Emeklilik Bildirimindeki Veri İhlali Taleplerinin Elenmesi

EWHC-KBD 2024 383 [2024] EWHC 383 (KB) 0.26.10 dfbaf1036092ee02b5ba2d9fda375aff64e136b6009ebd125a23eadb0811b853 6.0.2

Neutral Citation Number: [2024] EWHC 383 (KB)

Case No: QB-2021-001497

QB-2022-002822

IN THE HIGH COURT OF JUSTICE

KING’S BENCH DIVISION

MEDIA & COMMUNICATIONS LIST

Royal Courts of Justice

Strand, London, WC2A 2LL

Date: 23 February 2024

Before :

THE HONOURABLE MR JUSTICE NICKLIN

- - - - - - - - - - - - - - - - - - - - -

Between :

(1) Michael Farley (formerly “CR”)

(2)-(474) Individuals identified in Annex 1 to the Claim Form

Claimants

- and -

Paymaster (1836) Limited

(trading as Equiniti)

Defendant

- - - - - - - - - - - - - - - - - - - - -

Oliver Campbell KC, Pepin Aslett and Alex Platts

(instructed by Keller Postman UK Limited ) for the Claimants

Andrew Sharland KC and Hannah Ready (instructed by Freeths LLP ) for the Defendant

Hearing dates: 27-28 February 2023

Further written submissions: 18/19 May 2023 and 1 June 2023

- - - - - - - - - - - - - - - - - - - - -

Approved Judgment

The Honourable Mr Justice Nicklin :

This judgment is divided into the following sections:

Section

Paragraphs

Parties and background

[2]–[12]

The original claims

[13]

The Anonymity Application

[14]–[24]

Statements of case

[25]–[42]

(1)

Particulars of Claim

[25]–[36]

(2)

Defence

[37]

(3)

[38]

(4)

Further Information of the claims and Individual Schedules

[39] – [42]

Further claims

[43]–[54]

Applications

[55]–[72]

(1)

Dismissal Application

[55]–[62]

(2)

Striking Out Application

[63]–[65]

(3)

Application by the Claimants in the Second Claim

[66]–[72]

Events following the hearing on 27-28 February 2023

[73]–[83]

(1)

Anonymity Order substantially discharged

[73]

(2)

Further Application and evidence in respect of derogations from open justice

[74]–[80]

(3)

Application to amend the MPoC in the First Claim to advance personal injury claims

[81]–[83]

Legal principles

[84]–[122]

(1)

Striking out

[84]–[86]

(2)

Summary judgment

[87]

(3)

Misuse of private information

[88]–[100]

(4)

Data protection

[101]–[110]

(a) ‘Damage’ in data protection cases

[102]–[103]

(b) Threshold of seriousness

[104]–[105]

[106]–[110]

(5)

Jameel abuse of process

[111]–[115]

(6)

Anonymity and derogations from open justice

[116]–[122]

Anonymity Application

[126]–[136]

(1)

Submissions

[126]–[128]

(a) Claimants

[126]–[127]

(b) Defendant

[128]

(2)

Decision

[129]–[136]

Dismissal Application

[137]–[165]

(1)

Submissions

[137]–[142]

(a) Defendant

[137]–[138]

(b) Claimants

[139]–[142]

(2)

Decision

[143]–[165]

Conclusion and next steps

[166]–[167]

A: Parties and background

In this action, the Claimants, over 400 current or former police officers of Sussex Police, bring claims for breach of the General Data Protection Regulation (“GDPR”) and/or Data Protection Act 2018 (“the DPA”) and/or misuse of private information. In August 2018, the pension function of Sussex Police was transferred to the Defendant who, from that date, has been the administrator of the pension scheme to which the Claimants belonged.

In late August 2019, the Defendant sent to each member of the scheme an annual pension benefit statement (“the ABS”). The ABS provided an overview of the relevant member’s accrued benefits under the pension scheme. The information contained in each ABS necessarily varied, officer by officer, but broadly it contained his/her name, date of birth, national insurance number, and details of the officer’s salary and pension details (the particular information the Claimants contend was included in the ABS is set out in [26] below). It would have been apparent to any third party reading the ABS, from the information it contained, that the intended recipient of the ABS was a police officer.

It is common ground that, unfortunately, the ABSs were sent to out-of-date addresses (i.e. an address that had previously been provided by the relevant officer as his/her address for correspondence, but which had become out of date). This error appears to have happened because of the way in which the relevant Claimant’s address details were stored and processed in the database used by the Defendant. A complaint made by the Claimants is that this was not the first time that ABSs had been sent to the wrong addresses. They say that there was another incident earlier in 2019.

The sending of the ABSs to out-of-date addresses was detected by the Defendant and notifications were sent to those affected in early October 2019. Each affected officer was offered the opportunity to sign up to CIFAS, a fraud protection service, the fees of which would be met by the Defendant. The Defendant’s evidence is that 37 people took up the offer to sign up with CIFAS (which represented around 5% of those who were affected by the ABSs being sent to the wrong address).

The potential data breach was also reported to the Information Commissioner (“the ICO”) but, on 17 October 2019, the ICO confirmed to Sussex Police that no further action needed to be taken. The reasons given by the ICO for its decision were as follows:

“- The breach was caused by your [Sussex Police’s] data processor [the Defendant]. You had notified them of the change of addresses and they failed to effectively update their systems.

- You have conducted a risk assessment and concluded that the risk of data subjects suffering significant consequences as a result of this incident is unlikely; the data disclosed is limited in nature and each data set has only been sent to one household, who can be identified.

- You have a contract with [the Defendant], which specifically states that all their staff should have received data protection training.

- You have undertaken to inform the data subjects and… have been provided with a link to the ICO’s advice regarding identity theft. This can be forwarded to those data subjects to help them take any action they regard as necessary to protect their identities…”

Nevertheless, in these proceedings, the Claimants contend that the sending of the ABS to an incorrect address was a breach of the relevant data protection legislation by the Defendant and/or misuse of their private information entitling them to compensation. The Claimants have taken no action against Sussex Police.

Following a letter of claim, dated 28 February 2020, the Defendant (in a letter dated 2 April 2020) admitted that there had been a data breach and that the Claimants were “ entitled to pursue [the Defendant] for loss, damage and/or distress allowable at law ”.

On 23 February 2021, the Claimants’ solicitors sent a letter to the Defendant’s solicitors proposing the issue of a single Claim Form for all the Claimants, a Master Particulars of Claim and the selection of “ test cases ”, albeit not as a representative action under CPR 19.6. Accompanying that letter was a Schedule identifying the “ damages sought ” for claims in misuse of private information and breach of data protection. Each claimant claimed damages of £2,000 for misuse of private information, and a range of £1,064.80 and £2,606.20 for the data protection claim. The basis used to calculate these figures (which, in respect of the data protection claim, were oddly precise) has not been explained.

10.

The Claimants’ solicitors’ position is that, individually, each claim is relatively ‘low value’ and that the cohort of claims “ need[s] to be pursued in a cost-effective and proportionate way ”. At the hearing, Mr Campbell KC estimated that the value of a typical claim (without a claim for personal injury) would be in the region of £1,250 to £1,500 (embracing both causes of action), representing a significant discounting of the figures provided with the letter of 23 February 2021.

11.

The Claimants’ pre-issue costs were around £1.2m. As a purely mathematical calculation, that equates to just over £2,500 per Claimant at the date of issue of the Claim Form. For most Claimants, therefore, even at the point of issuing the Claim (the very first step in the litigation) they had spent more in terms of costs than they hoped to achieve by way of an award of damages. Mr Campbell KC accepted that any individual Claimant, acting on his/her own, would have been expected to have brought that claim in the County Court and that the claim would almost certainly have been dealt with on the Small Claims Track. Nevertheless, he contends that the only practical way for the cohort of Claimants to obtain redress – and effective access to justice – was to pursue this claim on a class basis.

12.

As a result of directions given by the Court, the parties have provided to the Court broad information about their costs. For the Claimants, in October 2022, they had incurred costs of around £1.8m. At the date of the hearing that figure had risen to just short of £2m. The Claimants’ estimated budget for a trial of lead cases was £2.549m. The Defendant’s estimated budget for a trial of lead cases was £2.7m. The Claimants have also taken out ATE insurance. The claim for misuse of private information means that, if that claim is successful, they can seek to recover the premiums for the ATE insurance from the Defendant. At the hearing, Mr Campbell KC was quite candid that the potential to recover ATE premiums was an advantage to the Claimants in advancing a misuse of private information claim, which would not have been available had the Claimants pursued a claim solely for alleged breach of data protection.

B: The original claims

13.

The original Claim Form in QB-2021-001497 was filed on behalf of 474 Claimants on 22 April 2021 (“the First Claim”). 28 claims have been discontinued subsequently. As at the date of the filing of the Amended Claim Form, on 15 March 2023 (see [73] below), there were 446 active Claimants. The Claimants:

“… claim damages for breach of statutory duty pursuant to the General Data Protection Regulation and the Data Protection Act 2018 and/or misuse of private information arising from the Defendant’s failures to keep the Claimants’ personal data and private information (including financial pension information) secure by posting the same to incorrect postal addresses. The Claimants bring claims for financial and non-financial loss and damage in sums to be assessed.”

C: The Anonymity Application

14.

On 25 March 2021, prior to the issue of the First Claim Form, the Claimants’ solicitors issued an Application Notice seeking orders that all the Claimants be anonymised and that their addresses should be withheld and, on the Claim Form, replaced with the address of their solicitors (“the Anonymity Application”). The Application Notice provided the following as justification for the orders sought:

“(a)

The Claimants are 474 serving police officers who are bringing claims following a data protection breach and misuse of their private information relating to sensitive financial information concerning their pension benefits.

(b)

Some of the Claimants are high ranking officers and others work in sensitive areas of policing.”

15.

A witness statement from Kingsley Hayes, a solicitor in the firm of Keller Lenkner, the Claimants’ solicitors, was provided in support of the Anonymity Application, dated 25 March 2021. Mr Hayes explained the background to the Claim and how, in August 2019, ABSs were sent to out-of-date addresses. As to the justification for the orders for anonymity of the Claimants and the withholding of their addresses, Mr Hayes stated:

“17.

The Claimants, being serving police officers are fearful on a number of fronts if their names and/or personal residential addresses are put into the public domain, in the sense that a third party may be able to interrogate the court file and obtain that information.

18.

The Claimants are serving police officers who range from the rank of Police Constable through Sergeant, Inspector, Chief Inspector and Superintendent. Some of the Claimants are thus very high ranking officers. Further, some of these officers work in a range of sensitive areas with higher levels of security and vetting. These areas include firearms, counter-terrorism, intelligence, public protection, safeguarding and child protection.

19.

As police officers, all Claimants, but particularly those of higher ranks and in these sensitive areas feel that they legitimately need to protect both their identity as having been involved in a data breach concerning their sensitive financial information, and their true address details.

20.

The latter point is of obvious relevance and concern to all police officers as their private residential address ought not to be available in the public domain at all having regard to their job and function. Therefore, there is a risk that suspects, associates, victims of crime, witnesses or others involved with the relevant officer may obtain their home address. The Claimants’ knowledge that this may happen adds to their anxiety and fear for their safety.

21.

Further, it is likely that when the claim is issued at court, there may be some press interest and that could lead to the Claimants’ names and their addresses being made available to non-parties who conduct a search of the court file. This is likely to lead to reports that certain named officers have been the subject of a data leak.

22.

Importantly, bearing in mind that there are certain categories of personal data as set out … above which may be in the hands of third parties already, it is entirely conceivable that much in the same way as wrongdoers may seek to “phish” for information from victims, those wrongdoers may obtain a further piece of the jigsaw by obtaining full names, middle names, initials or true home addresses of the Claimants as contained on the court file.”

16.

On 7 April 2021, having considered the Claimants’ evidence, but without a hearing, the Master made an order granting anonymity to all 474 Claimants and permitting them to issue the First Claim Form withholding their names (to be replaced by ciphers) and giving, as their address, the address of their solicitors (“the Anonymity Order”). Without the permission of the Court, the Anonymity Order prevented non-parties from obtaining a copy of the Claim Form which recorded the Claimants’ names and addresses. A liberty to apply was included to vary or discharge the Anonymity Order.

17.

A complaint made by the Defendant is that when the Claim Form and anonymised Particulars of Claim were served, on 23 April 2021, there was no way to identify the Claimants. It was not until 14 May 2021 that the Claimants provided a schedule that identified the Claimants. It was not until 12 May 2021 that the Claimants’ solicitors provided the Application Notice and witness statement in support of the Anonymity Application.

18.

On 14 December 2022, without a hearing, I made an Order that the Court would reconsider the Anonymity Order at a hearing that had been fixed for 27-28 February 2023. I directed that if the Claimants (or any of them) contended that they should continue to be anonymised, then they must file and serve any further evidence in support by 4.30pm on 20 January 2023. The Defendant was given until 3 February 2023 to serve any evidence in response. The Order explained my reasons as follows:

“Anonymity orders are derogations from open justice which must be strictly justified. Although, on the evidence available, I consider that the Claimants may well succeed in demonstrating that there remain cogent grounds for withholding their addresses, the Court will want to look again at the justification, and evidence in support, for withholding the Claimants’ names. In this respect, attention is drawn to Various Claimants -v- Independent Parliamentary Standards Authority [2022] EMLR 4 . Some Claimants may have a stronger justification for anonymity than others, and the evidence may vary between the Claimants. ”

19.

On behalf of the Claimants, Kingsley Hayes filed a witness statement dated 20 January 2023. He explained that the Claimants solicitors had reconsidered the issue of anonymity with the Claimants. As a result, the vast majority of Claimants were likely to be content to withdraw their application to be anonymised (although they maintained the application to withhold their addresses from Court documents open to public inspection). Mr Hayes explained that time was needed to take instructions from all the Claimants on the issue of anonymity.

20.

As to the Claimants’ addresses, Mr Hayes referred to (and exhibited) guidance from the Association of Chief Police Officers, which recommended that police officers should not post their home addresses on the internet or on social media. He added:

“All, or certainly a great majority of the Claimants, regard their addresses as being confidential. If a claim form with names and addresses were made public this could provide any member of the public with a list of over 400 police officers and their addresses. … [Many] of the officers work in sensitive areas of policing and some are senior officers. Such a list could be put to nefarious use.

Making the addresses of the Claimants public would necessarily give rise to a troubling risk of harm both for the Claimants, and for their families. This is in the context of increasing anti-police sentiment, and violence against police officers.

Having spoken with officers in counterterrorism roles, we also understand that the publication of the addresses of the Claimants may well give rise to a terrorism risk. As we understand, credible intelligence has been disseminated to law enforcement that extremist groups have actively used information about police officers to plot terror attacks. The officers we have spoken with are unable to provide any further details due to issues of security and sensitivity.

The publication of the Claimants’ addresses would cause distress to many of the Claimants. Several Claimants have made clear that they would wish to discontinue their claims if their addresses are to be made public.

In addition, publication would risk aggravating the condition of those with pre-existing psychological conditions. We have served medical reports on behalf of over 30 Claimants evidencing a psychological injury as a result of the Defendant’s breach. Those reports will be made available to the Court for consideration in advance of the hearing on 27 and 28 February.

