospect of demonstrating that the ABS was opened and read by a third party. Without that, the relevant Claimant would have no real prospect of demonstrating that there had been “misuse”, an essential element of the tort of misuse of private information. The authorities I have identified (see [91]-[95]) establish such a principle. In TLT the publication by the Defendant was negligent and unintended, but there was nevertheless publication.

For the purposes of clearly isolating the principle, it is helpful to consider the cases of the cohort of Claimants who ultimately did receive their ABS unopened. For those Claimants, an inferential case that the ABS was opened (and read) by a third party cannot be sustained. On the contrary, there is positive evidence that the ABS had not been opened (or read) by anyone else. Can these Claimants nevertheless bring a claim for misuse of private information and/or data protection in respect of the period before the ABS was returned? In my judgment, the answer is no.

I reject the submission that these Claimants can advance a claim on the basis that, until returned, their personal information/data was “in danger” or “at risk”. The general law of tort does not generally allow recovery for the apprehension that a tort might have been committed; a person crossing a road cannot recover damages (whether for distress or otherwise) for almost being struck by a passing lorry or for a defamatory letter that was never actually received by its intended recipient. To be entitled to any remedy, a claimant must demonstrate that s/he is the victim of a tortious wrong. A near miss, even if it causes significant distress, is not sufficient. Without the contents of the ABS coming to the attention of a third party there is no viable claim for misuse of private information. In simple terms, there has been no interference with the Article 8 rights of the relevant Claimant because the privacy of the information contained in the ABS has not been compromised at any stage.

The same is true for a civil claim for data protection. Data breach cases are premised on the personal data of the relevant claimant having been compromised; usually accessed by, or provided to, a third party. Shorn of the claim for “loss of control”, the Claimants’ claim is essentially one for Unlawful Processing by sending the ABS to the wrong address. But, if the ABS has not been opened or read by a third party, there has been no real “processing”. It was a near miss. I accept that there are wider policy considerations underpinning the data protection regime. Concepts of placing the data “at risk” have greater resonance in the regulatory context. A person who leaves a laptop on a train, from which unencrypted personal data could readily be accessed, may face regulatory action even if the laptop is recovered without any data having been compromised.

In consequence, the claims in which the ABS was returned unopened fail to disclose reasonable grounds for bringing a claim for misuse of private information and/or data protection and will be struck out under CPR 3.4(2)(a). In the alternative, I would have found that these claims should be summarily dismissed under CPR Part 24 as having no real prospect of success.

Next, I will consider the cases in which the ABS has not been safely returned and where the relevant Claimant relies upon an inferential case that the ABS has been opened and read by a third party (see [33]-[34] above). In my judgment, in these claims, the relevant Claimant has no real prospect of success. As pleaded, I would also hold that the bare inferential case on publication falls to be struck out pursuant to CPR 3.4(2)(a). Unless the relevant Claimant can plead a viable case, with a real prospect of success, that his/her ABS was actually opened and read by a third party, the claim will be struck out and/or dismissed under CPR Part 24.

The drawing of inferences is an evidential process. It is a process whereby a Court concludes that the evidence adduced enables a further inference of fact to be drawn. It is to be contrasted with speculative guesswork or wishful thinking: see Amersi -v- Leslie [2023] EWHC 1368 (KB) [158]; Blake -v- Fox [2024] EWHC 146 (KB) [53].

The authorities relied upon by Mr Sharland KC (see [98]-[99] above) demonstrate that there may be cases where the Court will draw the inference of publication of a letter beyond the named recipient. But the factual premise for drawing such an inference is, in those cases, solidly based. Absent some facts that would compel a different conclusion, the Court will not draw the inference that a letter addressed to a named recipient, clearly marked “private and confidential”, will be opened by a third party who is not the named recipient or authorised by him/her to open correspondence addressed to named recipient.

In the Claimants’ MPoC, the case that the ABSs were opened (and read) by third parties is pleaded as a bare inference. No further particulars are provided. It is impossible, therefore, to identify the facts that are being relied upon to support the invited inference. Such a pleading fails to disclose a proper basis for the inferential case and falls to be struck out under CPR 3.4(2)(a). But beyond that, and looking at the evidential position, the Claimants’ position does not improve.

