Michael Farley (formerly CR) & Ors v Paymaster (1836) Limited

This judgment is divided into the following sections:

In this action, the Claimants, over 400 current or former police officers of Sussex Police, bring claims for breach of the General Data Protection Regulation (“GDPR”) and/or Data Protection Act 2018 (“the DPA”) and/or misuse of private information. In August 2018, the pension function of Sussex Police was transferred to the Defendant who, from that date, has been the administrator of the pension scheme to which the Claimants belonged.

In late August 2019, the Defendant sent to each member of the scheme an annual pension benefit statement (“the ABS”). The ABS provided an overview of the relevant member’s accrued benefits under the pension scheme. The information contained in each ABS necessarily varied, officer by officer, but broadly it contained his/her name, date of birth, national insurance number, and details of the officer’s salary and pension details (the particular information the Claimants contend was included in the ABS is set out in [26] below). It would have been apparent to any third party reading the ABS, from the information it contained, that the intended recipient of the ABS was a police officer.

It is common ground that, unfortunately, the ABSs were sent to out-of-date addresses (i.e. an address that had previously been provided by the relevant officer as his/her address for correspondence, but which had become out of date). This error appears to have happened because of the way in which the relevant Claimant’s address details were stored and processed in the database used by the Defendant. A complaint made by the Claimants is that this was not the first time that ABSs had been sent to the wrong addresses. They say that there was another incident earlier in 2019.

The sending of the ABSs to out-of-date addresses was detected by the Defendant and notifications were sent to those affected in early October 2019. Each affected officer was offered the opportunity to sign up to CIFAS, a fraud protection service, the fees of which would be met by the Defendant. The Defendant’s evidence is that 37 people took up the offer to sign up with CIFAS (which represented around 5% of those who were affected by the ABSs being sent to the wrong address).

The potential data breach was also reported to the Information Commissioner (“the ICO”) but, on 17 October 2019, the ICO confirmed to Sussex Police that no further action needed to be taken. The reasons given by the ICO for its decision were as follows:

Nevertheless, in these proceedings, the Claimants contend that the sending of the ABS to an incorrect address was a breach of the relevant data protection legislation by the Defendant and/or misuse of their private information entitling them to compensation. The Claimants have taken no action against Sussex Police.

Following a letter of claim, dated 28 February 2020, the Defendant (in a letter dated 2 April 2020) admitted that there had been a data breach and that the Claimants were “entitled to pursue [the Defendant] for loss, damage and/or distress allowable at law”.

On 23 February 2021, the Claimants’ solicitors sent a letter to the Defendant’s solicitors proposing the issue of a single Claim Form for all the Claimants, a Master Particulars of Claim and the selection of “test cases”, albeit not as a representative action under CPR 19.6. Accompanying that letter was a Schedule identifying the “damages sought” for claims in misuse of private information and breach of data protection. Each claimant claimed damages of £2,000 for misuse of private information, and a range of £1,064.80 and £2,606.20 for the data protection claim. The basis used to calculate these figures (which, in respect of the data protection claim, were oddly precise) has not been explained.

The Claimants’ solicitors’ position is that, individually, each claim is relatively ‘low value’ and that the cohort of claims “need[s] to be pursued in a cost-effective and proportionate way”. At the hearing, Mr Campbell KC estimated that the value of a typical claim (without a claim for personal injury) would be in the region of £1,250 to £1,500 (embracing both causes of action), representing a significant discounting of the figures provided with the letter of 23 February 2021.

The Claimants’ pre-issue costs were around £1.2m. As a purely mathematical calculation, that equates to just over £2,500 per Claimant at the date of issue of the Claim Form. For most Claimants, therefore, even at the point of issuing the Claim (the very first step in the litigation) they had spent more in terms of costs than they hoped to achieve by way of an award of damages. Mr Campbell KC accepted that any individual Claimant, acting on his/her own, would have been expected to have brought that claim in the County Court and that the claim would almost certainly have been dealt with on the Small Claims Track. Nevertheless, he contends that the only practical way for the cohort of Claimants to obtain redress – and effective access to justice – was to pursue this claim on a class basis.

As a result of directions given by the Court, the parties have provided to the Court broad information about their costs. For the Claimants, in October 2022, they had incurred costs of around £1.8m. At the date of the hearing that figure had risen to just short of £2m. The Claimants’ estimated budget for a trial of lead cases was £2.549m. The Defendant’s estimated budget for a trial of lead cases was £2.7m. The Claimants have also taken out ATE insurance. The claim for misuse of private information means that, if that claim is successful, they can seek to recover the premiums for the ATE insurance from the Defendant. At the hearing, Mr Campbell KC was quite candid that the potential to recover ATE premiums was an advantage to the Claimants in advancing a misuse of private information claim, which would not have been available had the Claimants pursued a claim solely for alleged breach of data protection.

The original Claim Form in QB-2021-001497 was filed on behalf of 474 Claimants on 22 April 2021 (“the First Claim”). 28 claims have been discontinued subsequently. As at the date of the filing of the Amended Claim Form, on 15 March 2023 (see [73] below), there were 446 active Claimants. The Claimants:

On 25 March 2021, prior to the issue of the First Claim Form, the Claimants’ solicitors issued an Application Notice seeking orders that all the Claimants be anonymised and that their addresses should be withheld and, on the Claim Form, replaced with the address of their solicitors (“the Anonymity Application”). The Application Notice provided the following as justification for the orders sought:

A witness statement from Kingsley Hayes, a solicitor in the firm of Keller Lenkner, the Claimants’ solicitors, was provided in support of the Anonymity Application, dated 25 March 2021. Mr Hayes explained the background to the Claim and how, in August 2019, ABSs were sent to out-of-date addresses. As to the justification for the orders for anonymity of the Claimants and the withholding of their addresses, Mr Hayes stated:

On 7 April 2021, having considered the Claimants’ evidence, but without a hearing, the Master made an order granting anonymity to all 474 Claimants and permitting them to issue the First Claim Form withholding their names (to be replaced by ciphers) and giving, as their address, the address of their solicitors (“the Anonymity Order”). Without the permission of the Court, the Anonymity Order prevented non-parties from obtaining a copy of the Claim Form which recorded the Claimants’ names and addresses. A liberty to apply was included to vary or discharge the Anonymity Order.

A complaint made by the Defendant is that when the Claim Form and anonymised Particulars of Claim were served, on 23 April 2021, there was no way to identify the Claimants. It was not until 14 May 2021 that the Claimants provided a schedule that identified the Claimants. It was not until 12 May 2021 that the Claimants’ solicitors provided the Application Notice and witness statement in support of the Anonymity Application.

On 14 December 2022, without a hearing, I made an Order that the Court would reconsider the Anonymity Order at a hearing that had been fixed for 27-28 February 2023. I directed that if the Claimants (or any of them) contended that they should continue to be anonymised, then they must file and serve any further evidence in support by 4.30pm on 20 January 2023. The Defendant was given until 3 February 2023 to serve any evidence in response. The Order explained my reasons as follows:

On behalf of the Claimants, Kingsley Hayes filed a witness statement dated 20 January 2023. He explained that the Claimants solicitors had reconsidered the issue of anonymity with the Claimants. As a result, the vast majority of Claimants were likely to be content to withdraw their application to be anonymised (although they maintained the application to withhold their addresses from Court documents open to public inspection). Mr Hayes explained that time was needed to take instructions from all the Claimants on the issue of anonymity.

As to the Claimants’ addresses, Mr Hayes referred to (and exhibited) guidance from the Association of Chief Police Officers, which recommended that police officers should not post their home addresses on the internet or on social media. He added:

Mr Hayes then provided specific information, in relation to several Claimants, as to their particular concerns as to why their address should not be available through public inspection of the records of the Court relating to the Claims.

On 31 January 2023, the Claimants’ solicitors filed witness statements from the following Claimants who sought to maintain the order for anonymity that they had been granted.