I would suggest that the real risk of the Claimants being physically targeted, in addition to distress they – and their families – would be caused, poses a strong moral argument in favour of the Court withholding the addresses of the Claimants.

21.

Mr Hayes then provided specific information, in relation to several Claimants, as to their particular concerns as to why their address should not be available through public inspection of the records of the Court relating to the Claims.

22.

On 31 January 2023, the Claimants’ solicitors filed witness statements from the following Claimants who sought to maintain the order for anonymity that they had been granted.

(1)

Officer A had been a police officer since 2009. S/he is an Armed Response Officer. Officer A’s identity has protected within the police for the last six years and s/he operates under a general pseudonym number. The officer has no collar number shown on his/her uniform. If Officer A is required to give evidence, s/he is assigned a specific pseudonym and s/he gives evidence from behind a screen.

(2)

Officer B was formerly also an Armed Response Officer, but is now working in covert policing. S/he targets high level criminality, including highly resourced organised crime groups. Like Officer A, if required to give evidence s/he does so using a pseudonym and from behind a screen. His/her covert work is likely to mean that s/he will be issued with a false identity. Vehicles used by Officer B are registered to PO boxes.

(3)

Officer C works as a covert intelligence source handler. S/he states that everything about his/her identity is unknown at a public level and there are enhanced safeguarding measures in place to protect his/her identity. Officer C operates under a pseudonym and his/her vehicle registrations details are protected.

(4)

Officer D works in an exclusively covert unit in the police engaged in source handling. S/he is responsible for managing covert human intelligence sources, a role s/he has held for 8 years. Officer D targets serious and organised crime groups and his/her identity is protected through the use of a pseudonym and car registration details are redacted.

(5)

Officer E is a Counter Terrorist Specialist Firearms Officer. This is a covert policing role that Officer E has held since 2017. S/he works with the National Crime Agency, and in liaison with MI5, MI6 and specialist military forces (such as SAS). Officer E’s work includes infiltration of suspected terrorist activities and surveillance on convicted terrorists on their release from prison. Officer E states that his/her anonymity is of the utmost importance in the roles s/he carries out and to national security.

(6)

Officer F works in a covert unit engaged in surveillance targeting organised crime groups and significant drug traffickers. S/he has been operating undercover for 9 years. Officer F also works under a pseudonym and enhanced measures are in place to prevent him/her from being identified as a police officer. His/her vehicle’s registration details are redacted and s/he has been issued with a credit card in a false identity.

(7)

Officer G is another officer who works in a surveillance unit targeting organised crime. S/he has operated under a pseudonym for the last 5 years. S/he has a credit card in a false name for use in connection with his/her undercover work and his/her car registration details are redacted.

(8)

Officer H works as an intelligence development officer. There is a covert element to his/her role which involves targeting organised crime groups. Officer H is engaged in surveillance and depends upon not being identified as a police officer. S/he has a pseudonym and enjoys similar protections to other covert officers in terms of credit cards in false names and redacted vehicle registration numbers.

(9)

Officer I has worked in intelligence since 2005. S/he primarily undertakes surveillance. S/he operates under a pseudonym and if s/he gives evidence in Court, the pseudonym is used, and Officer I gives evidence from behind a screen. His/her identity is protected both within and outside the police.

23.

William Richmond-Coggan filed a witness statement, dated 3 February 2023, in relation to the Anonymity Application. He made several complaints about the lack of notice given to the Defendant of the original Anonymity Application and delays in receiving the evidence in support of the application and the schedule identifying the Claimants. Mr Richmond-Coggan drew attention to the fact that, in Kingsley Hayes’ witness statement of 25 March 2021, in support of the Anonymity Application, he stated that, “ the Application is brought by the 474 individuals listed… who have provided instructions to [the Claimants’ solicitors] to bring a claim against the Defendant and make this application ” (emphasis provided by Mr Richmond-Coggan). This, he contrasted with Mr Hayes’ statement, of 20 January 2023, in which he stated that his firm had only “ identified a sample of officers who we directly spoke with ” and that he had taken “ targeted instructions ”. Mr Richmond-Coggan suggested that this reference to instructions only having been taken from a sample of Claimants should be viewed in the context of the costs budgets filed by the Claimants. Those showed that the Claimants had incurred pre-action costs of £1,180,600 with a further £263,749 for preparing and issuing statements of case, and £120,042 for witness statements. These costs exclude VAT and disbursements, including Counsel’s fees.

24.

More generally, Mr Richmond-Coggan stated that the Defendant “ continues to have concerns about the quality of the evidence being tendered in support of anonymity, including over it being minimal, generic and not directly from the Claimants themselves ”.

D: Statements of Case

(1)

Particulars of Claim

25.

With the First Claim Form, the Claimants filed what were called “ Master Particulars of Claim ” which set out “ the common or generic claims made by the Claimants against the Defendant ” (“the MPoC”).

26.

The MPoC contended that each Claimant’s ABS contained the following information (“the Private Information”): (1) name; (2) date of birth; (3) national insurance number; (4) start date in service; (5) salary banding; (6) part time hours worked; (7) police service details; (8) value of final salary benefits; (9) average pensionable pay; (10) annual pension payable; (11) projected pension benefits including lump sum and residual annual pension; (12) death in service benefits; (13) Police Pension Scheme member reference number; and (14) Equiniti account number.

27.

The Claimants contend that each of these pieces of Private Information is:

(1)

their personal data within the terms of Article 4(1) GDPR and s.3(5) DPA; and/or

(2)

private and confidential information in respect of which they have a reasonable expectation of privacy.

28.

For the purposes of the DPA, the Claimants contend that the Defendant is a data controller rather than data processor.

29.

Although the Claimants pursue other alleged breaches of the data protection legislation, arising from the way in which their addresses were processed by the Defendant, the principal complaint of each Claimant is about the sending of the ABSs to an out-of-date address in August 2019. This is alleged to amount to unlawful processing (“Unlawful Processing”). It is this Unlawful Processing that is alleged to have caused the Claimants non-material harm. Each Claimant alleges that the “ mis-addressing ” of the ABS and sending it through the postal system to “ unknown third parties ” constituted “ a serious unjustified infringement and intrusion into each Claimant’s right to privacy ” and/or a misuse of private information.

30.

The misuse of private information claim is advanced by the Claimants in the following terms:

“11.1

The combination of the Defendants acts in (a) wrongfully mis-addressing each ABS containing the Private Information; and (b) sending each ABS through the postal service to unknown third parties constituted a serious unjustified infringement and intrusion into each Claimant’s right to privacy and/or a misuse of the Private Information as related to each Claimant

PARTICULARS

(a)

The Defendant knew that the Private Information was private and confidential and within the scope of each Claimant’s rights under Article 8 of the European Convention on Human Rights.

(b)

The Defendant disclosed the Private Information to unknown third parties, being person the Defendant knew the Claimants would not wish to have access to the Personal Information.

(c)

Each Claimant did not consent to the use of the Private Information by it being sent through the postal service to known and/or unknown third parties.

(d)

The Defendant allowed a situation to arise whereby the Claimant each lost control and autonomy over the Private Information.

11.2

Further, or in the alternative, each Claimant held a reasonable expectation that the ABS would be sent from the Defendant to him/her.

11.3

As a person in control of the Correspondence, the Defendant’s act of mis-addressing each ABS containing the Private Information and sending the Correspondence to unknown third parties, constituted a serious unjustified infringement of each Claimant’s right to respect for their correspondence. The Claimants repeat the particulars provided in the preceding sub-paragraph.”

31.

In terms of loss and/or damage, each Claimant claimed to have suffered damage caused by the alleged “ infringements ”. This damage was identified as:

(1)

“ anxiety, alarm, distress and embarrassment by the fact that the Personal Data has passed and/or may have passed into the hands of unknown third parties ”; and

(2)

“ as soon as each ABS was put into the postal service bearing the wrong address, the Claimants each suffered an immediate loss of control and/or autonomy and/or diminution in the Personal Data, including having regard to their right to determine how any Personal Data should be used, with whom it should be shared, where it is made available and when it should no longer be made available ”.

32.

The MPoC stated that the Claimants intended to provide “ Heads of Damage ” for each Claimant. As the Defendant has complained, no application had been made to disapply CPR PD 53B §2.2 which required the Claimants to provide particulars of their claim for damages (see [85] below).

33.

The particulars of damage and distress provided in the MPoC, in respect of the data protection claim, included the following:

“(a)

The Claimants have been caused anxiety, alarm, distress and embarrassment by the fact that the Personal Data has passed and/or may have passed into the hands of unknown third parties.

(b)

As a result, each of the Claimants seek (sic) compensation for moral and/or non-material damage.

(c)

Further, as soon as each ABS was put into the postal service bearing the wrong address, the Claimants each suffered an immediate loss of control and/or autonomy and/or a diminution in the Personal Data, including having regard to their right to determine how any Personal Data should be used, with whom it should be shared, where it is made available and when it should no longer be made available.

(d)

… unless the Defendant can provide any ABS which was physically returned unopened to the Defendant as sender, the Claimants infer that the (sic) each envelope was opened and read by an unknown third party…

(e)

The Claimants each seek as a discrete head of loss, the loss of autonomy and/or control over their ABS and the consequential distress as a result of the same. For the avoidance of doubt, all Claimants seek compensation in this regard even where it may be shown that an ABS was returned, on the basis that there was a loss of control and/or autonomy for the period between posting and physical return…

The Claimants claimed for damage and distress for similar “ loss of control and/or autonomy ” in respect of the misuse of private information claim.

34.

No particulars were provided to support the inference, pleaded in sub-paragraph (d), that mis-addressed ABSs would be opened and read by unknown third parties.

35.

Finally, the MPoC contained an apparent claim for personal injury for some of the Claimants who it was alleged had “ suffered an aggravation of pre-existing medical conditions ” and in respect of whom a further award of general damages was sought.

36.

The MPoC were filed before the decision in Lloyd -v- Google LLC [2022] AC 1217 . Mr Campbell KC confirmed, at the hearing, that, following the decision of the Supreme Court, the Claimants were not pursuing a claim for damages for ‘loss of control’.

(2)

Defence

37.

The Defendant’s Defence was filed on 9 July 2021.

(1)

The Defendant admitted that it had sent the Claimants’ ABSs to out-of-date addresses, and gave its explanation for how that error had occurred.

(2)

The Defendant admitted that each ABS contained some Private Information of the relevant Claimant. However, seven different versions of the ABS had been sent out, depending on the individual circumstances of the individual Claimant, so it was not the case that all Private Information was included in every ABS. No Equiniti account number was included in an ABS.

(3)

The Defendant contended that each envelope was addressed to the relevant Claimant and marked “ Private and Confidential ” and provided a return address.

(4)

At the date of the Defence, 102 ABSs had been returned to the Defendant unopened and a further 19, had been forwarded to the relevant Claimant unopened. The Defendant has sought information from the Claimants’ solicitors as to the number of Claimants who had a mail redirection service in operation.

(5)

The Defendant denied that mere handling of an unopened opaque envelope could constitute misuse (or conceivably give rise to any actionable damage) whether for misuse of private information (or under data protection law), having regard particularly to the threshold of seriousness for both causes of action.

(6)

More generally, the Defendant denied the inferential case that any ABS had been opened by an unidentified third party. In each case, the ABS had been sent to an address at which the relevant Claimant had previously lived.

(7)

In relation to the misuse of private information claim, the Defendant denied:

that each Claimant had a reasonable expectation of privacy in the Private Information (for example his/her name or the fact that s/he was a police officer);

that placing a piece of information, even if private, “ at risk of being viewed by unknown third parties ” would constitute actionable misuse;

that, subject to the outcome of the appeal to the Supreme Court in Lloyd -v- Google , the Claimants could advance any claim to “ loss of control ” damages; and

that, in any event, any of the Claimants had not demonstrated that they had actually suffered “ loss of control ” of the Personal Information, much of which would have been available in the public domain in any event.

(8)

Further, in relation to the data protection claim, the Defendant:

denied that it was the data controller; and relied upon the agreement it had in place with Sussex Police under which the Defendant was identified as a data processor on behalf of Sussex Police, which was the data controller; and

admitted the various acts of alleged processing, including the sending of each ABS to an out-of-date address; this had been a mistake on the part of the Defendant which was “ one-off and non-deliberate ”.

(3)

38.

In a Reply, dated 24 August 2021, the Claimants:

(1)

stated that they did not know what had happened to all the ABSs but alleged that they had been “ put at significant risk of being opened and read by unknown third party recipients ” and maintained that each Claimant had a claim for damages even if the relevant Claimant had ultimately received his/her ABS;

(2)

contended that it was for the Defendant to prove that each ABS was not opened and read by unintended and unknown third-party recipients; and

(3)

contended that the damage caused to each of them was not “ trivial ”, but no further information was provided of the damage suffered by each Claimant.

(4)

Further Information of the claims and Individual Schedules

39.

The Defendant made a Part 18 Request for Further Information on 9 March 2022. Following an application by the Defendant, on 27 April 2022, each Claimant was ordered to provide further information about his/her case, including providing details of his/her case on the loss and/or damage claimed. That was achieved by each Claimant being required to answer a series of questions. In response, by the end of July 2022, each Claimant filed a Schedule setting out specific information relating to his/her claim that was verified by a statement of truth (“the Individual Schedules”).

40.

Although the amount of detail provided varied, each Individual Schedule sets out the relevant Claimant’s claim on whether s/he:

(1)

ultimately received the ABS;

(2)

was advised that the ABS had been returned to the Defendant or Sussex Police;

(3)

suffered any annoyance and/or distress and/or anxiety;

(4)

has a medical condition caused (or exacerbated) by the mis-addressed ABS;

(5)

suffered any other loss or damage; and/or

(6)

is aware of any (mis)use of his/her personal data/private information or any other events linked to the mis-addressed ABS.

41.

By way of example, the Individual Schedule filed on behalf of the First Claimant:

(1)

stated that he had not received the ABS and had been notified by Sussex Police, on 4 October 2019, that the ABS had not been returned to the police or to the Defendant;

(2)

contained details of the First Claimant’s “ annoyance… distress and/or anxiety ” caused by the mis-addressing of the ABS, including the following:

“The Claimant has suffered and continues to suffer distress. The Claimant works in a highly sensitive area of policing… The Claimant has always been rigorous in his measures to ensure that he keeps his work life and private life separate. Only trusted friends and family members know the nature of his employment.

The ABS was posted to an address at which the Claimant had not lived for at least 10 years. That address is in the same neighbourhood in which the Claimant continues to life and the Claimant does not disclose the nature of his employment to his neighbours…

The Claimant felt compromised and vulnerable knowing that a document containing sensitive information about him, and the nature of his employment, had been sent to an address in his neighbourhood and that there was no knowing who now had that information and what they might do with it…

The Claimant was distressed about the potential consequences of the information falling into the hands ot someone on the other side of the law…

The Claimant was distressed because his family might be at risk…

The Claimant considers these risks to be remote, but it is precisely the type of risk that officers … are trained to identify and mitigate against yet, through no fault of the Claimant, the risks were live and real due to the breach…

The Claimant suffered and continues to suffer anxiety for the reasons explained… and with regard to the potential for other misuse of the data that was not protected such as the information being used to open bank accounts, apply for jobs or credit cards in the Claimant’s name…

The Claimant can see no end to the annoyance, distress and anxiety that he suffers as the data that was not protected is not going to change and might be misused at any time.”