The fact that, in a handful of cases, there is some evidence that the relevant ABS was opened does not supply a reliable evidential foundation for the drawing of an inference that ABSs were generally opened by third parties. On the contrary, the very few instances when this happened is evidence that (if anything) supports an inference that private correspondence is not generally opened by someone who is not the addressee. Effectively, the Claimants have tried to reverse the burden of proof and require the Defendant to demonstrate that the ABS was not opened (and read) by a third party in each claim. As a matter of principle, that is impermissible, but the evidence paints an entirely different picture. Of the 14 cases where there is direct evidence that the ABS was opened, 11 were opened by a relative of the addressee (opened perhaps believing that it was acceptable for him/her to open the envelope or in error) (see further [61] above). In only 2 cases, in a cohort of some 450 individuals, is there evidence that the ABS was opened by someone other than a family member or colleague. That evidence speaks for itself. It effectively destroys any inferential case that the ABSs were generally opened and read by third parties.

If, as I have found, each Claimant must demonstrate that his/her ABS was opened and read by a third party, then any claim which relies solely upon this inferential case has no real prospect of success. Ordinarily, the consequence of this finding would be that the relevant claim would be dismissed under CPR Part 24. The Claimants have not suggested that further evidence is likely to be available at trial on this issue. I will hear submissions when this judgment is handed down as to the consequential orders to be made. A Claimant who believes that s/he might be able to provide actual evidence that the ABS was actually opened and read by a third party may, even at this late stage, be able to persuade the Court to give him/her one last chance. Against that, the Defendant may very well say that the Claimants have known that an attack was being made on the viability of claims that relied solely on an inferential case as to publication and that they have had ample opportunity to advance a reformulated claim but did not do so.

The effect of the decisions I have made would be to leave 14 claims in which the relevant Claimant has a real prospect of demonstrating that his/her ABS was opened and read by a third party.

From the information that has been put forward in the Individual Schedules, the 14 claims where the ABSs were opened would appear to be very far from being serious cases (see [61] above). If the claims go further, the Claimants may face further attacks on the viability of the relevant claim depending upon the evidence that is ultimately adduced at trial. Some may ultimately be found to be trivial and fall to be dismissed on the basis that they fail to surmount the threshold of seriousness.

In particular, the 14 Claimants may yet have to surmount the evidential hurdle that the ABS was read by the person who opened the envelope (or someone else). In all but one of the cases it is not clearly stated, in terms, whether the ABS was read, and if so, how much of it was read. In the case of the 258^th Claimant (see [61(9)] above), she was told that her family had not looked at the contents. In half of the cases, the relevant Claimant’s case is that the ABS was (or may have been) opened (or received) in error (see cases of the 75^th, 111^th, 307^th, 342^nd, 359^th, 386^th and 472^nd Claimants [61] above). Unless the Defendant concedes that the ABS was read by a third party in each of these cases, then the Claimants will bear the burden of demonstrating, at trial, that it was. Given the evidence as to the layout of the first page of the ABS, the Claimants may also need to demonstrate that more than the first page of the letter was read.

Some aspects of individual Claimants’ claims for loss and damage can be seen, even now, to be hopeless. For example, the 359^th Claimant’s ABS was opened by his father in error (he shares the same first initial of the Claimant) (see [61(12)] above). It was then forwarded to him. On this Claimant’s case, the extent of the “misuse” of his private information and/or processing of his personal data (even assuming that his father read the whole ABS) arose from publication to one person; the Claimant’s father. Set against those basic facts, the expressed fears of the 359^th Claimant (in support of his claim for distress damages) that the information within the ABS might be used to identify and target him, his family or his current home appear to be completely unreal. Unless it is to be suggested that the Claimant’s father took a copy of the ABS (or the information it contained) before returning it, the Claimant’s concern that the information in the ABS could be “misused at any time” would appear to be equally baseless. A Claimant’s prospects of success are not going to be improved by making exaggerated claims as to the impact of the ABS being opened (and read) by a third party.

Nevertheless, the appropriate time for an assessment of the evidence in relation to each of the Claimant’s claims is at a trial. In part because of the way these claims have been pursued, the Court has not been able to drill down into the details of these 14 claims. I cannot be satisfied, at this stage, that none of these Claimants has a real prospect of surmounting the threshold of seriousness in his/her claim. The ABS did contain some information that went beyond the banal and anodyne. If, for example, details of the individual Claimant’s expected annual pension were published to (i.e. read by) a third party, the relevant Claimant does have a real prospect of demonstrating the constituent elements of a misuse of private information claim (and so to a data protection claim). The fact that any award of damages might be very modest, if a claim were to succeed, does not affect the viability of the claim. In respect of that claim, each Claimant has provided details of the distress (or equivalent) that s/he claims to have suffered. On first impression, it might seem unlikely that the opening of the ABS could have caused much distress to a police officer, but each Claimant is advancing a claim, verified with a statement of truth, that s/he has been caused distress (or equivalent). A Court could only reject evidence in support of such a claim after all the relevant evidence has been tested at trial. In short, the claim cannot be struck out or dismissed under Part 24.