William Richmond-Coggan filed a witness statement, dated 3 February 2023, in relation to the Anonymity Application. He made several complaints about the lack of notice given to the Defendant of the original Anonymity Application and delays in receiving the evidence in support of the application and the schedule identifying the Claimants. Mr Richmond-Coggan drew attention to the fact that, in Kingsley Hayes’ witness statement of 25 March 2021, in support of the Anonymity Application, he stated that, “the Application is brought by the 474 individuals listed… who have provided instructions to [the Claimants’ solicitors] to bring a claim against the Defendant and make this application” (emphasis provided by Mr Richmond-Coggan). This, he contrasted with Mr Hayes’ statement, of 20 January 2023, in which he stated that his firm had only “identified a sample of officers who we directly spoke with” and that he had taken “targeted instructions”. Mr Richmond-Coggan suggested that this reference to instructions only having been taken from a sample of Claimants should be viewed in the context of the costs budgets filed by the Claimants. Those showed that the Claimants had incurred pre-action costs of £1,180,600 with a further £263,749 for preparing and issuing statements of case, and £120,042 for witness statements. These costs exclude VAT and disbursements, including Counsel’s fees.

More generally, Mr Richmond-Coggan stated that the Defendant “continues to have concerns about the quality of the evidence being tendered in support of anonymity, including over it being minimal, generic and not directly from the Claimants themselves”.

Particulars of Claim

With the First Claim Form, the Claimants filed what were called “Master Particulars of Claim” which set out “the common or generic claims made by the Claimants against the Defendant” (“the MPoC”).

The MPoC contended that each Claimant’s ABS contained the following information (“the Private Information”): (1) name; (2) date of birth; (3) national insurance number; (4) start date in service; (5) salary banding; (6) part time hours worked; (7) police service details; (8) value of final salary benefits; (9) average pensionable pay; (10) annual pension payable; (11) projected pension benefits including lump sum and residual annual pension; (12) death in service benefits; (13) Police Pension Scheme member reference number; and (14) Equiniti account number.

The Claimants contend that each of these pieces of Private Information is:

For the purposes of the DPA, the Claimants contend that the Defendant is a data controller rather than data processor.

Although the Claimants pursue other alleged breaches of the data protection legislation, arising from the way in which their addresses were processed by the Defendant, the principal complaint of each Claimant is about the sending of the ABSs to an out-of-date address in August 2019. This is alleged to amount to unlawful processing (“Unlawful Processing”). It is this Unlawful Processing that is alleged to have caused the Claimants non-material harm. Each Claimant alleges that the “mis-addressing” of the ABS and sending it through the postal system to “unknown third parties” constituted “a serious unjustified infringement and intrusion into each Claimant’s right to privacy” and/or a misuse of private information.

The misuse of private information claim is advanced by the Claimants in the following terms:

In terms of loss and/or damage, each Claimant claimed to have suffered damage caused by the alleged “infringements”. This damage was identified as:

The MPoC stated that the Claimants intended to provide “Heads of Damage” for each Claimant. As the Defendant has complained, no application had been made to disapply CPR PD 53B §2.2 which required the Claimants to provide particulars of their claim for damages (see [85] below).

The particulars of damage and distress provided in the MPoC, in respect of the data protection claim, included the following:

No particulars were provided to support the inference, pleaded in sub-paragraph (d), that mis-addressed ABSs would be opened and read by unknown third parties.

Finally, the MPoC contained an apparent claim for personal injury for some of the Claimants who it was alleged had “suffered an aggravation of pre-existing medical conditions” and in respect of whom a further award of general damages was sought.

The MPoC were filed before the decision in Lloyd -v- Google LLC [2022] AC 1217. Mr Campbell KC confirmed, at the hearing, that, following the decision of the Supreme Court, the Claimants were not pursuing a claim for damages for ‘loss of control’.

Defence

The Defendant’s Defence was filed on 9 July 2021.

Reply

In a Reply, dated 24 August 2021, the Claimants:

Further Information of the claims and Individual Schedules

The Defendant made a Part 18 Request for Further Information on 9 March 2022. Following an application by the Defendant, on 27 April 2022, each Claimant was ordered to provide further information about his/her case, including providing details of his/her case on the loss and/or damage claimed. That was achieved by each Claimant being required to answer a series of questions. In response, by the end of July 2022, each Claimant filed a Schedule setting out specific information relating to his/her claim that was verified by a statement of truth (“the Individual Schedules”).

Although the amount of detail provided varied, each Individual Schedule sets out the relevant Claimant’s claim on whether s/he:

By way of example, the Individual Schedule filed on behalf of the First Claimant:

In this judgment, it is not necessary to analyse each of the Individual Schedules. Some common themes emerge; for example, the fear that the relevant Claimant would be a victim of identity theft. The evidence filed by the Claimants has not demonstrated that the apprehended risk of identity theft has materialised. Some of the Claimants have, in their Individual Schedules, raised concerns over receipt of spam emails or suspicious financial transactions, but given that neither email nor financial information was contained in the ABS, it is difficult to see how that could be attributed to any misuse of information from the ABS by a third party. Substantially, the claim for each Claimant is very much put on the distress/anxiety caused by the apprehension that s/he might be a victim of identity theft.

On 25 July 2022, the Claimants’ solicitors wrote to the Defendant’s solicitors to advise that:

On 5 August 2022, the proposal of a standstill agreement was rejected by the Defendant’s solicitors.

On 8 August 2022, the Claimants’ solicitors wrote again to the Defendant’s solicitors. The letter included the following, under the heading “Medical Claimants”:

On 31 August 2022, a sub-set of 63 Claimants in the First Claim issued a further Claim Form seeking damages for personal injury alleged to have been occasioned by the sending of the ABS to the wrong address (“the Second Claim”). No application was made to amend the existing MPoC or Individual Schedules. This Claim Form in the Second Claim was issued, as the Claimants’ solicitors had indicated in correspondence, to protect the relevant Claimant from any arguable defence of limitation that might be raised. Before service of the Claim Form, by amendment, the number of Claimants in the Second Claim was reduced to 42 (see [50] below).

On 10 October 2022, the Defendant’s solicitors sought confirmation whether a further claim had been issued, as threatened by the Claimants. The Claimants’ solicitors did not tell the Defendant’s solicitors that the Second Claim had been issued. That failure has not properly been explained by the Claimants.

By Application Notice dated 6 September 2022, the Claimants in the Second Claim applied for, and by Order dated 21 December 2022, were granted by the Master an anonymity order in similar terms to that granted in the First Claim (“the Second Anonymity Order”). That Application was made without notice to the Defendant.

On 21 December 2022, the Claimants’ solicitors wrote to the Defendant indicating that the deadline for service of the Claim Form in the Second Claim was 30 December 2022. This was the first that the Defendant knew of the Second Claim. The letter stated that the Claimants “[did] not propose to seek an extension for service of the [Claim Form in the Second Claim] but would be grateful if you could confirm whether you are amenable to an extension of time for service of the supporting medical evidence”. The Defendant’s solicitors refused that request.

The Claimants’ solicitors purported to serve the Claim Form by email on 30 December 2022. In doing so, they relied upon a prior indication by the Defendant’s solicitors, in a letter dated 11 March 2021, that they were authorised to accept service of the proceedings, and would accept service by email providing certain conditions were met. Before it was served, the Claim Form was amended to remove several Claimants, leaving the Second Claim being pursued by 42 Claimants. The Claim Form in the Second Claim was accompanied by medical reports for some, but not all, of the remaining Claimants. The Claim Form indicated that Particulars of Claim in the Second Claim were “to follow”.

By email, at 12.29 on 30 December 2022, after purported service of the Claim Form in the Second Claim, the Defendant’s solicitors advised the Claimants’ solicitors that they did not accept service of the Claim Form in the Second Claim by email. Also, on 30 December 2022, the Claimants in the Second Claim issued an Application Notice seeking an extension of time for the service of medical evidence for the remaining Claimants. This Application did not include an application for an extension of time for service of Particulars of Claim. Under CPR 7.4(2), Particulars of Claim must be served on a defendant no later than the latest time for serving a Claim Form (i.e. 30 December 2022).

“Draft” Master Particulars of Claim in the Second Claim, dated 17 January 2023, were apparently provided to the Defendant on 6 February 2023. By 16 February 2023, medical reports for all Claimants in the Second Claim had been served. The Claimants in the Second Claim subsequently made an Application for an extension of time for service of the Particulars of Claim (see [66] below).