42.

In this judgment, it is not necessary to analyse each of the Individual Schedules. Some common themes emerge; for example, the fear that the relevant Claimant would be a victim of identity theft. The evidence filed by the Claimants has not demonstrated that the apprehended risk of identity theft has materialised. Some of the Claimants have, in their Individual Schedules, raised concerns over receipt of spam emails or suspicious financial transactions, but given that neither email nor financial information was contained in the ABS, it is difficult to see how that could be attributed to any misuse of information from the ABS by a third party. Substantially, the claim for each Claimant is very much put on the distress/anxiety caused by the apprehension that s/he might be a victim of identity theft.

E: Further claims

43.

On 25 July 2022, the Claimants’ solicitors wrote to the Defendant’s solicitors to advise that:

“… during the course of [the] exercise [to provided the Individual Schedules], it has become apparent that approximately 75 Claimants (“the Medical Claimants”) require a medical examination by a psychologist. The data breach has caused the Medical Claimants to suffer to the extent that warrants the referral to a medical expert. We are in the process of making the necessary referral to experts for the Medical Claimants and will be in receipt of CPR Part 35 compliant medical reports in due course.”

The Claimants’ solicitors stated that, by their calculations, the limitation period for any personal injury claims, would expire on 30 August 2022. They sought the Defendant’s agreement to a standstill agreement in respect of these further personal injury claims.

44.

On 5 August 2022, the proposal of a standstill agreement was rejected by the Defendant’s solicitors.

45.

On 8 August 2022, the Claimants’ solicitors wrote again to the Defendant’s solicitors. The letter included the following, under the heading “ Medical Claimants ”:

“You are no doubt aware that the Claimants have sought to manage this claim at proportionate cost throughout. The Claimants’ stated intention throughout has been to have these claims managed by way of a mechanism akin to group litigation. We have maintained this to be the most proportionate way of managing the claim as a whole. To that end elements of individual work were deliberately restricted so as to keep costs to a minimum and to provide you with the necessary claim information in the form of Schedule of Information (“SOI”). This wouldn’t have required a deep dive, and the associated cost, into detailed distress and medical information for each Claimant.

However, your client has disagreed with the Claimants’ proposed mechanism throughout this claim. You sought individually particularised statements of case for each and every Claimant in this action and that is what the Master ordered. As part of that costly exercise, we have had to take full and complete instructions in order to answer the questions set by the Master, at your behest. Full and complete instructions from every Claimant have been taken. As a result of that exercise, it is clear that there is (sic) significant levels of aggravation amongst the Claimant cohort and must now be investigated.

The exercise that you have requested throughout this litigation has been completed and it has escalated costs and potentially damages significantly. You cannot reasonably now complain that these instructions should have been taken at the start of the claim when you do not like the results of your client’s own submissions. Essentially, your client has made its bed and now it must lie in it.

Contrary to your point that we are only now asserting personal injury claims, we would ask you to re-read the Claimants’ letter of claim dated 28 February 2020 in which it was stated... that ‘… it may be appropriate in certain individuals’ cases to consider the psychological and psychiatric impact of the personal data breach’. Further, in … the Master Particulars of Claim it was stated that ‘Further, certain of the Claimants have suffered an aggravation of pre-existing medical conditions and seek general damages as a result.’

Arguably, those Claimants now advancing ‘medical claims’ fall under that paragraph. However, it is only out of an abundance of caution and in circumstances where you may seek to argue otherwise and take a limitation point that we had hoped that the parties could co-operate in agreeing a standstill agreement. Such a course would further the parties’ obligations to co-operate with each other, save costs and be in accordance with the overriding objective. However if, as it seems, you wish to take the point, we will have to act accordingly in order to protect the Claimants’ position…

We will now start work to prepare to issue a further claim form for the medical Claimants with the associated cost of the Court fee…”

In a further letter, dated 19 August 2022, the Claimants’ solicitors indicated that they intended to issue a protective Claim Form for the Medical Claimants (as previously described) “ shortly ”.

46.

On 31 August 2022, a sub-set of 63 Claimants in the First Claim issued a further Claim Form seeking damages for personal injury alleged to have been occasioned by the sending of the ABS to the wrong address (“the Second Claim”). No application was made to amend the existing MPoC or Individual Schedules. This Claim Form in the Second Claim was issued, as the Claimants’ solicitors had indicated in correspondence, to protect the relevant Claimant from any arguable defence of limitation that might be raised. Before service of the Claim Form, by amendment, the number of Claimants in the Second Claim was reduced to 42 (see [50] below).

47.

On 10 October 2022, the Defendant’s solicitors sought confirmation whether a further claim had been issued, as threatened by the Claimants. The Claimants’ solicitors did not tell the Defendant’s solicitors that the Second Claim had been issued. That failure has not properly been explained by the Claimants.

48.

By Application Notice dated 6 September 2022, the Claimants in the Second Claim applied for, and by Order dated 21 December 2022, were granted by the Master an anonymity order in similar terms to that granted in the First Claim (“the Second Anonymity Order”). That Application was made without notice to the Defendant.

49.

On 21 December 2022, the Claimants’ solicitors wrote to the Defendant indicating that the deadline for service of the Claim Form in the Second Claim was 30 December 2022. This was the first that the Defendant knew of the Second Claim. The letter stated that the Claimants “ [did] not propose to seek an extension for service of the [Claim Form in the Second Claim] but would be grateful if you could confirm whether you are amenable to an extension of time for service of the supporting medical evidence ”. The Defendant’s solicitors refused that request.

50.

The Claimants’ solicitors purported to serve the Claim Form by email on 30 December 2022. In doing so, they relied upon a prior indication by the Defendant’s solicitors, in a letter dated 11 March 2021, that they were authorised to accept service of the proceedings, and would accept service by email providing certain conditions were met. Before it was served, the Claim Form was amended to remove several Claimants, leaving the Second Claim being pursued by 42 Claimants. The Claim Form in the Second Claim was accompanied by medical reports for some, but not all, of the remaining Claimants. The Claim Form indicated that Particulars of Claim in the Second Claim were “ to follow ”.

51.

By email, at 12.29 on 30 December 2022, after purported service of the Claim Form in the Second Claim, the Defendant’s solicitors advised the Claimants’ solicitors that they did not accept service of the Claim Form in the Second Claim by email. Also, on 30 December 2022, the Claimants in the Second Claim issued an Application Notice seeking an extension of time for the service of medical evidence for the remaining Claimants. This Application did not include an application for an extension of time for service of Particulars of Claim. Under CPR 7.4(2), Particulars of Claim must be served on a defendant no later than the latest time for serving a Claim Form (i.e. 30 December 2022).

52.

“Draft” Master Particulars of Claim in the Second Claim, dated 17 January 2023, were apparently provided to the Defendant on 6 February 2023. By 16 February 2023, medical reports for all Claimants in the Second Claim had been served. The Claimants in the Second Claim subsequently made an Application for an extension of time for service of the Particulars of Claim (see [66] below).

53.

This statement of case in the Second Claim largely repeated the claims made in the First Claim, but also expressly adopted a claim for personal injury alleged to have been caused by the alleged breach of data protection/misuse of private information. Brief details of the alleged psychological injury claim of each Claimant were included in a Schedule attached to the Master Particulars of Claim, which also identified the medical report from a clinical psychologist relied upon by each Claimant.

54.

Again, taking an example of one of the expert reports filed in support of a claim for personal injury, the 48 th Claimant (Scott Walters) has relied upon a report from Dr Rosalie Hughes, Consultant Clinical Psychologist, dated 30 November 2022. Dr Hughes states that, in her opinion, the data breach had caused exacerbations of pre-existing psychological symptoms.

F: Application for summary judgment/striking out

(1)

Dismissal Application

55.

On 17 October 2022, the Defendant issued an Application Notice seeking to strike out the Claimants’ claims and/or for summary judgment (“the Dismissal Application”). The Dismissal Application was released to be heard by a Judge of the Media & Communications List, on 9 November 2022, and fixed for hearing on 27-28 February 2023.

56.

The grounds of the Dismissal Application were as follows:

(1)

In relation to the data protection claims:

damages cannot be awarded for ‘loss of control’ of data without proof of material damage or distress; and

in respect of some of the claims, no pleaded case of actionable damage having been suffered has been advanced.

(2)

In relation to the claims for misuse of private information there was no misuse or misuse for which the Defendant could be liable.

(3)

In relation to the claims generally:

the Claimants had not suffered damage or distress above a de minimis level or such as to cross the applicable level of seriousness; and/or

the claims constitute an abuse of the court’s process under the principles established in Jameel -v- Dow Jones & Co Inc [2005] QB 946 .

57.

The Dismissal Application was supported by witness statements, on behalf of the Defendant, from William Richmond-Coggan and Adam Green, both dated 17 October 2022. In answer, the Claimants have filed a witness statement from Kingsley Hayes, dated 9 December 2022. Exhibited to Mr Hayes’ statement were separate statements from eight Claimants. In response, the Defendant filed a further witness statement from Mr Richmond-Coggan, dated 13 January 2023.

58.

As part of the evidence filed by the Defendant, examples of the envelope in which the ABSs were sent have been provided together with specimen letters. From an unopened letter, all that could have been seen would have been, through the window of the envelope, the name of the addressee together with the out-of-date address and, printed on the outside of the envelope, the words “ Private and Confidential ” and a return address of the Defendant. Scrutiny of an unopened envelope would give no indication that an intended recipient was a police officer. Mr Sharland KC submitted that the only piece of information visible from an unopened letter, that the Claimants contend is private and/or personal data, is the relevant Claimant’s name. He argues that this is de minimis and incapable of supporting a claim for misuse of private information and/or data protection.

59.

In the few cases, where the relevant Claimant has positive evidence that the ABS was opened, Mr Sharland KC submits that the initial pages of the letter included no personal information beyond the name of the intended recipient and his/her reference number. By way of example, the first page of the ABS contained the following:

“ SUSSEX POLICE PENSION ANNUAL BENEFIT STATEMENT

A Benefit Statement is attached showing the details that we hold about you and the pension benefits you are accruing under the Police Pension as at [date]. If the information we hold about you is wrong, this could affect the way we calculate your pension when you come to claim it.

Action for You

Please read the enclosed notes and check carefully that the details on the Benefit Statement are correct as far as you can tell. You need to:

•

tell us of any mistakes ; please send an email to us at the above address. Revised Benefit Statements will not be issued to reflect amendments to address, National Insurance number, title, marital status or spelling errors. These amendments will be reflected in your next Annual Benefit Statement. Where it is necessary to re-issue a statement we will endeavour to send this to you within 8 weeks of your email.

•

ask us if you are unsure about any of the details ; experience has shown that it is better to put things right now rather than waiting until retirement. If you have any queries or are not sure about what some of the details contained on the Benefit Statement mean, please contact us using the above email address;

•

keep the Benefit Statement ; including any details or comments that you have made on it or have attached to it until you reach retirement (or leave the Scheme).

Action for us

As pension scheme administrators, we want to maintain your records properly and ensure that we calculate your pension correctly. If you find any errors in the Benefit Statement, we will correct them. We will send you a Benefit Statement annually so that you can see how your pension benefits are growing and to check the details we hold.”

The detailed pension information, which contained the bulk of the information in respect of which the Claimants maintain a claim for misuse of private information and/or data protection was found in an enclosure. Mr Sharland KC argued that a person, who opened the ABS by mistake, would have immediately appreciated (a) the broad nature of the document before s/he reached any of the personal data of the relevant Claimant, and, more importantly (b) that it was not meant for him/her.

60.

Based on the evidence filed for the hearing, in his skeleton argument, Mr Sharland KC provided the following summary of the claims:

(1)

101 of the ABSs were returned to the Defendant unopened (Mr Campbell KC suggested that the correct figure was 99), with confirmation being provided of the return to the officer concerned either by direct communication or via the relevant Claimant’s solicitor.

(2)

74 of the ABSs were successfully retrieved by the relevant Claimant.

(3)

1 Claimant believed, but is not certain, that he received the ABS, unopened, at his home address.

(4)

1 Claimant states that he received his ABS which, to the best of his knowledge, had been reposted to him at his correct address.

(5)

Only 14 Claimants pleaded a positive case – beyond the purely inferential case (see [33] above) – that the envelope containing his/her ABS was opened by a third party. Of those 14 instances,

in each case, the ABS was handed back to the relevant Claimant;

in 11 cases, the ABS is said to have been opened by a relative before being passed on to the relevant Claimant;

in 1 case the ABS is said to have been received by another police officer; and

in 2 cases, it is alleged that the ABS was opened or read by someone other than a family member or colleague.

61.

As noted already, the majority of the Claimants have relied on an inferential case that their ABS was opened (and read) by a third party (see [33]-[34 above). It is necessary to look more closely at the claims of the 14 Claimants who have advanced a positive case that their ABS was opened (and read) by a third party. Those are the claims bought by the 14 th , 75 th , 109 th , 111 th , 155 th , 200 th , 247 th , 253 rd , 258 th , 307 th , 342 nd , 359 th , 386 th and 472 nd Claimants. The information provided in the Individual Schedules for these Claimants includes the following:

(1)

14 th Claimant (Tim Rush): Mr Rush received the mis-posted ABS in December 2019. It had been opened. The address to which the ABS was sent was that of the his estranged parents. Mr Rush complains that it was of “ major concern ” that the personal information in the ABS should have been seen by his parents and possibly other family members. He suffered anxiety and also feared misuse of the personal information in the ABS, although he was not aware of (and did not allege) any further misuse. No other claim for loss or damage.

(2)

75 th Claimant (Samantha Kembery): Ms Kembery’s ABS was posted to her mother’s address and opened by her brother, who has the same first initial and surname as the Claimant. It was then returned to Ms Kembery by the her mother. Ms Kembery states that she suffered distress. At the time of the ABS being sent to the wrong address, she was not on good terms with her brother. She was concerned and worried about potential misuse her personal information, such as opening financial accounts or obtaining personal loans. Ms Kembery stated that she was anxious about ongoing potential misuse of her personal information. Although she did not anticipate this had happened, there was nothing to stop her brother from copying her private information for future use. She took steps to change the passwords for online accounts. Ms Kembery claims for general distress and for exacerbation of symptoms of post-natal depression. She is unaware of any further unauthorised use of her information.

(3)

109 th Claimant (Gemma Holley): Ms Holley’s ABS was sent to her parents’ address and was opened by her mother. She states that she would “ very much have preferred not to be placed in that position ”. Although she had a good relationship with her parents, she would not have chosen to share confidential information regarding “ her pension, earnings etc. ” with them. Ms Holley stated that she had been caused “ annoyance ” and “ anxiety ”, but would not describe the emotion as “ distress ”. The feeling of anxiety has lessened over time. She lost confidence in the Defendant’s ability to manage her pension. Ms Holley is unaware of any further unauthorised use of her information.

