432 police officers are suing over pension statements posted to old addresses. The catch: none of them has shown that anyone opened the envelope.
In early October the Supreme Court heard Farley v Paymaster (t/a Equiniti), a case brought by 432 police officers whose pension statements were posted to out-of-date addresses. The question is whether someone who has had their data mishandled can claim compensation without showing that the breach caused serious harm, or even that anyone read what was sent.
The Court of Appeal said no such threshold applies, and that a well-founded fear of misuse can be compensated. Whatever the Supreme Court decides, the ruling will change what organisations need to think about once a breach turns into a claim.
It will help decide whether reputation management after a breach is mainly about protecting trust, or whether it also means shaping the evidence in a claim.
What happened
In 2019, Equiniti, administering the Sussex Police pension scheme, posted over 750 benefit statements to out-of-date addresses after a database error. They showed dates of birth, National Insurance numbers, salaries and pension details. Around 475 officers sued for distress and, in some cases, psychiatric injury.
The High Court (Mr Justice Nicklin) let just 14 claims proceed in 2024, as the rest couldn’t show their letters had been opened. Of the rest, 432 appealed.
In August 2025, the Court of Appeal reversed this, holding that there is no seriousness threshold for non-financial harm and that well-founded fear is compensable.
The legal question, and the reputational one
The legal question is whether a threshold of seriousness applies under the UK GDPR and the Data Protection Act 2018. In other words, is minor upset enough to found a claim?
The reputational question follows from it: if fear can be compensated, how an organisation communicates after a breach affects not only how people feel, but potentially what they can claim.
The two sides
Equiniti calls the incident a trivial one-off, noting that over 90% of those affected ignored a free fraud-protection course. That may be a fair legal point, but telling police officers their concerns are trivial rarely lands well in public.
Notice, too, that the statistic only exists because of how Equiniti responded: post-breach conduct is already being used as evidence of whether fear was reasonable.
The officers point to systemic failings, including duplicate address records and outdated databases, and a story of systemic failure tends to outlast one about a single error.
What’s at stake
For reputation specialists, it’s about how breach work gets done: how early we’re brought in and how closely we work with counsel. A statement that alarms people can later be cited as evidence that their fear was reasonable, while one that downplays the breach, or says nothing at all, can look evasive and end up causing lasting reputational damage.
For organisations, it’s about volume: low-value privacy claims are surging, with AI tools reportedly making them easy to bring. ICO complaints rose from 42,300 in 2024/25 to over 76,700 in 2025/26.
For individuals, it’s about access to justice: if small harms can’t be compensated, accountability falls almost entirely to regulators.
Three potential outcomes
1. Outcome A
No threshold, but a firm filter on proof. Claimants must still prove real harm and show their fear is objectively justified. Trivial upset brings trivial damages, so few claims are worth bringing individually, but if they can’t be struck out at the outset, they are worth bundling. That means more group actions and a longer run in the headlines. “No evidence your data was accessed” stops working as a defence or a reassurance. Legal and communications teams will need to work together from the first hour: a tone that alarms people can encourage claims, while a tone that downplays the breach can look evasive.
2. Outcome B
A threshold applies. English law has long avoided compensating trivial harm, and Lord Leggatt, who wrote the leading judgment in Lloyd v Google, is on the panel. That said, Lloyd concerned the old 1998 Act and a representative claim, so the read-across is not automatic. Fewer claims would survive, but those that did would be the serious ones, with fuller facts and more press interest, so each would carry more reputational weight. And while calling a breach “trivial” may win in court, it can look dismissive to everyone else.
3. Outcome C
A middle path. A very low threshold, or trivial claims struck out case by case. This is the hardest to plan for. With no single playbook, conduct after the breach weighs more heavily, and a consistent, documented response matters most.
Prediction
Essentially Outcome A, with courts using case management to weed out the most trivial claims: no formal threshold, but proof strict enough to leave trivial claims worth little. A misdirected envelope may still found a claim, but if no one opened it, it shouldn’t be worth much. The key question becomes whether fear was reasonable, and an organisation’s own words go a long way towards answering it. That means legal and communications teams should agree the first statement together and keep a record of why it was worded as it was.
After a breach, your first statement may turn out to be your biggest reputational risk.
Written by Viktor Stasopoulos, Graduate Account Executive.