This statement of case in the Second Claim largely repeated the claims made in the First Claim, but also expressly adopted a claim for personal injury alleged to have been caused by the alleged breach of data protection/misuse of private information. Brief details of the alleged psychological injury claim of each Claimant were included in a Schedule attached to the Master Particulars of Claim, which also identified the medical report from a clinical psychologist relied upon by each Claimant.

Again, taking an example of one of the expert reports filed in support of a claim for personal injury, the 48^th Claimant (Scott Walters) has relied upon a report from Dr Rosalie Hughes, Consultant Clinical Psychologist, dated 30 November 2022. Dr Hughes states that, in her opinion, the data breach had caused exacerbations of pre-existing psychological symptoms.

Dismissal Application

On 17 October 2022, the Defendant issued an Application Notice seeking to strike out the Claimants’ claims and/or for summary judgment (“the Dismissal Application”). The Dismissal Application was released to be heard by a Judge of the Media & Communications List, on 9 November 2022, and fixed for hearing on 27-28 February 2023.

The grounds of the Dismissal Application were as follows:

The Dismissal Application was supported by witness statements, on behalf of the Defendant, from William Richmond-Coggan and Adam Green, both dated 17 October 2022. In answer, the Claimants have filed a witness statement from Kingsley Hayes, dated 9 December 2022. Exhibited to Mr Hayes’ statement were separate statements from eight Claimants. In response, the Defendant filed a further witness statement from Mr Richmond-Coggan, dated 13 January 2023.

As part of the evidence filed by the Defendant, examples of the envelope in which the ABSs were sent have been provided together with specimen letters. From an unopened letter, all that could have been seen would have been, through the window of the envelope, the name of the addressee together with the out-of-date address and, printed on the outside of the envelope, the words “Private and Confidential” and a return address of the Defendant. Scrutiny of an unopened envelope would give no indication that an intended recipient was a police officer. Mr Sharland KC submitted that the only piece of information visible from an unopened letter, that the Claimants contend is private and/or personal data, is the relevant Claimant’s name. He argues that this is de minimis and incapable of supporting a claim for misuse of private information and/or data protection.

In the few cases, where the relevant Claimant has positive evidence that the ABS was opened, Mr Sharland KC submits that the initial pages of the letter included no personal information beyond the name of the intended recipient and his/her reference number. By way of example, the first page of the ABS contained the following:

Based on the evidence filed for the hearing, in his skeleton argument, Mr Sharland KC provided the following summary of the claims:

As noted already, the majority of the Claimants have relied on an inferential case that their ABS was opened (and read) by a third party (see [33]-[34 above). It is necessary to look more closely at the claims of the 14 Claimants who have advanced a positive case that their ABS was opened (and read) by a third party. Those are the claims bought by the 14^th, 75^th, 109^th, 111^th, 155^th, 200^th, 247^th, 253^rd, 258^th, 307^th, 342^nd, 359^th, 386^th and 472^nd Claimants. The information provided in the Individual Schedules for these Claimants includes the following:

As to the claims for damages advanced by the Claimants, Mr Sharland KC extracted the following summary from the Individual Schedules:

Striking Out Application

On 12 January 2023, the Defendant issued an Application Notice seeking an order striking out the Second Claim on the grounds that the Claimants in the Second Claim had failed to serve Particulars of Claim by the deadline imposed by CPR 7.4(2) (“the Striking Out Application”).

The Striking Out Application was referred to me. Without a hearing, I made an Order, on 17 January 2023, listing the Striking Out Application to be heard at the hearing that had been fixed for 27-28 February 2023, and gave directions for evidence to be filed by the parties. I also directed that:

In compliance with that Order, the Claimants filed a further witness statement from Mr Hayes, dated 24 January 2023. He stated that the decision to issue the Second Claim was to protect the relevant Claimants from any argument by the Defendant that their claims were time barred, and explained:

Application by the Claimants in the Second Claim

On 24 January 2023, the Claimants in the Second Claim issued an Application Notice seeking orders that:

In relation to this procedural thicket, the Claimants submitted:

Despite the observations made in the Order of 17 January 2023 questioning why the Claimants had not simply sought permission to amend the First Claim, no such application was made by the Claimants prior to the hearing on 27-28 February 2023. At the hearing, the Claimants faintly pursued their suggestion that they be granted permission to amend the Particulars of Claim in the First Claim to enable the Claimants in the Second Claim to pursue a claim for personal injury (see [67(2)] above). I refused to do so. The Court of Appeal has deprecated first instance courts dealing with applications to amend ‘on the hoof’: see Sayn-Wittgenstein-Sayn -v- HM Juan Carlos Alfonso Victor María de Borbón y Borbón [2023] 1 WLR 1162 [63]. The Claimants had had sufficient time in advance of the hearing on 27-28 February 2023 to propose draft amendments to the MPoC in the First Claim to the Defendant and, if consent were not forthcoming, to issue the necessary Application Notice to seek permission to amend. By the time of the hearing, they had not done so.

The Claimants’ position in relation to the Second Claim remains difficult to understand. Mr Campbell KC referred me to Chandra -v- Brooke North [2013] EWCA Civ 1559 [69] as providing the Court of Appeal’s suggestion that, where a claimant seeks permission to amend in circumstances where the amendment sought might arguably time barred, the prudent course is to issue a second claim prior to expiry of the limitation period. No one can quarrel with the good sense of that recommendation. However, here, the Claimants did not issue an application to amend the First Claim either before issuing the Second Claim or at any time before the hearing on 27-28 February 2023. In circumstances where a second claim is issued, protectively, it is as a fall back to guard against any adverse ruling of the Court refusing permission to amend the first claim.

At the hearing, I was unable to understand the stance adopted by the Claimants. Objectively judged, even if there was a risk of the limitation period for any claim for personal injury expiring, the Claimants appeared to me to have what appeared to be an unanswerable argument that the amendments sought would fall within CPR 17.4(2). The Claimants in the Second Claim were simply advancing a claim that they had additionally been caused personal injury as a result of the sending of the mis-addressed ABSs. The underlying facts in the First Claim remained the same. Yet, by the time of the hearing, they had not taken the step of issuing an application seeking permission to amend.

At the hearing, the Defendant did not challenge the contention that, if required, the Claimants could rely upon CPR 17.4(2) in relation to any application to amend the First Claim. Challenged that this was not a particularly constructive approach, the Defendant submitted that it was not required to assist the Claimants in formulating their claims, or for that matter, to assist in sparing the Court from interminable procedural wranglings by proposing a pragmatic solution. The Defendant’s position was the Court should simply rule on the Applications that were in front of it. In the circumstances of this case, that was not a helpful stance to adopt.

So that the Court could deal with the real issue between the parties in relation to the claim for personal injury, I made an Order, at the hearing, that, by 4.30pm on 2 March 2023, the relevant Claimants in the First Claim should file and serve any Application to amend their claim so as to include a claim for personal injury. The Defendant was required to confirm in writing, by 17 March 2023, whether it consented to any Application to amend made by the Claimants.

Anonymity Orders discharged

As a result of the change of the Claimants’ stance on the issue of anonymity, only 9 Claimants sought to maintain the Anonymity Order in their claims (see [22] above). In consequence, pending determination of the issue whether the Anonymity Order should be maintained in the case of those Claimants, I made an order discharging the Anonymity Order, save for those Claimants who wished to argue that anonymity should be maintained in their case. The Claimants were directed to file an Amended Claim Form providing the names of the Claimants who had previously been anonymised and in respect of whom the Anonymity Order had been discharged. An Amended Claim Form was duly filed on 15 March 2023. Since then, it has been available for public inspection under CPR 5.4C(1) and the Schedule attached lists the names of all Claimants in respect of whom the Anonymity Order has been discharged.