(4)

111 th Claimant (Adam Richardson): Mr Richardson’s ABS was sent to his parents’ address and opened by his father in error. His parents notified him of the error and Mr Richardson collected the ABS soon afterwards. He describes his emotions as “ annoyance ”, “ minor anxiety ” and feeling “ baffled and frustrated ”. He claimed that he suffered “ distress ” and was worried about whether other documentation meant for him had been sent to an incorrect address. Mr Richardson is unaware of any further unauthorised use of his information.

(5)

155 th Claimant (Chris Pipkin): Mr Pipkin’s ABS was sent to a property belonging to his family. It was opened, he believes, to see whether it contained anything of importance. Mr Pipkin was contacted by his family. He does not say so in terms, but it would appear that he was then able to retrieve the ABS. Mr Pipkin complains of feeling “ extremely annoyed and irritated ” that the ABS had been sent to the wrong address and distressed that such an important document went astray. He is unaware of any further unauthorised use of his information.

(6)

200 th Claimant (Chris Lane): Mr Lane simply states that “ Through his own efforts, [I] was able to retrieve the mis-posted ABS. The ABS had been opened. ” He explains that he had to contact “ strangers ” and ask them whether they had some post that should have come to him. The householders admitted that they had opened the ABS. They agreed to forward it to Mr Lane. He describes the sending of the ABS to an out-of-date address as a “ catastrophic mistake ”. Mr Lane states that he has been caused annoyance, distress, and anxiety, particularly in relation to the safety of his family. This anxiety has lessened over time. He is unaware of any further unauthorised use of his information.

(7)

247 th Claimant (Adam Parris): Mr Parris states only that he received the ABS in an opened condition. He was, he said, aware that the person living at the address to which his ABS was sent “ had links with criminal activity which added an extra level of distress and worry ”. As a result, Mr Parris claims to have suffered distress, annoyance and anxiety. He is unaware of any further unauthorised use of his information.

(8)

253 rd Claimant (Claire Richardson): Ms Richardson’s ABS had been opened by her parents and returned to her. She said that she was not close to her parents and was “ mortified ” that they had opened it and “ become aware of her financial situation and future pension ”. Ms Richardson was annoyed that the ABS had been sent to her parents’ address, when she had moved out over 21 years ago. She has had no relationship with her parents since she left home aged 18. Ms Richardson reported experiencing anxiety, “ strong feelings of distress and was completely mortified ”. She is unaware of any further unauthorised use of her information.

(9)

258 th Claimant (Charlotte Grant): Ms Grant’s ABS was sent to the address of a family member where it had been opened. She states that her family told her that they had not looked at its contents, but the Claimant says that she “ remains unsure whether a family member accessed and viewed her data ”. She complains about annoyance and anger at the negligent handling of her data and was distressed about the potential repercussions. Ms Grant felt anxious about potential identity theft and changed the passwords to her online accounts. She is unaware of any further unauthorised use of her information.

(10)

307 th Claimant (Mario Ciaramella): Mr Ciaramella’s father was approached by a current resident of his parents’ former address. That person passed the opened ABS to the Mr Ciaramella’s father stating that it had been opened in error. He then passed it on to Mr Ciaramella. He states that he is annoyed that the ABS was sent to an address that he ceased living at for more than 13 years. He also claims to have been caused distress arising from his not knowing the current residents of his parents’ former home and the fact that he could not rule out the possibility that they may have copied information from his ABS “ for future use or dissemination. ” Mr Ciaramella has suffered anxiety arising from his fear of identity theft (and also changed his online passwords) and the impact that it might have on his career progression. He is unaware of any further unauthorised use of his information.

(11)

342 nd Claimant (Naomi O’Keeffe): Ms O’Keeffe did receive her ABS after it had been sent to her parents’ address. Her parents passed it on to her. They had opened it as they thought it was junk mail. Ms O’Keeffe reports that she continues to suffer considerable annoyance as a result of the ABS being sent to an address at which she had not lived for 14 years. She complains of “ minor distress ” as she would not have discussed the contents of the ABS with her parents, and she was distressed that such information had been shared with them without her permission. She has not experienced any anxiety. Ms O’Keeffe is unaware of any further unauthorised use of her information.

(12)

359 th Claimant (Paul Fielder): Mr Fielder’s ABS was sent to his parents’ home address and was opened in error by his father, who shares the same first initial as him. Mr Fielder’s father advised him of the error and passed the ABS on to him. Mr Fielder reported feelings of “ considerable annoyance ” that his ABS had been sent to an address he had not lived at for more than 13 years. He was also caused distress through worry that other items of correspondence might similarly have gone astray. He was also concerned that the information within the ABS could be used to identify him, his family or his current home, “ allowing him to be targeted due to his work and involvement with the [Police] ” and that the information “ could be misused at any time in the future ”. Mr Fielder also reported feelings of anxiety from being a victim of possible identity fraud. He is unaware of any further unauthorised use of his information.

(13)

386 th Claimant (Toby Young): Mr Young’s ABS was sent to his mother’s home. It was passed on to him by his mother. She had opened it in error believing it to be addressed to her. Mr Young reported that he had suffered “ considerable annoyance ” at the fact that the ABS had been sent to an address he had not occupied for at least 17 years. He is concerned as to whether there have been other letters that have gone astray. Mr Young complains of “ minor distress ”. He would not have discussed his pension (or its value) with his mother, and he was distressed that “ the Defendant’s negligence lead (sic) to her being made aware of such information. ” He reported suffering “ minor anxiety ” caused by the Defendant’s “ mismanagement of his personal data ”. He is unaware of any further unauthorised use of his information.

(14)

472 nd Claimant (Elizabeth Hawkins): Ms Hawkins received her ABS from another serving police officer. She received an email from the police officer which advised her that she received Ms Hawkins’ ABS in the same envelope as her own. The police officer sent it on to her a few days later. Ms Hawkins reports feeling “ extreme annoyance ” at the Defendant’s failure in its duty of care towards her. She says that she has been caused distress arising from the number of inquiries that she had made with the Defendant and believes that other documents may have been “ misplaced by the Defendant ”. She believes that the Defendant cannot be trusted to deliver future mail correctly or to handle her pension. Ms Hawkins is unaware of any further unauthorised use of her information.

62.

As to the claims for damages advanced by the Claimants, Mr Sharland KC extracted the following summary from the Individual Schedules:

(1)

All Claimants have advanced a claim that annoyance and irritation was caused by the mis-addressed ABS.

(2)

35 Claimants plead that they (a) would not describe the feelings they suffered as “ distress ”; (b) did not suffer distress; (c) consider “ distress ” to be too strong a word to describe the impact on them or say that they are too resilient to have suffered “distress”; or (d) suffered “ stress ” rather than “ distress ”.

(3)

15 Claimants claim that their reactions were “ mild ”, “ minor ” or “ temporary ”.

As to the 35 Claimants identified by Mr Sharland KC, Mr Campbell KC submits that they all suffered non-material damage, akin to distress, and that the Defendant’s complaint is one of semantics that has no substance.

(2)

Striking Out Application

63.

On 12 January 2023, the Defendant issued an Application Notice seeking an order striking out the Second Claim on the grounds that the Claimants in the Second Claim had failed to serve Particulars of Claim by the deadline imposed by CPR 7.4(2) (“the Striking Out Application”).

64.

The Striking Out Application was referred to me. Without a hearing, I made an Order, on 17 January 2023, listing the Striking Out Application to be heard at the hearing that had been fixed for 27-28 February 2023, and gave directions for evidence to be filed by the parties. I also directed that:

(1)

at that hearing, the Court would re-consider the Second Anonymity Order; and

(2)

the Claimants’ solicitors must file and serve a witness statement explaining why the Second Claim had been issued (rather than an application made to amend the First Claim) by 24 January 2023.

My reasons for making these orders were stated in the Order as follows:

“The Court has already made an Order directing the reconsideration of the Anonymity Order in the Main Claim. Although the Order of 21 December 2022 properly held the ring in respect of the anonymity of the Claimants in this claim pro tem , the issue of anonymity will be considered at the [hearing on 27-28 February 2023].

I do not presently understand why this further claim has been issued. It risks complicating (and therefore obstructing) the just disposal of the Claimants’ claims and has already generated satellite applications that the Court will need now to resolve. I have therefore directed the service of a witness statement by the Claimants’ solicitors to explain.”

65.

In compliance with that Order, the Claimants filed a further witness statement from Mr Hayes, dated 24 January 2023. He stated that the decision to issue the Second Claim was to protect the relevant Claimants from any argument by the Defendant that their claims were time barred, and explained:

“The Claimants’ primary position is that these 42 Claimants [in the Second Claim] are entitled to pursue claims for damages for personal injury as part of the [First Claim]. If the Court agrees, or that is now accepted by the Defendant, then the Claimants would be content for the [Second Claim] to be stayed. However, if the Court concludes that these Claimants are not entitled to claim damages for personal injury as part of the [First Claim], then the Claimants would wish to pursue the [Second Claim] and the Defendant’s application to strike out the [Second Claim] would need to be determined…”

(3)

Application by the Claimants in the Second Claim

66.

On 24 January 2023, the Claimants in the Second Claim issued an Application Notice seeking orders that:

(1)

the Particulars of Claim in the Second Claim had been served in time; or, alternatively,

(2)

time for service of the Particulars of Claim (and particulars required by §4.1 CPR PD 16) be extended to 24 January 2023; and

(3)

time for service of the particulars required by §4.2 CPR PD 16 be extended.

67.

In relation to this procedural thicket, the Claimants submitted:

(1)

the MPoC in the First Claim was sufficient to encompass the claims for personal injury now the subject of the Second Claim (i.e. that the Second Claim was unnecessary); alternatively

(2)

the MPoC in the First Claim could be amended to permit the Claimants in the Second Claim to advance their claims for personal injury in the First Claim; alternatively

(3)

the MPoC in the First Claim and the Individual Schedules are sufficient by way of particulars for the Second Claim; alternatively,

(4)

the Court should grant to the Claimants in the Second Claim an extension of time for service of the Particulars of Claim in the Second Claim, and (to the extent necessary) also grant their application for relief from sanctions in respect of the late service of the Particulars of Claim in the Second Claim.

68.

Despite the observations made in the Order of 17 January 2023 questioning why the Claimants had not simply sought permission to amend the First Claim, no such application was made by the Claimants prior to the hearing on 27-28 February 2023. At the hearing, the Claimants faintly pursued their suggestion that they be granted permission to amend the Particulars of Claim in the First Claim to enable the Claimants in the Second Claim to pursue a claim for personal injury (see [67(2)] above). I refused to do so. The Court of Appeal has deprecated first instance courts dealing with applications to amend ‘on the hoof’: see Sayn-Wittgenstein-Sayn -v- HM Juan Carlos Alfonso Victor María de Borbón y Borbón [2023] 1 WLR 1162 [63]. The Claimants had had sufficient time in advance of the hearing on 27-28 February 2023 to propose draft amendments to the MPoC in the First Claim to the Defendant and, if consent were not forthcoming, to issue the necessary Application Notice to seek permission to amend. By the time of the hearing, they had not done so.

69.

The Claimants’ position in relation to the Second Claim remains difficult to understand. Mr Campbell KC referred me to Chandra -v- Brooke North [2013] EWCA Civ 1559 [69] as providing the Court of Appeal’s suggestion that, where a claimant seeks permission to amend in circumstances where the amendment sought might arguably time barred, the prudent course is to issue a second claim prior to expiry of the limitation period. No one can quarrel with the good sense of that recommendation. However, here, the Claimants did not issue an application to amend the First Claim either before issuing the Second Claim or at any time before the hearing on 27-28 February 2023. In circumstances where a second claim is issued, protectively, it is as a fall back to guard against any adverse ruling of the Court refusing permission to amend the first claim.

70.

At the hearing, I was unable to understand the stance adopted by the Claimants. Objectively judged, even if there was a risk of the limitation period for any claim for personal injury expiring, the Claimants appeared to me to have what appeared to be an unanswerable argument that the amendments sought would fall within CPR 17.4(2). The Claimants in the Second Claim were simply advancing a claim that they had additionally been caused personal injury as a result of the sending of the mis-addressed ABSs. The underlying facts in the First Claim remained the same. Yet, by the time of the hearing, they had not taken the step of issuing an application seeking permission to amend.

71.

At the hearing, the Defendant did not challenge the contention that, if required, the Claimants could rely upon CPR 17.4(2) in relation to any application to amend the First Claim. Challenged that this was not a particularly constructive approach, the Defendant submitted that it was not required to assist the Claimants in formulating their claims, or for that matter, to assist in sparing the Court from interminable procedural wranglings by proposing a pragmatic solution. The Defendant’s position was the Court should simply rule on the Applications that were in front of it. In the circumstances of this case, that was not a helpful stance to adopt.

72.

So that the Court could deal with the real issue between the parties in relation to the claim for personal injury, I made an Order, at the hearing, that, by 4.30pm on 2 March 2023, the relevant Claimants in the First Claim should file and serve any Application to amend their claim so as to include a claim for personal injury. The Defendant was required to confirm in writing, by 17 March 2023, whether it consented to any Application to amend made by the Claimants.

G: Events following hearing on 27-28 February 2023

(1)

Anonymity Orders discharged

73.

As a result of the change of the Claimants’ stance on the issue of anonymity, only 9 Claimants sought to maintain the Anonymity Order in their claims (see [22] above). In consequence, pending determination of the issue whether the Anonymity Order should be maintained in the case of those Claimants, I made an order discharging the Anonymity Order, save for those Claimants who wished to argue that anonymity should be maintained in their case. The Claimants were directed to file an Amended Claim Form providing the names of the Claimants who had previously been anonymised and in respect of whom the Anonymity Order had been discharged. An Amended Claim Form was duly filed on 15 March 2023. Since then, it has been available for public inspection under CPR 5.4C(1) and the Schedule attached lists the names of all Claimants in respect of whom the Anonymity Order has been discharged.

(2)

Further Applications and evidence in respect of other derogations from open justice

74.

At the hearing on 27-28 February 2023, the Claimants indicated that they (or most of them) wished to maintain that their addresses should be withheld from the Claim Form and other documents required to be filed with the Court that were open to public inspection. At the hearing, the Claimants also sought restrictions on third party access to the Individual Schedules pursuant to CPR 5.4C(4), largely because public access to the Individual Schedules would frustrate the Applications of those Claimants who were seeking orders to restrict public access. I made orders:

(1)

imposing temporary restrictions on third-party access to the Individual Schedules without the permission of the Court;

(2)

directing any Claimant who wished to maintain such restrictions to file an Application, supported by evidence, by 4.30pm on 5 May 2023; and

(3)

requiring those Claimants who wished his/her address to continue to be withheld from the Claim Form and other documents to be filed with the Court to file an Application, supported by evidence, by 5 May 2023.

75.