In light of my conclusions, it is not necessary (nor is it desirable) for me to reach a concluded view on the very interesting points as to whether the law in this jurisdiction imposes a threshold of seriousness in data protection claims. Given its potential importance, and the way the point arose (and had to be argued) in this case, I think it is better for me not to express any view. It is sufficient, for the claims of the remaining Claimants, that I have decided that whether each Claimant could surmount a threshold of seriousness (were one found to apply in data protection claims) is a factual question that, like the similar question that applies in misuse of private information claims, can only fairly be resolved at a trial. Given the potential importance of the point, this is a case where the Court should resolve the point of law on threshold of seriousness on the basis of facts found after a trial rather than facts assumed for the purposes of a summary judgment or striking out application (see [87(10)] above).

Therefore, and finally, I turn to the Defendant’s submission that I should nevertheless dismiss these 14 claims, under the Jameel jurisdiction on the grounds that their continued litigation is an abuse of process. The starting point for this analysis must be that each Claimant has a viable cause of action with a real prospect of success. In the final analysis, it may well be that, if successful, the claims of the remaining 14 Claimants will only achieve very modest damages, but for the reasons explained in Alsaifi ([113] above) that is only one factor that the Court considers when deciding whether continued litigation of the claims would be Jameel abusive.

The decisions I have made earlier in this judgment mean that (subject only to a last-ditch effort to amend – see [153] above) only 14 claims (from a remaining cohort of over 450) will be going forward. The scope and complexion of this remaining litigation has therefore changed radically (and most of Mr Sharland KC’s objections based on the vast sums in costs that have been expended substantially fall away). The Court is no longer dealing with an unwieldly number of Claimants litigating a pseudo-class action in a way that is alleged to be wholly disproportionate to the likely sums that would be achieved in compensation were the claims to succeed. There are now 14 claims. The question for me is whether, for these claims, the Court can fashion a procedure by which the claim can be adjudicated in a proportionate way. I have no difficulty in answering that the Court can meet this challenge.

Given what has happened to the bulk of the cohort of claims, the figures for costs (both incurred and budgeted) that have been produced to the Court have now substantially been overtaken by events and have limited continuing relevance to the issue that now presents for decision. Put simply, I do not have reliable costs information as to how much it will now cost to progress the remaining 14 cases to resolution at a trial. I suspect that there is also likely to be a degree of taking stock to be done on both sides and there may well be a narrowing of issues. At this stage, I lack the basic material upon which to make the assessment of the value of what the remaining Claimants hope to achieve by way of compensation and the likely costs of doing so.

Had liability been admitted by the Defendant in this case, leaving only an assessment of damages, the most appropriate directions would appear to be to transfer the remaining 14 cases to the County Court to be allocated to the small claims track (as happened in Cleary -v- Marston (Holdings) Ltd [2021] EWHC 3809 (QB)). The cost/benefit analysis would change significantly if the remaining claims were transferred to the County Court small claims track.

Nevertheless, one of Mr Campbell KC’s strongest points remains that, for as long as the Defendant continues to dispute liability on the grounds that it was a data processor, rather than a data controller, there is a common issue between the 14 claims that must be resolved. The most convenient way to resolve that issue may well be for it to be determined, as a preliminary issue, in the High Court. Once that has been resolved, the way would be clear (if liability has not been determined against the Claimants or the claims do not otherwise resolve by agreement) to transfer to the County Court for an assessment of damages.

For all these reasons, I am very far from satisfied that the Court has reached the point whereby it is impossible to fashion a procedure for resolving the remaining 14 claims at proportionate cost. I decline therefore to strike out the remaining 14 claims as an abuse of process.

For the reasons given in this judgment:

At the hearing when this judgment is handed down, I shall hear arguments on the consequential orders, including directions for the 14 remaining claims. The parties are invited to identify what they can agree, and what matters the Court will need to resolve. There are likely to be substantial issues as to costs, including the costs of the various applications and the costs of the Second Claim. The parties will need to identify clearly all the issues that need to be resolved (either by agreement or decision of the Court).