Further Applications and evidence in respect of other derogations from open justice

At the hearing on 27-28 February 2023, the Claimants indicated that they (or most of them) wished to maintain that their addresses should be withheld from the Claim Form and other documents required to be filed with the Court that were open to public inspection. At the hearing, the Claimants also sought restrictions on third party access to the Individual Schedules pursuant to CPR 5.4C(4), largely because public access to the Individual Schedules would frustrate the Applications of those Claimants who were seeking orders to restrict public access. I made orders:

Following the hearing and in accordance with directions given by the Court, on 5 May 2023, the Claimants issued a further Application Notice seeking derogations from open justice in two categories of Claimant:

Each Claimant who sought orders in either or both of these categories filed a witness statement in support of the Application. In addition, Kingsley Hayes, of the Claimants’ solicitors also provided a witness statement, dated 5 May 2023. Mr Hayes’ witness statement provides a helpful summary of the Claimants’ individual witness statements:

Each Claimant, in his/her witness statement, has explained why an order should be made in these terms in his/her favour. The reasons differ, Claimant by Claimant, but some themes emerged from this evidence. A common justification, advanced in support of a 5.4C Order, was that, apart from close family and immediate colleagues, the officer’s role within the police was not public knowledge. Some officers stated that they would be “worried and frustrated” if their role in the police did become public knowledge. Some suggested that it might lead to their being “targeted by criminals”, others that such knowledge would put the officer and his/her family “at grave risk of harm”.

Finally, the Claimants have filed a witness statement from the Data Protection Officer at Sussex Police, Martin Brazier, also dated 5 May 2023. Mr Brazier states that Sussex Police issues guidance regarding the steps that its officers can take in order to protect their identities. He exhibits the guidance that is provided to officers and states:

Mr Brazier adds that the threat level to the UK Police Service remains “substantial”. Guidance is given that: “Police officers are considered legitimate, accessible and symbolic targets for attack by Islamist and Extreme Right-Wing terrorists…” Mr Brazier states that he is aware of Facebook groups that are dedicated to identifying police officers and harassing them. The names of police officers are, he says, routinely redacted when documents are provided, for example in response to subject access requests under the data protection legislation and when documents are provided in Court proceedings. Mr Brazier states that if a police officer’s home address were to be made publicly available, that might affect the officer’s ability to move into more sensitive areas of policing with increased vetting requirements.

Mr Hayes, in his witness statement, stated that the Claimants were not seeking a “blanket restriction” on public access to the Individual Schedules. He suggested that they were seeking only a requirement that any third party wishing to obtain a copy from the records of the Court should be required to make an application. “The order sought thereby attempts to go no further than establishing a simple and limited safeguard against access by nefarious parties for malevolent purposes, and in order to protect the safety of the Claimants.”

Application to amend the MPoC in the First Claim to advance the personal injury claims

Further to the Order made at the hearing (see [72] above), the Claimants duly issued an Application Notice on 2 March 2023 seeking (if necessary) permission to amend the First Claim to enable the relevant Claimants to advance a claim for personal injury (“the Application to Amend”).

On 17 March 2023, the Defendant’s solicitors confirmed that, subject to receiving some points of clarification, the Defendant consented to the Application to Amend.

Subject to hearing the parties’ further submissions, it would appear that the consequence of this is that the Second Claim has been rendered otiose. I shall deal with the consequential orders in relation to this Second Claim when this judgment is handed down.

Striking out

The Court can strike out a statement of case (in whole or in part) if it appears that it discloses no reasonable grounds for bringing the claim: CPR 3.4(2)(a). PD 3A §1.2 provides examples of cases where the Court may conclude that Particulars of Claim fall within CPR 3.4(2)(a), including where the Particulars of Claim “contain a coherent set of facts but those facts, even if true, do not disclose any legally recognisable claim against the defendant”.

For Media & Communications claims, CPR PD 53B §2.1 provides:

A striking out application requires analysis of the statement of case, without reference to evidence. Unless demonstrably and patently hopeless, the Court proceeds on the assumption that the relevant factual averments will be established by evidence at trial. The Court should not be deterred from deciding a point of law; if it has all the necessary materials, it should “grasp the nettle”. Where a statement of case is found to be defective, the Court should consider whether the defects might be cured by an amendment and, if it might be, the Court should consider whether to give the party concerned an opportunity to amend: Morgan -v- Associated Newspapers Ltd [2018] EWHC 3960 (QB) [39]; Duchess of Sussex -v- Associated Newspapers Ltd [2020] EWHC 1058 (QB) [33(2)]; Duke of Sussex -v- Associated Newspapers Ltd [2023] EWHC 3120 (KB) [35].

Summary Judgment

There is no real dispute between the parties as to the principles that apply when the Court is deciding a summary judgment application. I can take those principles from Lawrence -v- Associated Newspapers Ltd [2024] EMLR 3 [77]:

Misuse of private information

The tort of misuse of private information has a two-stage test. First whether the claimant has a reasonable expectation of privacy in the relevant information; and second whether that expectation is outweighed by any countervailing interest: ZXC -v- Bloomberg [2022] AC 1158 [47]. The question whether there is a reasonable expectation of privacy is a broad one, which takes account of all the circumstances of the case: Murray -v- Express Newspapers plc [2009] Ch 481 [36].

The ‘misuse’ relied upon to found a claim must “attain a certain level of seriousness”: ZXC [45] and In re JR38 [2016] AC 1131 [87] (approving the articulation of this principle by Laws LJ in  R (Wood) -v- Commissioner of Police of the Metropolis  [2010] 1 WLR 123 [20]-[22]). In Underwood -v- Bounty UK Ltd [2022] EWHC 888 (QB), the claimants’ claims were dismissed on other grounds, but I did find that the information obtained was trivial (name, gender and date of birth) and did not meet the level of seriousness to sustain a claim for misuse of private information: [53].

In this case, the Defendant does not contend that there is a justification for misaddressing the ABSs. It contends that, unless the contents of the ABSs have been read by (and published to) a third party, there has been no ‘misuse’. As a fall-back, the Defendant also argues that, even if an ABS was read by a third party, that cannot constitute ‘misuse’ under the tort.

The issue of what constitutes ‘misuse’, for the purposes of the tort, has arisen in several decisions. Mr Campbell KC has referred to the Court of Appeal’s decision in TLT -v- Secretary of State for the Home Department [2018] 4 WLR 101 [50] as establishing that liability for misuse of private information may arise as a result of ‘human error’. In a similar vein, Saini J observed in Warren -v- DSG Retail Limited [2021] EMLR 25 [27] that the ‘misuse’, relied upon to found the action:

I accept that principle, as far as it goes, but TLT was a case in which the claimants had established, at trial, that a spreadsheet containing their private information had been published on a website and, on the evidence, had been downloaded 27 times by 22 different IP addresses. In other words, that there had been an interference with the privacy interests of the claimants caused by the negligent act of publication of the spreadsheet containing the claimants’ private information to the various third parties who had downloaded the document.

Warren was a cyber-attack case, where personal data was obtained by hackers from the defendant’s computer systems. Striking out the claim for misuse of private information, Saini J found that there had been no ‘misuse’ of the claimants’ personal information by the defendant; it had been the victim in the cyber-attack. The Judge held that misuse of private information could not be maintained in respect of what was, in essence, a complaint about alleged inadequate data security: it was, he noted, “an unconvincing attempt to shoehorn the facts of the data breach into the tort of MPI”: [27].

Saini J returned to consider this point in another cyber-attack case: Smith -v- Talktalk Telecom Group plc [2022] 1 WLR 5213. The Judge held:

In Stadler -v- Currys Group Limited [2022] EWHC 160 (QB), the Court dismissed claims for breach of confidence and misuse of private information arising from the Defendant’s resale of a television set which had not been adequately ‘wiped’ to remove some of the Claimant’s data stored on it. HHJ Lewis held [58]:

In my judgment, based on these authorities, if a Claimant in this case can show that, as a result of his/her ABS having been read by a third party, information over which s/he has an expectation of privacy has been disclosed/published, then (subject to satisfying the threshold of seriousness) s/he has an arguable case for misuse of private information. This is not like a data breach case where a third party has unlawfully obtained the information as a result of hacking or a cyber-attack. This case is much closer on the facts to TLT . Where a Claimant can demonstrate publication of the private information in an ABS, that has arisen from the Defendant’s act of sending the ABS to the wrong address, then that can, in my judgment, provide the element of ‘misuse’ for the tort. I therefore reject the Defendant’s fall-back argument (see [90] above).