Following the hearing and in accordance with directions given by the Court, on 5 May 2023, the Claimants issued a further Application Notice seeking derogations from open justice in two categories of Claimant:

(1)

those who maintained that an order should be made maintaining that their address should be withheld from the Claim Form and other documents to be filed with the Court; and

(2)

those who sought an order restricting non-party access to their Individual Schedules (see [39] above) (“a 5.4C Order”).

A very large number of Claimants were included in both categories.

76.

Each Claimant who sought orders in either or both of these categories filed a witness statement in support of the Application. In addition, Kingsley Hayes, of the Claimants’ solicitors also provided a witness statement, dated 5 May 2023. Mr Hayes’ witness statement provides a helpful summary of the Claimants’ individual witness statements:

“… to assist the Court and by way of overview, the following features concerning the current position of the Claimants are common to many of the statements:

(a)

Many Claimants refer to receiving guidance or recommendations from the Force to prevent their home addresses being identified, and all Claimants outline the various measures they take to retain the confidentiality of their home addresses. Examples of such steps taken by some Claimants include:

(i)

Using their maiden name at work;

(ii)

Moving to a different area to that in which they police;

(iii)

Removing their details from the electoral roll; and

(iv)

Not having a social media presence.

(b)

Almost all Claimants refer to the current very high anti-police sentiment amongst the public, noting that violence against police officers is on the rise.

(c)

The vast majority of Claimants refer to encountering dangerous individuals due to the nature of their role. A significant number refer to receiving threats in the course of their duties and/or being aware of threats made to colleagues. Several note that such threats are less worrying whilst their home address is not publicly identifiable.

In addition, the statements refer to the potential consequences to Claimants of not being granted the order sought. Some of these potential consequences are outlined below:

(a)

Relocation: Some Claimants detail that they would be forced to move homes were their address and details in the schedule to become accessible to the public (see for example the [exhibited] statement at pp.25-29). Other Claimants note that, where credible threats have previously been identified to officers’ home addresses, the Force has acted to place markers on their address or even re-locate them.

(b)

Barrier to justice : A high number of Claimants state that they would consider discontinuing their claims should their address and schedules be compromised, in order to protect their personal safety.

(c)

Injury: Those Claimants seeking damages for personal injury in this claim have opined that non-protection of their addresses and schedules may exacerbate and/or revive their injuries.

(d)

Professional restrictions/interference: Several Claimants note that disclosure would prevent them from moving into more sensitive areas of policing. Others currently working in such sensitive areas worry about being taken off active duty, or moved to an alternative unit, thereby undermining operations.

(e)

Career progression: Some Claimants have raised the issue that by reason of having to make their addresses or Claimant Schedules accessible, that would either deter them from applying for sensitive roles or may mean that any application might be declined, thus frustrating their ability to progress within the Force.”

77.

Each Claimant, in his/her witness statement, has explained why an order should be made in these terms in his/her favour. The reasons differ, Claimant by Claimant, but some themes emerged from this evidence. A common justification, advanced in support of a 5.4C Order, was that, apart from close family and immediate colleagues, the officer’s role within the police was not public knowledge. Some officers stated that they would be “ worried and frustrated ” if their role in the police did become public knowledge. Some suggested that it might lead to their being “ targeted by criminals ”, others that such knowledge would put the officer and his/her family “ at grave risk of harm ”.

78.

Finally, the Claimants have filed a witness statement from the Data Protection Officer at Sussex Police, Martin Brazier, also dated 5 May 2023. Mr Brazier states that Sussex Police issues guidance regarding the steps that its officers can take in order to protect their identities. He exhibits the guidance that is provided to officers and states:

“This advice is given to ensure that members of the public cannot identify officers outside of work and so that officers can preserve the confidentiality of their addresses. Unfortunately, there are people who would seek to do harm to police officers and indeed their families. Someone who has been arrested by an officer, or who has come into contact with them, may seek a confrontation. It is one thing when this happens at a police station, but another if it happens at the home address of the officer where their family resides…”

79.

Mr Brazier adds that the threat level to the UK Police Service remains “ substantial ”. Guidance is given that: “ Police officers are considered legitimate, accessible and symbolic targets for attack by Islamist and Extreme Right-Wing terrorists… ” Mr Brazier states that he is aware of Facebook groups that are dedicated to identifying police officers and harassing them. The names of police officers are, he says, routinely redacted when documents are provided, for example in response to subject access requests under the data protection legislation and when documents are provided in Court proceedings. Mr Brazier states that if a police officer’s home address were to be made publicly available, that might affect the officer’s ability to move into more sensitive areas of policing with increased vetting requirements.

80.

Mr Hayes, in his witness statement, stated that the Claimants were not seeking a “ blanket restriction ” on public access to the Individual Schedules. He suggested that they were seeking only a requirement that any third party wishing to obtain a copy from the records of the Court should be required to make an application. “ The order sought thereby attempts to go no further than establishing a simple and limited safeguard against access by nefarious parties for malevolent purposes, and in order to protect the safety of the Claimants. ”

(3)

Application to amend the MPoC in the First Claim to advance the personal injury claims

81.

Further to the Order made at the hearing (see [72] above), the Claimants duly issued an Application Notice on 2 March 2023 seeking (if necessary) permission to amend the First Claim to enable the relevant Claimants to advance a claim for personal injury (“the Application to Amend”).

82.

On 17 March 2023, the Defendant’s solicitors confirmed that, subject to receiving some points of clarification, the Defendant consented to the Application to Amend.

83.

Subject to hearing the parties’ further submissions, it would appear that the consequence of this is that the Second Claim has been rendered otiose. I shall deal with the consequential orders in relation to this Second Claim when this judgment is handed down.

H: Legal principles

(1)

Striking out

84.

The Court can strike out a statement of case (in whole or in part) if it appears that it discloses no reasonable grounds for bringing the claim: CPR 3.4(2)(a). PD 3A §1.2 provides examples of cases where the Court may conclude that Particulars of Claim fall within CPR 3.4(2)(a), including where the Particulars of Claim “ contain a coherent set of facts but those facts, even if true, do not disclose any legally recognisable claim against the defendant ”.

85.

For Media & Communications claims, CPR PD 53B §2.1 provides:

“2.1

Statements of case should be confined to the information necessary to inform the other party of the nature of the case that they have to meet. Such information should be set out concisely and in a manner proportionate to the subject matter of the claim…

2.2

A claimant must in the particulars of claim give full details of the facts and matters on which they rely in support of any claim for damages.

…

8.1

In a claim for misuse of private information, the claimant must specify in the particulars of claim … the use … of the information by the defendant which the claimant claims was … a misuse…”

86.

A striking out application requires analysis of the statement of case, without reference to evidence. Unless demonstrably and patently hopeless, the Court proceeds on the assumption that the relevant factual averments will be established by evidence at trial. The Court should not be deterred from deciding a point of law; if it has all the necessary materials, it should “ grasp the nettle ”. Where a statement of case is found to be defective, the Court should consider whether the defects might be cured by an amendment and, if it might be, the Court should consider whether to give the party concerned an opportunity to amend: Morgan -v- Associated Newspapers Ltd [2018] EWHC 3960 (QB) [39]; Duchess of Sussex -v- Associated Newspapers Ltd [2020] EWHC 1058 (QB) [33(2)]; Duke of Sussex -v- Associated Newspapers Ltd [2023] EWHC 3120 (KB) [35].

(2)

Summary Judgment

87.

There is no real dispute between the parties as to the principles that apply when the Court is deciding a summary judgment application. I can take those principles from Lawrence -v- Associated Newspapers Ltd [2024] EMLR 3 [77]:

(1)

The burden of proof is on the applicant for summary judgment.

(2)

The court must consider whether the claimant has a ‘realistic’ as opposed to a ‘fanciful’ prospect of success: Swain -v- Hillman [2001] 1 All ER 91 .

(3)

The criterion ‘real’ within CPR 24.2 (a) is not one of probability, it is the absence of reality: Lord Hobhouse in Three Rivers DC -v- Bank of England (No.3) [2003] 2 AC 1 [158].

(4)

At the same time, a ‘realistic’ claim is one that carries some degree of conviction. This means a claim that is more than merely arguable: ED & F Man Liquid Products -v- Patel [2003] EWCA Civ 472 [8].

(5)

The court must be astute to avoid the perils of a mini-trial but is not precluded from analysing the statements made by the party resisting the application for summary judgment and weighing them against contemporaneous documents ( ibid ).

(6)

However disputed facts must generally be assumed in the claimant’s favour: James-Bowen -v- Commissioner of Police for the Metropolis [2015] EWHC 1249 [3].

(7)

An application for summary judgment is not appropriate to resolve a complex question of law and fact, the determination of which necessitates a trial of the issue having regard to all the evidence: Apovdedo NV -v- Collins [2008] EWHC 775 (Ch) .

(8)

If there is a short point of law or construction and, the court is satisfied that it has before it all the evidence necessary for the proper determination of the question and that the parties have had an adequate opportunity to address it in argument, it should grasp the nettle and decide it: ICI Chemicals & Polymers Ltd -v- TTE Training Ltd [2007] EWCA Civ 725 .

(9)

However, in reaching its conclusion the court must take into account not only the evidence actually placed before it on the application for summary judgment, but also the evidence that can reasonably be expected to be available at trial. The court should hesitate about making a final decision without a trial, even where there is no obvious conflict of fact at the time of the application, where reasonable grounds exist for believing that a fuller investigation into the facts of the case would add to, or alter, the evidence available to a trial judge and so affect the outcome of the case: Royal Brompton Hospital NHS Trust -v- Hammond (No.5) [2001] EWCA Civ 550 ; Doncaster Pharmaceuticals Group Ltd -v- Bolton Pharmaceutical Co 100 Ltd [2007] FSR 63 .

(10)

The same point applies to an extent to difficult questions of law, particularly those in developing areas, which tend to be better decided against actual rather than assumed facts: TFL Management Services -v- Lloyds TSB Bank [2014] 1 WLR 2006 [27].

(3)

Misuse of private information

88.

The tort of misuse of private information has a two-stage test. First whether the claimant has a reasonable expectation of privacy in the relevant information; and second whether that expectation is outweighed by any countervailing interest: ZXC -v- Bloomberg [2022] AC 1158 [47]. The question whether there is a reasonable expectation of privacy is a broad one, which takes account of all the circumstances of the case: Murray -v- Express Newspapers plc [2009] Ch 481 [36].

89.

The ‘misuse’ relied upon to found a claim must “ attain a certain level of seriousness ”: ZXC [45] and In re JR38 [2016] AC 1131 [87] (approving the articulation of this principle by Laws LJ in R (Wood) -v- Commissioner of Police of the Metropolis [2010] 1 WLR 123 [20]-[22]). In Underwood -v- Bounty UK Ltd [2022] EWHC 888 (QB) , the claimants’ claims were dismissed on other grounds, but I did find that the information obtained was trivial (name, gender and date of birth) and did not meet the level of seriousness to sustain a claim for misuse of private information: [53].

90.

In this case, the Defendant does not contend that there is a justification for misaddressing the ABSs. It contends that, unless the contents of the ABSs have been read by (and published to) a third party, there has been no ‘misuse’. As a fall-back, the Defendant also argues that, even if an ABS was read by a third party, that cannot constitute ‘misuse’ under the tort.

91.

The issue of what constitutes ‘misuse’, for the purposes of the tort, has arisen in several decisions. Mr Campbell KC has referred to the Court of Appeal’s decision in TLT -v- Secretary of State for the Home Department [2018] 4 WLR 101 [50] as establishing that liability for misuse of private information may arise as a result of ‘human error’. In a similar vein, Saini J observed in Warren -v- DSG Retail Limited [2021] EMLR 25 [27] that the ‘misuse’, relied upon to found the action:

“… may include unintentional use, but it still requires a ‘use’: that is, a positive action. In the language of Article 8 ECHR (the basis for the MPI tort), there must be an ‘interference’ by the defendant, which falls to be justified.”

92.

I accept that principle, as far as it goes, but TLT was a case in which the claimants had established, at trial, that a spreadsheet containing their private information had been published on a website and, on the evidence, had been downloaded 27 times by 22 different IP addresses. In other words, that there had been an interference with the privacy interests of the claimants caused by the negligent act of publication of the spreadsheet containing the claimants’ private information to the various third parties who had downloaded the document.

93.

Warren was a cyber-attack case, where personal data was obtained by hackers from the defendant’s computer systems. Striking out the claim for misuse of private information, Saini J found that there had been no ‘misuse’ of the claimants’ personal information by the defendant; it had been the victim in the cyber-attack. The Judge held that misuse of private information could not be maintained in respect of what was, in essence, a complaint about alleged inadequate data security: it was, he noted, “ an unconvincing attempt to shoehorn the facts of the data breach into the tort of MPI ”: [27].

94.

Saini J returned to consider this point in another cyber-attack case: Smith -v- Talktalk Telecom Group plc [2022] 1 WLR 5213 . The Judge held:

[46] I was taken to two more recent cases where the reasoning in Warren was applied in dismissing MPI claims: Stadler -v- Currys Group Ltd [2022] EWHC 160 (QB) , and Underwood -v- Bounty UK Ltd [2022] EWHC 888 (QB) at [52]. In each case, the court did not accept the submission that a defendant who did things which enabled access to information by an unauthorised person in any true sense amounted to the defendant itself misusing the information within the tort.

[47] On the assumption that Warren correctly identified the principles, the claimants’ original case plainly fell foul of the principles. It expressly alleged breach of a security duty as the basis for the alleged misuse of private information. The RAPOC is an attempt to work around the reasoning in Warren. I accept the defendant’s submission that it fails to do so.

…

[49] To summarise, I do not consider that element (3) of an MPI claim [whether the conduct complained of by the claimant a misuse by the defendant of the information] can be established merely on the basis of prior conduct of the defendant of this type. That is because, as in Warren , that conduct is not a misuse of information by the defendant. The misuse is later by the criminal actors. Creating a situation of vulnerability (and thus enabling a fraud) is simply not a misuse of information within the tort. That the Claimants’ case is one of wrong through creation of a vulnerability is clear from the very first paragraph of the RAPOC: it is pleaded that they are “ victims of a series of significant failures by the defendant to put in place, in particular, appropriate security measures to prevent unauthorised access to and/or use of data and information held on its IT estate, including its IT infrastructure, systems and/or databases ”. The emphasis on “ enabling ” misuse by others underlines that this is not in reality a proper claim of misuse of information by the defendant.

95.

In Stadler -v- Currys Group Limited [2022] EWHC 160 (QB) , the Court dismissed claims for breach of confidence and misuse of private information arising from the Defendant’s resale of a television set which had not been adequately ‘wiped’ to remove some of the Claimant’s data stored on it. HHJ Lewis held [58]:

“In passing the Smart TV to a third party the defendant was not making use of the data or information that is the subject of this claim. In fact, there is no evidence that the defendant had any actual knowledge of the information in question or made use of it. It follows that there cannot have been any unauthorised use (or misuse) of the information by the defendant. It would be artificial to characterise the disposal of the Smart TV as a misuse of the information itself. At best, it could be said that in failing to wipe the device, the defendant was responsible for breaching a duty of data security, but this is insufficient on the facts of this case to make out claims for either BOC or MOPI.”

96.

