UK businesses may face surge in 'trivial' GDPR claims

Key facts

• Businesses may face a flood of 'trivial' compensation claims over GDPR worries.
• A Court of Appeal ruling stated there is no de minimis 'threshold of seriousness' for GDPR claims of non-material damage.
• The ruling allows claims based on the 'fear of the consequences' of a data breach, provided the fear is objectively well-founded.
• The Supreme Court will hear Equiniti's appeal on the threshold issue in October 2026.
• The Information Commissioner and Open Rights Group support the argument for no seriousness threshold.

Businesses in the UK could face a significant increase in data protection compensation claims if the Supreme Court upholds a recent Court of Appeal ruling that there is no minimum threshold of seriousness required for claims under the General Data Protection Regulation (GDPR).

In 2019, Equiniti, a pensions scheme administrator, mistakenly sent pension benefit statements for over 750 police officers to outdated addresses. These statements contained personal data and details of accrued pension benefits. Over 400 affected members subsequently filed claims for damages under GDPR, alleging distress.

The High Court had initially struck out most of these claims, stating that claimants could not prove the envelopes were opened by a third party, thus no "processing" of data occurred for GDPR purposes. However, fourteen claims were allowed to proceed on the basis that there was a reasonable prospect of proving the envelopes were opened.

In 2025, the Court of Appeal overturned parts of the High Court's decision. It ruled that a claim can be brought if personal data is mistakenly sent to a third party, and that proving the correspondence was actually opened is not a necessary element of "processing" under GDPR. The court also stated that compensation is available for an individual's "fear of the consequences" of a breach, provided this fear is objectively well-founded. Crucially, it found no de minimis "threshold of seriousness" below which a claim for non-material damage cannot be pursued, adhering to recent Court of Justice of the EU case law.

Equiniti has been granted permission to appeal to the Supreme Court on the sole issue of whether a minimum threshold of seriousness applies to damages claims under GDPR and the Data Protection Act 2018 in England and Wales. Arguments are scheduled for October 7 and 8, 2026. The Information Commissioner and the Open Rights Group have intervened in support of the argument that no such threshold exists.