That leads me on to a further, and important, point. In this case, each Claimant’s claim of misuse of private information depends upon his/her ABS having ended up in the hands of (at least) one third party who, it is contended, would have opened the letter, and read the contents. For almost all Claimants, that case is purely inferential.

The Defendant contends that – absent an averment in the statement of case (and ultimately proof) that the ABS was read by any third party, a claim for misuse of private information either fails to disclose a cause of action or has no real prospect of success. For that element of publication of the ABS to a third party, the Defendant relies – by analogy – upon principles from the law of defamation which establish that there is no presumption that a letter – sent in the post – will be read by anyone other than the addressee. The authors of Gatley (13^th edition, 2022, Sweet & Maxwell) give the following summary of the principles of publication in §7-017 (footnotes, omitted or expanded):

As to the scope for drawing inferences about publication, the principles are stated as follows in §34-007 (footnotes, omitted or expanded):

Closely linked to the question of what amounts to ‘misuse’ under the tort is the issue of whether English law permits recovery under the tort simply for ‘loss of control’. In Lloyd -v- Google , although strictly obiter (as no claim for misuse of private information had been pursued), the Supreme Court considered the decisions in Gulati -v- MGN Ltd (both at first instance ([2016] FSR 12) and on appeal to the Court of Appeal ([2017] QB 149) and noted:

Data protection

There are two issues of dispute between the parties in relation to the data protection claim. First, what amounts to damage sufficient to sustain the cause of action; and second, whether the law in England & Wales imposes a threshold of seriousness for that damage in data protection claims. The parties have also provided submissions, after the hearing, on the ECJ decision in UI -v- Österreichische Post AG [2023] 1 WLR 3702.

‘Damage’ in data protection cases

In Lloyd -v- Google LLC [2022] AC 1217, the Supreme Court held that, under s.13 Data Protection Act 1998, ‘damage’ was limited to material damage (i.e. financial loss or psychological injury) and distress. The Supreme Court rejected the claimant’s ‘loss of control’ argument; that an individual was entitled to recover compensation under s.13 without proof of material damage or distress whenever a data controller had failed to comply with any requirements of the Act: [112]-[113].

The Claimants do not dispute this principle. In their written submissions, the Claimants submitted that they “are not seeking damages for ‘loss of control’ without proof that it caused distress”. The Claimants maintain that each has suffered non-material damage in any event. That arises from (a) the inferential case that the misaddressed envelopes have been opened by third parties and the contents of the ABS read by them; and (in any event) (b) distress (or equivalent emotions) caused by not knowing what has happened to the misaddressed ABSs.

Threshold of seriousness

A threshold of seriousness applies to claims for misuse of private information (see [89] above). Does such a threshold apply to data protection claims? The point was briefly considered by the Court of Appeal in Vidal-Hall -v- Google Inc [2016] QB 1003. The appeal principally concerned the proper interpretation of s.13(2) Data Protection Act 1998, and whether a claimant could maintain a claim for damages without proof of pecuniary loss. The Court of Appeal held that, having regard to the objective of the EU Parliament and Council Directive 95/46/EC, “damage” in Article 23 of the Directive included both material and non-material damage. In consequence, s.13(2) of the 1998 Act, by restricting claims for damages for distress to instances where the claimant could demonstrate pecuniary or material loss, had not properly given effect to the Directive in English law. The Court of Appeal explained:

Mr Sharland KC has also submitted that, in Lloyd -v- Google , Lord Leggatt appeared to accept that there was a threshold of seriousness in data protection cases, when he observed ([153]):

The ECJ decision in UI -v- Österreichische Post AG

Since the original hearing, the Court of Justice of the European Union gave its judgment in the case of UI -v- Österreichische Post AG , which bore on the issues of (1) the proper interpretation of “damage” under the General Data Protection Regulation (“GDPR”); and (2) whether a threshold of seriousness was appropriate in the assessment of non-material damage.

On these issues, the ECJ held:

At the hearing, the parties had made submissions to the Court based on the Advocate General’s Opinion in the case. The Defendant relied upon this in support of its submission that damages are not available for loss of control/autonomy. The Claimants contended that it supported their submission that there was no threshold of seriousness in data protection claims. Both sides have provided further written submissions as to the impact of the ECJ decision, which they are agreed is not binding on the Court but is a decision to which the Court may “have regard”: s.6(2) European Union (Withdrawal) Act 2018

The Claimants submitted that the ECJ rejected the concept of a threshold of seriousness and, in doing so, has not accepted the Advocate General’s view that compensation should not be payable where the impact of a breach of data protection amounted to no more than “annoyance or upset” or a “mere feeling of displeasure due to another person’s failure to comply with the law”.

The Defendant submitted that the Court should not follow the ECJ’s decision on the point as to a threshold of seriousness. Mr Sharland KC argued that the ECJ’s key motivation for the decision was to avoid a lack of ‘coherence’ between the member states if each were to apply its own threshold of seriousness. He argues that no such consideration would apply when considering simply the law in England & Wales and that, in this jurisdiction (in the cases cited in [104]-[105] above), a threshold of seriousness has been recognised to apply to data protection claims.

Jameel abuse of process

There is no significant difference between the parties as to the principles governing Jameel abuse of process applications, which were summarised in Higinbotham -v- Teekhungam [2018] EWHC 1880 (QB) [44]:

The jurisdiction to dismiss cases as Jameel abusive is one that should be reserved for “exceptional cases” where the Court is satisfied that it is impossible to fashion a procedure whereby the claim can be resolved in a proportionate way: Tewari -v- Khetarpal [2022] EWHC 2066 (QB) [77].

In Alsaifi -v- Trinity Mirror plc [2018] EWHC 1954 (QB) [45], I held:

Although Jameel was a defamation case, there is no dispute between the parties that the Jameel jurisdiction is not limited to defamation claims and that it extends to all civil claims, including misuse of private information and data protection: see Higinbotham [45]; Vidal-Hall [134]-[136] ( Sullivan was, principally, a breach of copyright claim).

Mr Campbell KC has relied upon the group nature of the claims that are being pursued. In Municipio de Mariana -v- BHP Group (UK) Ltd [2022] 1 WLR 4691, another case that shows that the Jameel jurisdiction is of universal application, the Court of Appeal provided the following guidance in the context of multi-party group litigation:

Anonymity and derogations from open justice

Pursuant to CPR PD16 a Claim Form must include:

A Claim Form is one of the documents that is publicly available (subject to certain conditions) from the records of the Court as of right (i.e. without requiring permission of the Court): CPR 5.4C(1).

The default position, under the CPR, is therefore that the name and address of a party to civil litigation is required to be publicly available. These requirements are an important dimension of open justice and transparency. The Court has the power to permit derogation from this default position under CPR PD 16 §2.3 and CPR 39.2(4). As these are derogations from the principles of open justice, the following principles apply (drawn from Practice Guidance (Interim Non-Disclosure Orders) [2012] 1 WLR 1003 (“the Practice Guidance ”) [9]-[13] and [16]):

Anonymity orders are usually justified on one of two bases: maintenance of the administration of justice and harm to other legitimate interests. The first category of case is where, without the relevant order being made, the administration of justice would be frustrated. Examples of this type of justification for derogations from open justice would include cases involving trade secrets or other confidential information. In such cases, if no derogations from open justice were granted, the proceedings themselves would destroy that which the claimant was seeking to protect, thereby frustrating the administration of justice: Lupu -v- Rakoff [2020] EMLR 6 [28]-[30]:

Consistent with the requirement to establish the necessity for any derogation from open justice with convincing evidence, the Court will scrutinise with care any application that the Court should withhold the name of a party or other details about the claim (including the party’s address) from the public. Mere assertion that a party may suffer some harm is unlikely to discharge the burden to justify the order.