In my judgment, based on these authorities, if a Claimant in this case can show that, as a result of his/her ABS having been read by a third party, information over which s/he has an expectation of privacy has been disclosed/published, then (subject to satisfying the threshold of seriousness) s/he has an arguable case for misuse of private information. This is not like a data breach case where a third party has unlawfully obtained the information as a result of hacking or a cyber-attack. This case is much closer on the facts to TLT . Where a Claimant can demonstrate publication of the private information in an ABS, that has arisen from the Defendant’s act of sending the ABS to the wrong address, then that can, in my judgment, provide the element of ‘misuse’ for the tort. I therefore reject the Defendant’s fall-back argument (see [90] above).

97.

That leads me on to a further, and important, point. In this case, each Claimant’s claim of misuse of private information depends upon his/her ABS having ended up in the hands of (at least) one third party who, it is contended, would have opened the letter, and read the contents. For almost all Claimants, that case is purely inferential.

98.

The Defendant contends that – absent an averment in the statement of case (and ultimately proof) that the ABS was read by any third party, a claim for misuse of private information either fails to disclose a cause of action or has no real prospect of success. For that element of publication of the ABS to a third party, the Defendant relies – by analogy – upon principles from the law of defamation which establish that there is no presumption that a letter – sent in the post – will be read by anyone other than the addressee. The authors of Gatley (13 th edition, 2022, Sweet & Maxwell) give the following summary of the principles of publication in §7-017 (footnotes, omitted or expanded):

“As a general rule, when a letter is addressed to a particular person, the writer is not responsible except for a publication to that person. However, if in the circumstances of the case the writer knows that the letter will be opened and read by some person other than the person to whom he addresses it, he will be liable for the publication to that person. As it was put by Swinfen Eady LJ in Huth -v- Huth [1915] 3 KB 32 , 43 if:

‘a person sends a letter to, say, a merchant at his office, knowing that the merchant has a staff of clerks who in the ordinary course of business open all letters sent to the merchant’s office, that would clearly be a publication if the letter were opened and perused by a clerk in that way, even although that letter were most carefully sealed.’

By analogy with the cases in the next paragraph, it is submitted that the true rule is that the defendant will be liable if he has reason to know that the letter may be opened in the ordinary course of business by someone other than the addressee and, probably in modern business conditions, such knowledge will generally be imputed to him, unless the letter carries some clear indication (e.g. by being marked ‘personal’ or ‘private and confidential’) to show that this should not take place. There may also be cases in which the defendant has reason to know that a letter sent to a private address may be opened by someone other than the addressee, though in practice this may be less likely than in the case of a letter sent to a business address. Such a case might arise, e.g. if the writer knew that the addressee was illiterate or blind.

In Theaker -v- Richardson [1962] 1 WLR 151 , where the defendant put a letter intended for the plaintiff into an envelope similar to one which would contain an election address and delivered it by hand and the plaintiff’s husband picked it up and opened it, there was evidence on which the jury could find, as they did, that the defendant anticipated that someone other than the plaintiff might open and read the letter, and that it was a natural and probable consequence of the defendant’s act that the plaintiff’s husband would open and read it. There was accordingly held to have been publication. The appearance of the communication is significant in this case: it should certainly not be taken as supporting the view that one must assume that spouses open each other’s letters. On the other hand in Huth -v- Huth , where the defendant sent through the post in an unclosed envelope a written communication defamatory of the plaintiff which was taken out and read by the plaintiff’s butler out of curiosity, the Court of Appeal held that there was no evidence of publication, for there was no evidence that, to the defendant’s knowledge, the letter would in the ordinary course be likely to be opened by the butler, or by any other person at the plaintiff’s house, before it was delivered to her.”

99.

As to the scope for drawing inferences about publication, the principles are stated as follows in §34-007 (footnotes, omitted or expanded):

“It is not necessary in all cases to prove that the libellous matter was actually seen and read by some identified third party. If it is a matter of reasonable inference that this happened, a prima facie case of publication will be established. Thus, proof that a libellous letter was sent through the post is prima facie evidence of publication to the person to whom it was addressed… There is no presumption that a letter in an unsealed envelope will be read by anyone other than the addressee: Huth -v- Huth . It is always open to a claimant to seek to prove that in the particular case it was a natural and probable consequence of sending the letter, sealed or unsealed, that it would be opened and read by a third party: see Theaker -v- Richardson . Or that the defendant knew that a letter addressed to the claimant was likely to be opened by his clerk or secretary, and that is what happened: Gomersall -v- Davies (1898) 14 TLR 430 .”

100.

Closely linked to the question of what amounts to ‘misuse’ under the tort is the issue of whether English law permits recovery under the tort simply for ‘loss of control’. In Lloyd -v- Google , although strictly obiter (as no claim for misuse of private information had been pursued), the Supreme Court considered the decisions in Gulati -v- MGN Ltd (both at first instance ( [2016] FSR 12 ) and on appeal to the Court of Appeal ( [2017] QB 149 ) and noted:

[100] The measure of damages for wrongful invasion of privacy was considered in depth in Gulati … by Mann J and by the Court of Appeal. The eight test claimants in that case were individuals in the public eye whose mobile phones were hacked by newspapers, leading in some instances to the publication of articles containing information obtained by this means. The newspapers admitted liability for breach of privacy but disputed the amount of damages. Their main argument of principle was that (in the absence of material damage) all that could be compensated for was distress caused by their unlawful activities: see [2016] FSR 12 [108]. The judge rejected that argument. He said, at [111], that he did not see why “ distress (or some similar emotion), which would admittedly be a likely consequence of an invasion of privacy, should be the only touchstone for damages ”. In his view: “ While the law is used to awarding damages for injured feelings, there is no reason in principle … why it should not also make an award to reflect infringements of the right itself, if the situation warrants it. ”

[101] The judge referred to cases in which damages have been awarded to very young children (only ten months or one year old) for misuse of private information by publishing photographs of them even though, because of their age, they could not have suffered any distress: see AAA -v- Associated Newspapers Ltd [2013] EMLR 2 ; and Weller -v- Associated Newspapers Ltd [2014] EMLR 24 . He concluded, at [144]:

“I shall therefore approach the consideration of quantum in this case on the footing that compensation can be given for things other than distress, and in particular can be given for the commission of the wrong itself so far as that commission impacts on the values protected by the right.”

Later in the judgment, at [168], the judge referred back to his finding that:

“the damages should compensate not merely for distress … but should also compensate (if appropriate) for the loss of privacy or autonomy as such arising out [of] the infringement by hacking (or other mechanism) as such.”

[102] The Court of Appeal affirmed this decision: [2017] QB 149 . Arden LJ (with whom Rafferty and Kitchin LJJ agreed) held, at [45], that:

“the judge was correct to conclude that the power of the court to grant general damages was not limited to distress and could be exercised to compensate the claimants also for the misuse of their private information. The essential principle is that, by misusing their private information, MGN deprived the claimants of their right to control the use of private information.”

Arden LJ justified this conclusion, at [46], on the basis that:

“Privacy is a fundamental right. The reasons for having the right are no doubt manifold. Lord Nicholls of Birkenhead put it very succinctly in Campbell -v- MGN Ltd [2004] 2 AC 457 [12]: ‘ [Privacy] lies at the heart of liberty in a modern state. A proper degree of privacy is essential for the well-being and development of an individual. ’”

[103] The Court of Appeal in Gulati rejected a submission, also rejected by the judge, that granting damages for the fact of intrusion into a person’s privacy independently of any distress caused is inconsistent with the holding of this court in R (WL (Congo)) -v- Secretary of State for the Home Department [2012] 1 AC 245 [97]-[100], that vindicatory damages are not available as a remedy for violation of a private right. As Arden LJ pointed out at [48], no question arose of awarding vindicatory damages of the kind referred to in WL (Congo) , which have been awarded in some constitutional cases appealed to the Privy Council “ to reflect the sense of public outrage, emphasise the importance of the constitutional right and the gravity of the breach, and deter further breaches ”: see WL (Congo) [98]; Attorney General of Trinidad and Tobago -v- Ramanoop [2006] 1 AC 328 [19]. Rather, the purpose of the relevant part of the awards made in Gulati was “ to compensate for the loss or diminution of a right to control formerly private information ”.

[104] Mann J’s reference to “ loss of privacy or autonomy ” and the Court of Appeal’s explanation that the claimants could be compensated for misuse of their private information itself because they were deprived of “ their right to control [its] use ” convey the point that English common law now recognises as a fundamental aspect of personal autonomy a person’s freedom to choose and right to control whether and when others have access to his or her private affairs…

(4)

Data protection

101.

There are two issues of dispute between the parties in relation to the data protection claim. First, what amounts to damage sufficient to sustain the cause of action; and second, whether the law in England & Wales imposes a threshold of seriousness for that damage in data protection claims. The parties have also provided submissions, after the hearing, on the ECJ decision in UI -v- Österreichische Post AG [2023] 1 WLR 3702 .

(a)

‘Damage’ in data protection cases

102.

In Lloyd -v- Google LLC [2022] AC 1217 , the Supreme Court held that, under s.13 Data Protection Act 1998 , ‘damage’ was limited to material damage (i.e. financial loss or psychological injury) and distress. The Supreme Court rejected the claimant’s ‘loss of control’ argument; that an individual was entitled to recover compensation under s.13 without proof of material damage or distress whenever a data controller had failed to comply with any requirements of the Act : [112]-[113].

103.

The Claimants do not dispute this principle. In their written submissions, the Claimants submitted that they “ are not seeking damages for ‘loss of control’ without proof that it caused distress ”. The Claimants maintain that each has suffered non-material damage in any event. That arises from (a) the inferential case that the misaddressed envelopes have been opened by third parties and the contents of the ABS read by them; and (in any event) (b) distress (or equivalent emotions) caused by not knowing what has happened to the misaddressed ABSs.

(b)

Threshold of seriousness

104.

A threshold of seriousness applies to claims for misuse of private information (see [89] above). Does such a threshold apply to data protection claims? The point was briefly considered by the Court of Appeal in Vidal-Hall -v- Google Inc [2016] QB 1003 . The appeal principally concerned the proper interpretation of s.13(2) Data Protection Act 1998 , and whether a claimant could maintain a claim for damages without proof of pecuniary loss. The Court of Appeal held that, having regard to the objective of the EU Parliament and Council Directive 95/46/EC, “ damage ” in Article 23 of the Directive included both material and non-material damage. In consequence, s.13(2) of the 1998 Act , by restricting claims for damages for distress to instances where the claimant could demonstrate pecuniary or material loss, had not properly given effect to the Directive in English law. The Court of Appeal explained:

[77] Since what the Directive purports to protect is privacy rather than economic rights, it would be strange if the Directive could not compensate those individuals whose data privacy had been invaded by a data controller so as to cause them emotional distress (but not pecuniary damage). It is the distressing invasion of privacy which must be taken to be the primary form of damage (commonly referred to in the European context as “ moral damage ”) and the data subject should have an effective remedy in respect of that damage. Furthermore, it is irrational to treat EU data protection law as permitting a more restrictive approach to the recovery of damages than is available under article 8 of the Convention. It is irrational because, as we have seen at [56] and [57] above, the object of the Directive is to ensure that data-processing systems protect and respect the fundamental rights and freedoms of individuals “ notably the right to privacy, which is recognized both in article 8 of the [Convention] and in the general principles of Community law ”. The enforcement of privacy rights under article 8 of the Convention has always permitted recovery of non-pecuniary loss.

[78] Additionally, article 8 of the Charter of Fundamental Rights of the European Union (“the Charter”) makes specific provision for the protection of the fundamental right to the protection of personal data: “ everyone has the right to the protection of personal data concerning him or her ”. It would be strange if that fundamental right could be breached with relative impunity by a data controller, save in those rare cases where the data subject had suffered pecuniary loss as a result of the breach. It is most unlikely that the Member States intended such a result.

[79] In short, article 23 of the Directive does not distinguish between pecuniary and non-pecuniary damage. There is no linguistic reason to interpret the word “ damage ” in article 23 as being restricted to pecuniary damage. More importantly, for the reasons we have given such a restrictive interpretation would substantially undermine the objective of the Directive which is to protect the right to privacy of individuals with respect to the processing of their personal data.

[80] [Counsel for the claimants] submits that “ damage ” for the purpose of article 23 extends to non-pecuniary loss (such as distress) where privacy rights under article 8 of the Convention are engaged, but not otherwise. In other words, he accepts that article 23 does not require compensation for non-pecuniary loss unless a data subject has suffered a violation of his rights under article 8 of the Convention.

[81] In view of our conclusions as to the unrestricted meaning of “ damage ” in article 23, it necessarily follows that we are unable to accept this submission. But we add the following points. First, [the claimants’] analysis presupposes a two-tier approach to enforcement of rights under the DPA, with a claim for compensation only being available in cases which meet the article 8 seriousness threshold. But the Directive does not distinguish between different categories of data breach (i.e. those which technically engage article 8 rights and those which do not). It is true that the object of the Directive is to protect the right to privacy, but it does not follow that the plain language of article 23 (“ damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive ”) should not be given its natural and ordinary meaning. In many cases the resultant damage will be an invasion of privacy which meets the threshold of seriousness required by article 8 of the Convention. But in some cases it will not. There is nothing in the language of article 23 which indicates an intention to restrict the right to compensation to the former. In short, the Directive does not in terms incorporate the article 8 mechanism for protecting article 8 privacy rights, although in practice application of the data protection legislation may achieve the same results.

[82] Secondly, it is in any event unnecessary in practice to distinguish between cases which reach the article 8 threshold of seriousness and those which do not. If a case is not serious in terms of its privacy implications, then that by itself is likely to rule out any question of recovery of compensation for mere distress.

105.

Mr Sharland KC has also submitted that, in Lloyd -v- Google , Lord Leggatt appeared to accept that there was a threshold of seriousness in data protection cases, when he observed ([153]):

“On the claimant’s own case there is a threshold of seriousness which must be crossed before a breach of the DPA 1998 will give rise to an entitlement to compensation under section 13 . I cannot see that the facts which the claimant aims to prove in each individual case are sufficient to surmount this threshold. If (contrary to the conclusion I have reached) those facts disclose ‘damage’ within the meaning of section 13 at all, I think it impossible to characterise such damage as more than trivial. What gives the appearance of substance to the claim is the allegation that Google secretly tracked the internet activity of millions of Apple iPhone users for several months and used the data obtained for commercial purposes. But on analysis the claimant is seeking to recover damages without attempting to prove that this allegation is true in the case of any individual for whom damages are claimed. Without proof of some unlawful processing of an individual’s personal data beyond the bare minimum required to bring them within the definition of the represented class, a claim on behalf of that individual has no prospect of meeting the threshold for an award of damages.”

(c)

The ECJ decision in UI -v- Österreichische Post AG

106.

Since the original hearing, the Court of Justice of the European Union gave its judgment in the case of UI -v- Österreichische Post AG , which bore on the issues of (1) the proper interpretation of “ damage ” under the General Data Protection Regulation (“GDPR”); and (2) whether a threshold of seriousness was appropriate in the assessment of non-material damage.

107.