In Various Claimants -v- Independent Parliamentary Standards Authority [2022] EMLR 4, the Claimants sought an order relieving them from the requirements to provide their names and addresses on the Claim Form. In support of their application, they relied upon hostility in some sectors of the community towards Members of Parliament and their staff. The application was refused because the evidence put forward by the Claimants failed to demonstrate a credible risk that, if the Claimants were named (and their addresses provided), they would be exposed to some risk of harm. I noted [52]:

Warby LJ provided a distillation of the principles concerning anonymity orders and other derogations from open justice in R (Marandi) -v- Westminster Magistrates’ Court [2023] 2 Cr App R 15 [43]:

Turning to the Claimants’ recent application for a 5.4C Order, the MPoC, as a statement of case, is publicly available under CPR 5.4C(1). The status of the Individual Schedules, and whether they fall within the definition of a “statement of case” for the purposes of CPR 5.4C(1) is less clear. On the one hand, it might be contended that the Individual Schedules do not fall within CPR 5.4C(1) because they are “documents filed with or attached to the statement of case, or intended by the party whose statement it is to be served with it”. On the other hand, the Individual Schedules were ordered to be provided following the Defendant’s Application for Part 18 Further Information. Part 18 Further Information does fall within the definition of a statement of case (whether provided voluntarily or pursuant to a Court order): CPR 2.3(1).

If the Individual Schedules do not fall within the definition of “statement of case”, then a third party wanting to obtain a copy of an Individual Schedule would have to make an application under CPR 5.4C(2). The power to restrict third-party access to documents from the Court’s records, under CPR 5.4C(4), is limited to the categories of document available as of right under CPR 5.4C(1): ABC Ltd -v- Y Ltd [2012] 1 WLR 532 [9]. An order prospectively prohibiting third-party access to other documents on the Court file without the permission of the Court is otiose. Third parties can only obtain such documents with the permission of the Court under CPR 5.4C(2). When considering an application under that rule, the Court has power to impose conditions on such access, including directions that part(s) of the documents should be redacted before copies are provided to third parties: see Re Mobile Voicemail Interception Litigation [2012] 1 WLR 2545.

The Defendant submitted that the Individual Schedules are statements of case, relying upon CPR 2.3(1). Although I have not received detailed submissions on this point, tentatively, I would conclude that the Individual Schedules do fall within the definition of “statements of case” within CPR 5.4C(1) because they were filed by the Claimants, pursuant to a Court order, to provide further information about their claims (see [39] above). It would follow, therefore, that, subject to the Court making an order, under CPR 5.4C(4), restricting such access, a third party is therefore entitled to obtain a copy of any Individual Schedule from the records of the Court.

Submissions

Claimants

In relation to the 9 Claimants who maintain their application to be anonymised in the claim, Mr Aslett submitted that the evidence that has now been provided by the Claimants convincingly establishes why a derogation from open justice should be granted in their cases. The common theme in the evidence is that each of these Claimants is a police officer whose identity is closely protected in his/her operational role.

As to the further application to withhold their addresses, the Claimants submit that the evidence that has now been filed demonstrates that police officers are advised to keep their home addresses confidential. The individual statements that have been provided by the Claimants expand on particular concerns that the individual Claimants have about their addresses being available from the Court’s records. They also explain why the Claimants seek a 5.4C Order.

Defendant

The Defendant has taken largely a neutral stance on the Anonymity Application. Mr Sharland KC has, however, pointed to several features of the Anonymity Application which, he submits, are unsatisfactory.

Decision

I am satisfied that the 9 Claimants who maintain the Anonymity Application should retain the anonymity previously granted by the Master. The evidence that has now been provided to the Court is clear and cogent and convincingly establishes that the nature of their work as police officers requires them to be anonymised in these proceedings.

Turning to the application to permit the Claimants to continue to withhold their addresses from the Claim Form (and other documents required to be open to public inspection on the Court file), the further evidence that the Claimants have now filed does now satisfy me that the order should continue. I do not find the evidence of the individual Claimants, as to their particular reasons for wishing to withhold their addresses, on its own, to be sufficient to justify the continuation of the withholding order. If that had been the only evidence, the Claimants would have stood in a position that was similar to the Claimants in the IPSA case. The evidence that has satisfied me that the withholding order should continue is the evidence that shows that, as a matter of policy, the Claimants have been very strongly advised by their police force to protect the confidentiality of their home addresses. That is not to say that a police officer who brought, for example, a personal injury claim following a road traffic collision, would be entitled to withhold his/her address from the Claim Form. If his/her occupation was not relevant to the issues in the case, it is difficult to see why a withholding order for the claimant’s address would be necessary. Here, however, the nature of the claim, and the issues it raises, means that it will be immediately apparent that each of the Claimants is a police officer. As such, requiring each Claimant to provide his/her address would undermine the clear policy of the Sussex Police that officers should protect their addresses. I am therefore satisfied that the limited interference with the open justice principle, by permitting the Claimants to withhold their home addresses, is necessary and proportionate and has now been established by clear evidence.

However, it must be recorded that the original Anonymity Application, in seeking anonymity for (and to withhold the addresses of) the whole cohort of 474 Claimants was unjustifiably wide. The fact that a claim is being brought on behalf of a very large number of Claimants does not lessen the obligation to provide proper evidence in support of each individual Claimant’s application. Unless there are very unusual circumstances in a particular case, there are no categories of litigant who are entitled to anonymity or other derogations from open justice. Each Claimant who wishes to seek such a derogation must demonstrate, by evidence of the required cogency, that such an order is necessary, and its terms proportionate. The fact that, in this case, as soon as the Court challenged whether the Anonymity Order could be justified for the entire cohort of Claimants, all but 9 of the Claimants withdrew their applications stands as an alarming confirmation of the lack of justification for an order which represented a very significant derogation from open justice. The continuation of the Anonymity Order for 9 Claimants, and the withholding order for the addresses of the Claimants has only been justified by the further evidence that the Claimants have filed.

There is force in the Defendant’s criticisms of the original application for the Anonymity Order. There was, in my judgment, a serious lack of rigour in the Claimants’ approach.

I am not presently prepared to grant the 5.4C Order sought by the Claimants. Despite Mr Hayes’ protestations to the contrary (see [80] above), the Claimants have, again, adopted a blanket approach that is simply inappropriate when dealing with derogations from open justice. Much of the information contained in the Individual Schedules is anodyne and, in respect of which, there can be no justification from departing from the open justice principle that a non-party is entitled to obtain an unredacted copy of the Individual Schedules.

The justification largely advanced by the Claimants for making the 5.4C Order is that, for some of the Claimants, public access to the Individual Schedule will reveal his/her operational role in the police. Even if that concern did justify the imposition of some restriction on third party access to the Individual Schedules (and I remain to be convinced by evidence that it does), it could only justify withholding the relevant part of the Individual Schedule (by permitting third parties to obtain only a redacted version of the relevant Individual Schedule). It could not justify withholding the entire document. Such an order would represent an unnecessary and/or disproportionate interference with open justice. Mr Hayes’ suggestion that a third party could apply to be granted access to any Individual Schedule is to reverse the important open justice presumption of CPR 5.4C(1). It is for a party to demonstrate that a restriction on access to documents that fall within 5.4C(1) is necessary and proportionate, not for a third party to demonstrate that s/he should be provided with the document(s).

The Claimants have simply failed to perform a focused exercise to identify the particular information, in any Individual Schedule, they contend should be withheld from public access. Instead, they have sought an order that all Individual Schedules should be withheld from public inspection under 5.4C(1). Such an order cannot be justified. Its terms would be disproportionate because it would restrict public access to information contained in the Individual Schedules in a way that the Claimants cannot (and do not seek to) justify as necessary. As such, the application is refused.

I am not prepared to spend time going through over 400 Individual Schedules, and related witness statements, to attempt to identify what restrictions any particular Claimant might be able to justify, applying the principles I have identified. It is for a Claimant seeking a derogation from open justice to demonstrate that such a restriction is necessary. There is also an element of potential confusion in the witness statements. For those Claimants who have abandoned their Anonymity Application, they have accepted that they will be identified as police officers in this claim. That is inevitable, given the parameters of the litigation. If any individual Claimant wishes now to seek a narrow and focused redaction of particular information that s/he contends should be withheld from his/her Individual Schedules available to third parties from the Court’s records, then s/he can make a further application and the Court will determine each application on its merits.

Submissions

Defendant

The Defendant’s primary submission is that, without evidence that the ABSs have been opened and read by a third party, the claims for both misuse of private information and breach of data protection have no real prospect of success. Mr Sharland KC contends that publication is an essential element of each cause of action. The purely inferential case that a letter addressed to one of the Claimants which was sent to a former address would have been opened and read by a third party has no real prospect of success.