On these issues, the ECJ held:

(1)

since Article 82 of the GDPR made the existence of “ damage ” which had been “ suffered ” a condition of the right to compensation, a mere infringement of the provisions of the GDPR would not be sufficient on its own to confer a right to compensation on the data subject: [32]-[33], [36], [42]; and

(2)

that it would be contrary to the broad concept of “ damage ” in Article 82 – and undermine consistency in approach in member states – if the concept of “ non-material damage ” were subject to a threshold of seriousness: [45]-[51].

108.

At the hearing, the parties had made submissions to the Court based on the Advocate General’s Opinion in the case. The Defendant relied upon this in support of its submission that damages are not available for loss of control/autonomy. The Claimants contended that it supported their submission that there was no threshold of seriousness in data protection claims. Both sides have provided further written submissions as to the impact of the ECJ decision, which they are agreed is not binding on the Court but is a decision to which the Court may “ have regard ”: s.6(2) European Union (Withdrawal) Act 2018

109.

The Claimants submitted that the ECJ rejected the concept of a threshold of seriousness and, in doing so, has not accepted the Advocate General’s view that compensation should not be payable where the impact of a breach of data protection amounted to no more than “ annoyance or upset ” or a “ mere feeling of displeasure due to another person’s failure to comply with the law ”.

110.

The Defendant submitted that the Court should not follow the ECJ’s decision on the point as to a threshold of seriousness. Mr Sharland KC argued that the ECJ’s key motivation for the decision was to avoid a lack of ‘coherence’ between the member states if each were to apply its own threshold of seriousness. He argues that no such consideration would apply when considering simply the law in England & Wales and that, in this jurisdiction (in the cases cited in [104]-[105] above), a threshold of seriousness has been recognised to apply to data protection claims.

(5)

Jameel abuse of process

111.

There is no significant difference between the parties as to the principles governing Jameel abuse of process applications, which were summarised in Higinbotham -v- Teekhungam [2018] EWHC 1880 (QB) [44]:

(1)

The Court has jurisdiction to stay or strike out a claim where no real or substantial wrong has been committed and litigating the claim will yield no tangible or legitimate benefit to the claimant proportionate to the likely costs and use of court procedures: in other words, “ the game is not worth the candle ”: Jameel [69]-[70] per Lord Phillips MR and Schellenberg -v- BBC [2000] EMLR 296 , 319 per Eady J. The jurisdiction is useful where a claim “ is obviously pointless or wasteful ”: Vidal-Hall -v- Google Inc [2016] QB 1003 [136].

(2)

Nevertheless, striking out is a draconian power and it should only be used in exceptional cases: Stelios Haji-Ioannou -v- Dixon [2009] EWHC 178 (QB) [30].

(3)

It is not appropriate to carry out a detailed assessment of the merits of the claim. Unless obvious that it has very little prospect of success, the claim should be taken at face value: Ansari -v- Knowles [2014] EWCA Civ 1448 [17] per Moore-Bick LJ and [27] per Vos LJ.

(4)

The Court should only conclude that continued litigation of the claim would be disproportionate to what could legitimately be achieved where it is impossible “ to fashion any procedure by which that claim can be adjudicated in a proportionate way ”: Ames –v- Spamhaus Project Ltd [2015] 1 WLR 3409 [33]-[36] citing Sullivan –v- Bristol Film Studios Ltd [2012] EMLR 27 [29]-[32].

112.

The jurisdiction to dismiss cases as Jameel abusive is one that should be reserved for “ exceptional cases ” where the Court is satisfied that it is impossible to fashion a procedure whereby the claim can be resolved in a proportionate way: Tewari -v- Khetarpal [2022] EWHC 2066 (QB) [77].

113.

In Alsaifi -v- Trinity Mirror plc [2018] EWHC 1954 (QB) [45], I held:

[44] At the heart of any assessment of whether a claim is Jameel abusive is an assessment of two things: (1) what is the value of what is legitimately sought to be obtained by the proceedings; and (2) what is the likely cost of achieving it?

[45] But it is clear from Sullivan that this cannot be a mechanical assessment. The Court cannot strike out a claim for £50 debt simply because, assessed against the costs of the claim, it is not ‘worth’ pursuing. Inherent in the value of any legitimate claim is the right to have a legal wrong redressed. The value of vindicating legal rights – as part of the rule of law – goes beyond the worth of the claim. The fair resolution of legal disputes benefits not only the individual litigants but society as a whole.

114.

Although Jameel was a defamation case, there is no dispute between the parties that the Jameel jurisdiction is not limited to defamation claims and that it extends to all civil claims, including misuse of private information and data protection: see Higinbotham [45]; Vidal-Hall [134]-[136] ( Sullivan was, principally, a breach of copyright claim).

115.

Mr Campbell KC has relied upon the group nature of the claims that are being pursued. In Municipio de Mariana -v- BHP Group (UK) Ltd [2022] 1 WLR 4691 , another case that shows that the Jameel jurisdiction is of universal application, the Court of Appeal provided the following guidance in the context of multi-party group litigation:

[175] … [P]roceedings may also be abusive if, even though they raise an arguable cause of action, they are (objectively) pointless and wasteful, in the sense that the benefits to the claimants from success were likely to be extremely modest and the costs to the defendants in defending the claims wholly disproportionate to that benefit (see AB -v- John Wyeth & Brother (No.4) [1994] PIQR 109 , 114-115 ; and Jameel [69]). In Jameel it was held that the benefit attainable by a claimant was of small value and the costs of the litigation would be out of all proportion to what could be achieved, such that “ the game [was] not worth the candle ” (see [70]). There, at [54], Lord Phillips MR cited with approval the formulation of Eady J in Schellenberg -v- British Broadcasting Corporation [2000] EMLR 296 [57]. The question in each case was whether:

“… there is any realistic prospect of a trial yielding any tangible or legitimate advantage such as to outweigh the disadvantages for the parties in terms of expense, and the wider public in terms of court resources.”

The point being captured was that, while the court must provide a remedy in a case that requires one, the process of the court should not be used in a case where the need has gone away (see Cammish -v- Hughes [2013] EMLR 13 [55]-[56]). We would add that although in the same passage Lord Phillips referred to the concern of the court to “ ensure that judicial and court resources are appropriately and proportionately used ”, the fact that proceedings may place a very heavy burden on the court’s resources cannot constitute a ground of abuse by itself.

[176] Where multiple claims are brought by different claimants who do not stand in materially the same position, it is necessary to consider the question of abuse by reference to claims individually (or by relevant claimant category). Abusive factors applicable only to one claimant do not render another co-claimant’s claim abusive. We treat it as axiomatic that a claim brought by one claimant, which is not itself abusive, cannot become abusive merely because other claimants have chosen to bring abusive claims. The claimants should be in no different position, so far as an abuse argument is concerned, from that if each had brought separate proceedings, whether or not other claimants also brought proceedings. An individual approach is required. The court must be satisfied in relation to every claim, having regard to any differences between claimants or categories of claimant, that it is abusive and a strike-out or stay appropriate.

[177] A finding of abuse of process does not lead automatically to a striking out of the claim. The court then retains a discretion as to the appropriate response, which must always be proportionate (see for example Cable -v- Liverpool Victoria Insurance Co Ltd [2020] 4 WLR 110 [63]-[64]).

[178] Finally, but importantly for present purposes, litigants should not be deprived of their claims without scrupulous examination of all the circumstances and unless the abuse has been sufficiently clearly established: “ the court cannot be affronted if the case has not been satisfactorily proved ” (see Alpha Rocks Solicitors -v- Alade [2015] 1 WLR 4535 [24]; Hunter -v- Chief Constable of the West Midlands Police [1982] AC 529 ; Summers -v- Fairclough Homes Ltd [2012] 1 WLR 2004 [48]). Thus it has been stated repeatedly that it is only in “ clear and obvious ” cases that it will be appropriate to strike out proceedings as an abuse of process so as to prevent a claimant from bringing an apparently proper cause of action to trial (see for example Wallis -v- Valentine [2003] EMLR 8 [31], approving the dicta of Simon Brown LJ in Broxton -v- McCelland [1995] EMLR 485 , 497-498 ); JSC BTA Bank -v- Ablyazov [2011] 1 WLR 2996 [10]; Optaglio Ltd -v- Tethal [2015] EWCA Civ 1002 [63]).

(6)

Anonymity and derogations from open justice

116.

Pursuant to CPR PD16 a Claim Form must include:

(1)

the full name of each party: §2.4; and

(2)

an address (including the postcode) “ at which the claimant lives or carries on business, even if the claimant’s address for service is the business address of their solicitor ”: §2.1.

117.

A Claim Form is one of the documents that is publicly available (subject to certain conditions) from the records of the Court as of right (i.e. without requiring permission of the Court): CPR 5.4C(1).

118.

The default position, under the CPR, is therefore that the name and address of a party to civil litigation is required to be publicly available. These requirements are an important dimension of open justice and transparency. The Court has the power to permit derogation from this default position under CPR PD 16 §2.3 and CPR 39.2(4). As these are derogations from the principles of open justice, the following principles apply (drawn from Practice Guidance (Interim Non-Disclosure Orders) [2012] 1 WLR 1003 (“the Practice Guidance ”) [9]-[13] and [16]):

(1)

Open justice is a fundamental principle. The general rule is that hearings are carried out in, and judgments and orders are, public: see Article 6.1 of the Convention, CPR 39.2 and Scott -v- Scott [1913] AC 417 .

(2)

Derogations from this general principle can only be justified in exceptional circumstances, when they are strictly necessary as measures to secure the proper administration of justice. They are wholly exceptional: R -v- Chief Registrar of Friendly Societies, Ex p New Cross Building Society [1984] QB 227 , 235 ; Donald -v- Ntuli [2011] 1 WLR 294 [52]–[53]. Derogations should, where justified, be no more than strictly necessary to achieve their purpose.

(3)

The grant of derogations is not a question of discretion. It is a matter of obligation, and the court is under a duty to either grant the derogation or refuse it when it has applied the relevant test: M -v- W [2010] EWHC 2457 (QB) [34].

(4)

There is no general exception to open justice where privacy or confidentiality is in issue.

(5)

The burden of establishing any derogation from the general principle lies on the person seeking it. It must be established by clear and cogent evidence: Scott -v- Scott [1913] AC 417 , 438–439, 463, 477 ; Lord Browne of Madingley -v- Associated Newspapers Ltd [2008] QB 103 [2]-[3]; Secretary of State for the Home Department -v- AP (No.2) [2010] 1 WLR 1652 [7]; Gray -v- W [2010] EWHC 2367 (QB) at [6]-[8]; and JIH -v- News Group Newspapers Ltd (Practice Note) [2011] 1 WLR 1645 [21].

(6)

When considering the imposition of any derogation from open justice, the court will have regard to the respective and sometimes competing Convention rights of the parties as well as the general public interest in open justice and in the public reporting of court proceedings. It will also adopt procedures which seek to ensure that any ultimate vindication of article 8 of the Convention, where that is engaged, is not undermined by the way in which the court has processed an interim application. On the other hand, the principle of open justice requires that any restrictions are the least that can be imposed consistent with the protection to which the party relying on their article 8 Convention right is entitled. The proper approach is set out in JIH [21].

(7)

Derogations from the principle of open justice cannot be granted by consent of the parties. Such orders affect the Article 10 Convention rights of the public at large. Parties cannot waive or give up the rights of the public.

119.

Anonymity orders are usually justified on one of two bases: maintenance of the administration of justice and harm to other legitimate interests. The first category of case is where, without the relevant order being made, the administration of justice would be frustrated. Examples of this type of justification for derogations from open justice would include cases involving trade secrets or other confidential information. In such cases, if no derogations from open justice were granted, the proceedings themselves would destroy that which the claimant was seeking to protect, thereby frustrating the administration of justice: Lupu -v- Rakoff [2020] EMLR 6 [28]-[30]:

“Restrictions on open justice to protect the legitimate interests of others raise more difficult issues. The starting point is the recognition that open justice (and probably of greater practical significance, the privilege that attaches to media reports of proceedings in open court) will frequently lead to some interference with the legitimate interests of parties and witnesses. Media reports of proceedings in open court can have an adverse impact on the rights and interests of others, but, ordinarily, ’ the collateral impact that this process has on those affected is part of the price to be paid for open justice and the freedom of the press to report fairly and accurately on judicial proceedings held in public ’: Khuja -v- Times Newspapers Ltd [2019] AC 161 [34(2)] per Lord Sumption.”

120.

Consistent with the requirement to establish the necessity for any derogation from open justice with convincing evidence, the Court will scrutinise with care any application that the Court should withhold the name of a party or other details about the claim (including the party’s address) from the public. Mere assertion that a party may suffer some harm is unlikely to discharge the burden to justify the order.

121.

In Various Claimants -v- Independent Parliamentary Standards Authority [2022] EMLR 4 , the Claimants sought an order relieving them from the requirements to provide their names and addresses on the Claim Form. In support of their application, they relied upon hostility in some sectors of the community towards Members of Parliament and their staff. The application was refused because the evidence put forward by the Claimants failed to demonstrate a credible risk that, if the Claimants were named (and their addresses provided), they would be exposed to some risk of harm. I noted [52]:

“There might exist a very small number of people whose attitude towards MPs (and those who work for them) is so hostile that they might conceivably be moved to offer some threat of physical violence to them, but this risk is remote. The Claimants have not put forward any credible and specific evidence that one or more Claimants is at particular risk of any such threat. The civil justice system and the principles of open justice cannot be calibrated upon the risk of irrational actions of a handful of people engaging in what would be likely to amount to criminal behaviour. If it did, most litigation in this country would have to be conducted behind closed doors and under a cloak of almost total anonymity. As a democracy, we put our faith and confidence in our belief that people will abide by the law. We deal with those who do not, not by cowering in the shadows, but by taking action against them as and when required.”

This principle was recently endorsed by Swift J in R (IAB) -v- Secretary of State for the Home Department [2023] EWHC 2930 (Admin) [28]-[29] (affirmed on appeal: [2024] EWCA Civ 66 ).

122.

Warby LJ provided a distillation of the principles concerning anonymity orders and other derogations from open justice in R (Marandi) -v- Westminster Magistrates’ Court [2023] 2 Cr App R 15 [43]:

“(1)

The starting point is the common law principle of open justice, authoritatively expounded in Scott -v- Scott and subsequent authorities at the highest level. The judge was right to begin here. The summary of the common law principles which he adopted from the argument of Mr Bentham is not materially different from the summary in the Judicial College Guide, approved in R (Rai) -v- Winchester Crown Court [2021] EMLR 21 .

(2)

The general principles that (a) justice is administered in public and (b) everything said in court is reportable both encompass the mention of names. As a rule, ‘ [t]he public has a right to know, not only what is going on in our courts, but also who the principal actors are ’: R (C) -v- Secretary of State for Justice [2016] 1 WLR 444 [36] (Baroness Hale). In this case, it is clear that but for the claimant’s late request for a derogation from these principles the NCA would have named him in open court. Its decision to do otherwise was a purely executive act which has no bearing on the propriety of the judge’s decisions to grant and then lift anonymity. Those were decisions about what the law required. It would have been irrelevant if the NCA had consented to an anonymity order, as parties cannot waive or give up the rights of the public: see the Practice Guidance [16].