Separately, in his submissions on behalf of the Defendant, Mr Sharland KC has made a sustained attack on the trivial nature of the claims that have been brought and the wholly disproportionate way in which the litigation has been conducted. The Defendant argues that it is wholly unreal to suggest that the mis-addressing of the ABSs could have caused police officers any real distress or upset (or caused or exacerbated psychiatric harm). He points to the levels of incurred and estimated costs for the Claimants to argue that no sensible litigant would conduct litigation on this basis, given the very modest levels of compensation that most Claimants are seeking or expect to receive. Mr Sharland KC argues that this is a case where the Court should dismiss the claims under the Jameel jurisdiction.

Claimants

Although not resiling from his inferential case as to publication of the ABSs, Mr Campbell KC submitted that “the fundamental act of putting private information in danger is sufficient [use] to fall under the concept of misuse”. In other words, that, whether or not the mis-addressed ABS was actually opened and read by a third party, the mere act of wrongly addressing the ABS is an actionable “misuse” of private information. Mr Campbell KC was clear in his submissions: “the positive misuse by the Defendant here [is] in sending to the wrong address: that is the misuse”. The tort of misuse of private information is, on the Claimant’s submissions complete at this point. What happens subsequently to the ABS – whether it is returned unopened, never resurfaces or is returned opened – is a matter that goes only to the quantum of damages.

The Claimants’ fallback position is that if they are required to demonstrate that the ABS was opened and read by a third party – or “published” to borrow from the lexicon of defamation – then the Claimants rely upon the inferential case that the ABSs would have been opened. In this respect, Mr Campbell KC relied upon the – admittedly few – examples where the Claimants can show that the envelopes were opened.

When considering the Dismissal Application, Mr Campbell KC emphasises that this is a developing area of the law and he relies on the authorities that suggest that, in such cases, it is better for the Court to allow the matter to proceed to trial so that the law can be applied to facts as found on the evidence rather than on assumed facts.

On the issue of Jameel abuse, Mr Campbell KC submitted that the Court can fashion a way of resolving these claims in a proportionate manner. He submits that test cases should be selected, a proposal he said had been made by the Claimants’ solicitors from the outset. Selection of test cases would resolve some of the core issues that are common to all the claims, e.g. the various defences that have been raised by the Defendant to the alleged breaches of data protection. He makes the powerful submission that the Defendant is contesting liability. If not conceded, that issue will need to be resolved by the Court. That, he argues, will be best achieved (at proportionate cost) by selecting a sample of test cases in which the point can be isolated and determined for the benefit of the whole cohort. He referred me to the decision in Lancaster -v- Peacock [2020] EWHC 1231 (Ch), in which Fancourt J directed that 12 sample cases be identified from a group of 156 claimants. More generally, Mr Campbell KC acknowledged the Court’s concerns as to the scale of the costs that had been incurred already, but contended that the better course was not to dismiss the claims as Jameel abusive, but to disallow some of the incurred costs.

Decision

In my judgment, to have a viable claim for misuse of private information and/or data protection, each Claimant must show that s/he has a real prospect of demonstrating that the ABS was opened and read by a third party. Without that, the relevant Claimant would have no real prospect of demonstrating that there had been “misuse”, an essential element of the tort of misuse of private information. The authorities I have identified (see [91]-[95]) establish such a principle. In TLT the publication by the Defendant was negligent and unintended, but there was nevertheless publication.

For the purposes of clearly isolating the principle, it is helpful to consider the cases of the cohort of Claimants who ultimately did receive their ABS unopened. For those Claimants, an inferential case that the ABS was opened (and read) by a third party cannot be sustained. On the contrary, there is positive evidence that the ABS had not been opened (or read) by anyone else. Can these Claimants nevertheless bring a claim for misuse of private information and/or data protection in respect of the period before the ABS was returned? In my judgment, the answer is no.

I reject the submission that these Claimants can advance a claim on the basis that, until returned, their personal information/data was “in danger” or “at risk”. The general law of tort does not generally allow recovery for the apprehension that a tort might have been committed; a person crossing a road cannot recover damages (whether for distress or otherwise) for almost being struck by a passing lorry or for a defamatory letter that was never actually received by its intended recipient. To be entitled to any remedy, a claimant must demonstrate that s/he is the victim of a tortious wrong. A near miss, even if it causes significant distress, is not sufficient. Without the contents of the ABS coming to the attention of a third party there is no viable claim for misuse of private information. In simple terms, there has been no interference with the Article 8 rights of the relevant Claimant because the privacy of the information contained in the ABS has not been compromised at any stage.

The same is true for a civil claim for data protection. Data breach cases are premised on the personal data of the relevant claimant having been compromised; usually accessed by, or provided to, a third party. Shorn of the claim for “loss of control”, the Claimants’ claim is essentially one for Unlawful Processing by sending the ABS to the wrong address. But, if the ABS has not been opened or read by a third party, there has been no real “processing”. It was a near miss. I accept that there are wider policy considerations underpinning the data protection regime. Concepts of placing the data “at risk” have greater resonance in the regulatory context. A person who leaves a laptop on a train, from which unencrypted personal data could readily be accessed, may face regulatory action even if the laptop is recovered without any data having been compromised.

In consequence, the claims in which the ABS was returned unopened fail to disclose reasonable grounds for bringing a claim for misuse of private information and/or data protection and will be struck out under CPR 3.4(2)(a). In the alternative, I would have found that these claims should be summarily dismissed under CPR Part 24 as having no real prospect of success.

Next, I will consider the cases in which the ABS has not been safely returned and where the relevant Claimant relies upon an inferential case that the ABS has been opened and read by a third party (see [33]-[34] above). In my judgment, in these claims, the relevant Claimant has no real prospect of success. As pleaded, I would also hold that the bare inferential case on publication falls to be struck out pursuant to CPR 3.4(2)(a). Unless the relevant Claimant can plead a viable case, with a real prospect of success, that his/her ABS was actually opened and read by a third party, the claim will be struck out and/or dismissed under CPR Part 24.

The drawing of inferences is an evidential process. It is a process whereby a Court concludes that the evidence adduced enables a further inference of fact to be drawn. It is to be contrasted with speculative guesswork or wishful thinking: see Amersi -v- Leslie [2023] EWHC 1368 (KB) [158]; Blake -v- Fox [2024] EWHC 146 (KB) [53].

The authorities relied upon by Mr Sharland KC (see [98]-[99] above) demonstrate that there may be cases where the Court will draw the inference of publication of a letter beyond the named recipient. But the factual premise for drawing such an inference is, in those cases, solidly based. Absent some facts that would compel a different conclusion, the Court will not draw the inference that a letter addressed to a named recipient, clearly marked “private and confidential”, will be opened by a third party who is not the named recipient or authorised by him/her to open correspondence addressed to named recipient.

In the Claimants’ MPoC, the case that the ABSs were opened (and read) by third parties is pleaded as a bare inference. No further particulars are provided. It is impossible, therefore, to identify the facts that are being relied upon to support the invited inference. Such a pleading fails to disclose a proper basis for the inferential case and falls to be struck out under CPR 3.4(2)(a). But beyond that, and looking at the evidential position, the Claimants’ position does not improve.

The fact that, in a handful of cases, there is some evidence that the relevant ABS was opened does not supply a reliable evidential foundation for the drawing of an inference that ABSs were generally opened by third parties. On the contrary, the very few instances when this happened is evidence that (if anything) supports an inference that private correspondence is not generally opened by someone who is not the addressee. Effectively, the Claimants have tried to reverse the burden of proof and require the Defendant to demonstrate that the ABS was not opened (and read) by a third party in each claim. As a matter of principle, that is impermissible, but the evidence paints an entirely different picture. Of the 14 cases where there is direct evidence that the ABS was opened, 11 were opened by a relative of the addressee (opened perhaps believing that it was acceptable for him/her to open the envelope or in error) (see further [61] above). In only 2 cases, in a cohort of some 450 individuals, is there evidence that the ABS was opened by someone other than a family member or colleague. That evidence speaks for itself. It effectively destroys any inferential case that the ABSs were generally opened and read by third parties.

If, as I have found, each Claimant must demonstrate that his/her ABS was opened and read by a third party, then any claim which relies solely upon this inferential case has no real prospect of success. Ordinarily, the consequence of this finding would be that the relevant claim would be dismissed under CPR Part 24. The Claimants have not suggested that further evidence is likely to be available at trial on this issue. I will hear submissions when this judgment is handed down as to the consequential orders to be made. A Claimant who believes that s/he might be able to provide actual evidence that the ABS was actually opened and read by a third party may, even at this late stage, be able to persuade the Court to give him/her one last chance. Against that, the Defendant may very well say that the Claimants have known that an attack was being made on the viability of claims that relied solely on an inferential case as to publication and that they have had ample opportunity to advance a reformulated claim but did not do so.

The effect of the decisions I have made would be to leave 14 claims in which the relevant Claimant has a real prospect of demonstrating that his/her ABS was opened and read by a third party.

From the information that has been put forward in the Individual Schedules, the 14 claims where the ABSs were opened would appear to be very far from being serious cases (see [61] above). If the claims go further, the Claimants may face further attacks on the viability of the relevant claim depending upon the evidence that is ultimately adduced at trial. Some may ultimately be found to be trivial and fall to be dismissed on the basis that they fail to surmount the threshold of seriousness.

In particular, the 14 Claimants may yet have to surmount the evidential hurdle that the ABS was read by the person who opened the envelope (or someone else). In all but one of the cases it is not clearly stated, in terms, whether the ABS was read, and if so, how much of it was read. In the case of the 258^th Claimant (see [61(9)] above), she was told that her family had not looked at the contents. In half of the cases, the relevant Claimant’s case is that the ABS was (or may have been) opened (or received) in error (see cases of the 75^th, 111^th, 307^th, 342^nd, 359^th, 386^th and 472^nd Claimants [61] above). Unless the Defendant concedes that the ABS was read by a third party in each of these cases, then the Claimants will bear the burden of demonstrating, at trial, that it was. Given the evidence as to the layout of the first page of the ABS, the Claimants may also need to demonstrate that more than the first page of the letter was read.

Some aspects of individual Claimants’ claims for loss and damage can be seen, even now, to be hopeless. For example, the 359^th Claimant’s ABS was opened by his father in error (he shares the same first initial of the Claimant) (see [61(12)] above). It was then forwarded to him. On this Claimant’s case, the extent of the “misuse” of his private information and/or processing of his personal data (even assuming that his father read the whole ABS) arose from publication to one person; the Claimant’s father. Set against those basic facts, the expressed fears of the 359^th Claimant (in support of his claim for distress damages) that the information within the ABS might be used to identify and target him, his family or his current home appear to be completely unreal. Unless it is to be suggested that the Claimant’s father took a copy of the ABS (or the information it contained) before returning it, the Claimant’s concern that the information in the ABS could be “misused at any time” would appear to be equally baseless. A Claimant’s prospects of success are not going to be improved by making exaggerated claims as to the impact of the ABS being opened (and read) by a third party.

Nevertheless, the appropriate time for an assessment of the evidence in relation to each of the Claimant’s claims is at a trial. In part because of the way these claims have been pursued, the Court has not been able to drill down into the details of these 14 claims. I cannot be satisfied, at this stage, that none of these Claimants has a real prospect of surmounting the threshold of seriousness in his/her claim. The ABS did contain some information that went beyond the banal and anodyne. If, for example, details of the individual Claimant’s expected annual pension were published to (i.e. read by) a third party, the relevant Claimant does have a real prospect of demonstrating the constituent elements of a misuse of private information claim (and so to a data protection claim). The fact that any award of damages might be very modest, if a claim were to succeed, does not affect the viability of the claim. In respect of that claim, each Claimant has provided details of the distress (or equivalent) that s/he claims to have suffered. On first impression, it might seem unlikely that the opening of the ABS could have caused much distress to a police officer, but each Claimant is advancing a claim, verified with a statement of truth, that s/he has been caused distress (or equivalent). A Court could only reject evidence in support of such a claim after all the relevant evidence has been tested at trial. In short, the claim cannot be struck out or dismissed under Part 24.

In light of my conclusions, it is not necessary (nor is it desirable) for me to reach a concluded view on the very interesting points as to whether the law in this jurisdiction imposes a threshold of seriousness in data protection claims. Given its potential importance, and the way the point arose (and had to be argued) in this case, I think it is better for me not to express any view. It is sufficient, for the claims of the remaining Claimants, that I have decided that whether each Claimant could surmount a threshold of seriousness (were one found to apply in data protection claims) is a factual question that, like the similar question that applies in misuse of private information claims, can only fairly be resolved at a trial. Given the potential importance of the point, this is a case where the Court should resolve the point of law on threshold of seriousness on the basis of facts found after a trial rather than facts assumed for the purposes of a summary judgment or striking out application (see [87(10)] above).

Therefore, and finally, I turn to the Defendant’s submission that I should nevertheless dismiss these 14 claims, under the Jameel jurisdiction on the grounds that their continued litigation is an abuse of process. The starting point for this analysis must be that each Claimant has a viable cause of action with a real prospect of success. In the final analysis, it may well be that, if successful, the claims of the remaining 14 Claimants will only achieve very modest damages, but for the reasons explained in Alsaifi ([113] above) that is only one factor that the Court considers when deciding whether continued litigation of the claims would be Jameel abusive.

The decisions I have made earlier in this judgment mean that (subject only to a last-ditch effort to amend – see [153] above) only 14 claims (from a remaining cohort of over 450) will be going forward. The scope and complexion of this remaining litigation has therefore changed radically (and most of Mr Sharland KC’s objections based on the vast sums in costs that have been expended substantially fall away). The Court is no longer dealing with an unwieldly number of Claimants litigating a pseudo-class action in a way that is alleged to be wholly disproportionate to the likely sums that would be achieved in compensation were the claims to succeed. There are now 14 claims. The question for me is whether, for these claims, the Court can fashion a procedure by which the claim can be adjudicated in a proportionate way. I have no difficulty in answering that the Court can meet this challenge.

Given what has happened to the bulk of the cohort of claims, the figures for costs (both incurred and budgeted) that have been produced to the Court have now substantially been overtaken by events and have limited continuing relevance to the issue that now presents for decision. Put simply, I do not have reliable costs information as to how much it will now cost to progress the remaining 14 cases to resolution at a trial. I suspect that there is also likely to be a degree of taking stock to be done on both sides and there may well be a narrowing of issues. At this stage, I lack the basic material upon which to make the assessment of the value of what the remaining Claimants hope to achieve by way of compensation and the likely costs of doing so.

Had liability been admitted by the Defendant in this case, leaving only an assessment of damages, the most appropriate directions would appear to be to transfer the remaining 14 cases to the County Court to be allocated to the small claims track (as happened in Cleary -v- Marston (Holdings) Ltd [2021] EWHC 3809 (QB)). The cost/benefit analysis would change significantly if the remaining claims were transferred to the County Court small claims track.

Nevertheless, one of Mr Campbell KC’s strongest points remains that, for as long as the Defendant continues to dispute liability on the grounds that it was a data processor, rather than a data controller, there is a common issue between the 14 claims that must be resolved. The most convenient way to resolve that issue may well be for it to be determined, as a preliminary issue, in the High Court. Once that has been resolved, the way would be clear (if liability has not been determined against the Claimants or the claims do not otherwise resolve by agreement) to transfer to the County Court for an assessment of damages.

For all these reasons, I am very far from satisfied that the Court has reached the point whereby it is impossible to fashion a procedure for resolving the remaining 14 claims at proportionate cost. I decline therefore to strike out the remaining 14 claims as an abuse of process.

For the reasons given in this judgment:

At the hearing when this judgment is handed down, I shall hear arguments on the consequential orders, including directions for the 14 remaining claims. The parties are invited to identify what they can agree, and what matters the Court will need to resolve. There are likely to be substantial issues as to costs, including the costs of the various applications and the costs of the Second Claim. The parties will need to identify clearly all the issues that need to be resolved (either by agreement or decision of the Court).