(3)

When considering the application for derogation in this case the judge was right to identify and apply a test of necessity. Under the common law as it existed prior to the entry into force of the Human Rights Act 1998 , anonymity could only be justified where this was strictly necessary ‘ in the interests of justice ’: see Khuja [14]. This was and remains an exception of narrow scope: see the tests cited in Clifford -v-Millicom [2023] ICR 663 [31]-[32]. It has never been suggested that this case meets that standard. The claimant’s case rests on the common law privacy right derived from Article 8, to which the Supreme Court referred in Khuja . But in that context too the applicant for anonymity has to show that this is necessary in pursuit of the legitimate aim on which he relies.

(4)

The threshold question is whether the measure in question – here, allowing the disclosure of the claimant’s name and consequent publicity – would amount to an interference with the claimant’s right to respect for his private and family life. This requires proof that the effects would attain a ‘ certain level of seriousness ’: ZXC -v- Bloomberg LP [2022] AC 1158 [55], Javadov -v- Westminster Magistrates’ Court [2022] 1 WLR 1952 [39]…

(5)

The next stage is the balancing exercise. Both the judge’s decisions expressly turned on whether it was ‘ necessary and proportionate ’ to grant anonymity. That language clearly reflects a Convention analysis and the balancing process which the judge was required to undertake. The question implicit in the judge’s reasoning process is whether the consequences of disclosure would be so serious an interference with the claimant’s rights that it was necessary and proportionate to interfere with the ordinary rule of open justice. It is clear enough, in my view, that he was engaging in a process of evaluating the claimant’s case against the weighty imperatives of open justice.

(6)

It is in that context that the judge rightly addressed the question of whether the claimant had adduced ‘ clear and cogent evidence ’. He was considering whether it had been shown that the balance fell in favour of anonymity. The cases all show that this question is not to be answered on the basis of ‘ rival generalities ’ but instead by a close examination of the weight to be given to the specific rights that are at stake on the facts of the case. That is why ‘ clear and cogent evidence ’ is needed. This requirement reflects both the older common law authorities and the more modern cases. In Scott -v- Scott at p.438 Viscount Haldane held that the court had no power to depart from open justice ‘ unless it be strictly necessary ’; the applicant ‘ must make out his case strictly, and bring it up to the standard which the underlying principle requires ’. Rai is authority that the same is true of a case that relies on Article 8. The Practice Guidance is to the same effect and cites many modern authorities in support of that proposition. These include JIH -v- News Group Newspapers Ltd [2011] 1 WLR 1645 where, in an often-cited passage, Lord Neuberger of Abbotsbury said at [22]:

‘Where, as here, the basis for any claimed restriction ultimately rests on a judicial assessment, it is therefore essential that (a) the judge is first satisfied that the facts and circumstances of the case are sufficiently strong to justify encroaching on the open justice rule …’ …”

123.

Turning to the Claimants’ recent application for a 5.4C Order, the MPoC, as a statement of case, is publicly available under CPR 5.4C(1). The status of the Individual Schedules, and whether they fall within the definition of a “ statement of case ” for the purposes of CPR 5.4C(1) is less clear. On the one hand, it might be contended that the Individual Schedules do not fall within CPR 5.4C(1) because they are “ documents filed with or attached to the statement of case, or intended by the party whose statement it is to be served with it ”. On the other hand, the Individual Schedules were ordered to be provided following the Defendant’s Application for Part 18 Further Information. Part 18 Further Information does fall within the definition of a statement of case (whether provided voluntarily or pursuant to a Court order): CPR 2.3(1).

124.

If the Individual Schedules do not fall within the definition of “ statement of case ”, then a third party wanting to obtain a copy of an Individual Schedule would have to make an application under CPR 5.4C(2). The power to restrict third-party access to documents from the Court’s records, under CPR 5.4C(4), is limited to the categories of document available as of right under CPR 5.4C(1): ABC Ltd -v- Y Ltd [2012] 1 WLR 532 [9]. An order prospectively prohibiting third-party access to other documents on the Court file without the permission of the Court is otiose. Third parties can only obtain such documents with the permission of the Court under CPR 5.4C(2). When considering an application under that rule, the Court has power to impose conditions on such access, including directions that part(s) of the documents should be redacted before copies are provided to third parties: see Re Mobile Voicemail Interception Litigation [2012] 1 WLR 2545 .

125.

The Defendant submitted that the Individual Schedules are statements of case, relying upon CPR 2.3(1). Although I have not received detailed submissions on this point, tentatively, I would conclude that the Individual Schedules do fall within the definition of “ statements of case ” within CPR 5.4C(1) because they were filed by the Claimants, pursuant to a Court order, to provide further information about their claims (see [39] above). It would follow, therefore, that, subject to the Court making an order, under CPR 5.4C(4), restricting such access, a third party is therefore entitled to obtain a copy of any Individual Schedule from the records of the Court.

I: Anonymity Application and other derogations from open justice

(1)

Submissions

(a)

Claimants

126.

In relation to the 9 Claimants who maintain their application to be anonymised in the claim, Mr Aslett submitted that the evidence that has now been provided by the Claimants convincingly establishes why a derogation from open justice should be granted in their cases. The common theme in the evidence is that each of these Claimants is a police officer whose identity is closely protected in his/her operational role.

127.

As to the further application to withhold their addresses, the Claimants submit that the evidence that has now been filed demonstrates that police officers are advised to keep their home addresses confidential. The individual statements that have been provided by the Claimants expand on particular concerns that the individual Claimants have about their addresses being available from the Court’s records. They also explain why the Claimants seek a 5.4C Order.

(b)

Defendant

128.

The Defendant has taken largely a neutral stance on the Anonymity Application. Mr Sharland KC has, however, pointed to several features of the Anonymity Application which, he submits, are unsatisfactory.

(1)

In the witness statement that supported the original application to the Master, Mr Hayes stated: “ The application is brought by the 474 individuals listed… who have all provided instructions… to bring a claim against the Defendant and make this application. ” That is to be contrasted with the position, as it later emerged, that instructions had only been taken from some of the Claimants which necessitated a substantial further exercise to be undertaken, ultimately leading to the Anonymity Application being abandoned by all but 9 Claimants.

(2)

The Defendant raised concerns about the original grant of the Anonymity Order by letter dated 14 May 2021.

(3)

In the underlying claims, the Claimants do not contend that their addresses are confidential or private information.

(2)

Decision

129.

I am satisfied that the 9 Claimants who maintain the Anonymity Application should retain the anonymity previously granted by the Master. The evidence that has now been provided to the Court is clear and cogent and convincingly establishes that the nature of their work as police officers requires them to be anonymised in these proceedings.

130.

Turning to the application to permit the Claimants to continue to withhold their addresses from the Claim Form (and other documents required to be open to public inspection on the Court file), the further evidence that the Claimants have now filed does now satisfy me that the order should continue. I do not find the evidence of the individual Claimants, as to their particular reasons for wishing to withhold their addresses, on its own, to be sufficient to justify the continuation of the withholding order. If that had been the only evidence, the Claimants would have stood in a position that was similar to the Claimants in the IPSA case. The evidence that has satisfied me that the withholding order should continue is the evidence that shows that, as a matter of policy, the Claimants have been very strongly advised by their police force to protect the confidentiality of their home addresses. That is not to say that a police officer who brought, for example, a personal injury claim following a road traffic collision, would be entitled to withhold his/her address from the Claim Form. If his/her occupation was not relevant to the issues in the case, it is difficult to see why a withholding order for the claimant’s address would be necessary. Here, however, the nature of the claim, and the issues it raises, means that it will be immediately apparent that each of the Claimants is a police officer. As such, requiring each Claimant to provide his/her address would undermine the clear policy of the Sussex Police that officers should protect their addresses. I am therefore satisfied that the limited interference with the open justice principle, by permitting the Claimants to withhold their home addresses, is necessary and proportionate and has now been established by clear evidence.

131.

However, it must be recorded that the original Anonymity Application, in seeking anonymity for (and to withhold the addresses of) the whole cohort of 474 Claimants was unjustifiably wide. The fact that a claim is being brought on behalf of a very large number of Claimants does not lessen the obligation to provide proper evidence in support of each individual Claimant’s application. Unless there are very unusual circumstances in a particular case, there are no categories of litigant who are entitled to anonymity or other derogations from open justice. Each Claimant who wishes to seek such a derogation must demonstrate, by evidence of the required cogency, that such an order is necessary, and its terms proportionate. The fact that, in this case, as soon as the Court challenged whether the Anonymity Order could be justified for the entire cohort of Claimants, all but 9 of the Claimants withdrew their applications stands as an alarming confirmation of the lack of justification for an order which represented a very significant derogation from open justice. The continuation of the Anonymity Order for 9 Claimants, and the withholding order for the addresses of the Claimants has only been justified by the further evidence that the Claimants have filed.

132.

There is force in the Defendant’s criticisms of the original application for the Anonymity Order. There was, in my judgment, a serious lack of rigour in the Claimants’ approach.

133.

I am not presently prepared to grant the 5.4C Order sought by the Claimants. Despite Mr Hayes’ protestations to the contrary (see [80] above), the Claimants have, again, adopted a blanket approach that is simply inappropriate when dealing with derogations from open justice. Much of the information contained in the Individual Schedules is anodyne and, in respect of which, there can be no justification from departing from the open justice principle that a non-party is entitled to obtain an unredacted copy of the Individual Schedules.

134.

The justification largely advanced by the Claimants for making the 5.4C Order is that, for some of the Claimants, public access to the Individual Schedule will reveal his/her operational role in the police. Even if that concern did justify the imposition of some restriction on third party access to the Individual Schedules (and I remain to be convinced by evidence that it does), it could only justify withholding the relevant part of the Individual Schedule (by permitting third parties to obtain only a redacted version of the relevant Individual Schedule). It could not justify withholding the entire document. Such an order would represent an unnecessary and/or disproportionate interference with open justice. Mr Hayes’ suggestion that a third party could apply to be granted access to any Individual Schedule is to reverse the important open justice presumption of CPR 5.4C(1). It is for a party to demonstrate that a restriction on access to documents that fall within 5.4C(1) is necessary and proportionate, not for a third party to demonstrate that s/he should be provided with the document(s).

135.

The Claimants have simply failed to perform a focused exercise to identify the particular information, in any Individual Schedule, they contend should be withheld from public access. Instead, they have sought an order that all Individual Schedules should be withheld from public inspection under 5.4C(1). Such an order cannot be justified. Its terms would be disproportionate because it would restrict public access to information contained in the Individual Schedules in a way that the Claimants cannot (and do not seek to) justify as necessary. As such, the application is refused.

136.

I am not prepared to spend time going through over 400 Individual Schedules, and related witness statements, to attempt to identify what restrictions any particular Claimant might be able to justify, applying the principles I have identified. It is for a Claimant seeking a derogation from open justice to demonstrate that such a restriction is necessary. There is also an element of potential confusion in the witness statements. For those Claimants who have abandoned their Anonymity Application, they have accepted that they will be identified as police officers in this claim. That is inevitable, given the parameters of the litigation. If any individual Claimant wishes now to seek a narrow and focused redaction of particular information that s/he contends should be withheld from his/her Individual Schedules available to third parties from the Court’s records, then s/he can make a further application and the Court will determine each application on its merits.

J. Dismissal Application

(1)

Submissions

(a)

Defendant

137.

The Defendant’s primary submission is that, without evidence that the ABSs have been opened and read by a third party, the claims for both misuse of private information and breach of data protection have no real prospect of success. Mr Sharland KC contends that publication is an essential element of each cause of action. The purely inferential case that a letter addressed to one of the Claimants which was sent to a former address would have been opened and read by a third party has no real prospect of success.

138.

Separately, in his submissions on behalf of the Defendant, Mr Sharland KC has made a sustained attack on the trivial nature of the claims that have been brought and the wholly disproportionate way in which the litigation has been conducted. The Defendant argues that it is wholly unreal to suggest that the mis-addressing of the ABSs could have caused police officers any real distress or upset (or caused or exacerbated psychiatric harm). He points to the levels of incurred and estimated costs for the Claimants to argue that no sensible litigant would conduct litigation on this basis, given the very modest levels of compensation that most Claimants are seeking or expect to receive. Mr Sharland KC argues that this is a case where the Court should dismiss the claims under the Jameel jurisdiction.

(b)

Claimants

139.

Although not resiling from his inferential case as to publication of the ABSs, Mr Campbell KC submitted that “ the fundamental act of putting private information in danger is sufficient [use] to fall under the concept of misuse ”. In other words, that, whether or not the mis-addressed ABS was actually opened and read by a third party, the mere act of wrongly addressing the ABS is an actionable “ misuse ” of private information. Mr Campbell KC was clear in his submissions: “ the positive misuse by the Defendant here [is] in sending to the wrong address: that is the misuse ”. The tort of misuse of private information is, on the Claimant’s submissions complete at this point. What happens subsequently to the ABS – whether it is returned unopened, never resurfaces or is returned opened – is a matter that goes only to the quantum of damages.

140.

The Claimants’ fallback position is that if they are required to demonstrate that the ABS was opened and read by a third party – or “ published ” to borrow from the lexicon of defamation – then the Claimants rely upon the inferential case that the ABSs would have been opened. In this respect, Mr Campbell KC relied upon the – admittedly few – examples where the Claimants can show that the envelopes were opened.

141.

When considering the Dismissal Application, Mr Campbell KC emphasises that this is a developing area of the law and he relies on the authorities that suggest that, in such cases, it is better for the Court to allow the matter to proceed to trial so that the law can be applied to facts as found on the evidence rather than on assumed facts.

142.

On the issue of Jameel abuse, Mr Campbell KC submitted that the Court can fashion a way of resolving these claims in a proportionate manner. He submits that test cases should be selected, a proposal he said had been made by the Claimants’ solicitors from the outset. Selection of test cases would resolve some of the core issues that are common to all the claims, e.g. the various defences that have been raised by the Defendant to the alleged breaches of data protection. He makes the powerful submission that the Defendant is contesting liability. If not conceded, that issue will need to be resolved by the Court. That, he argues, will be best achieved (at proportionate cost) by selecting a sample of test cases in which the point can be isolated and determined for the benefit of the whole cohort. He referred me to the decision in Lancaster -v- Peacock [2020] EWHC 1231 (Ch) , in which Fancourt J directed that 12 sample cases be identified from a group of 156 claimants. More generally, Mr Campbell KC acknowledged the Court’s concerns as to the scale of the costs that had been incurred already, but contended that the better course was not to dismiss the claims as Jameel abusive, but to disallow some of the incurred costs.

(2)

Decision

143.

In my judgment, to have a viable claim for misuse of private information and/or data protection, each Claimant must show that s/he has a real prospect of demonstrating that the ABS was opened and read by a third party. Without that, the relevant Claimant would have no real prospect of demonstrating that there had been “ misuse ”, an essential element of the tort of misuse of private information. The authorities I have identified (see [91]-[95]) establish such a principle. In TLT the publication by the Defendant was negligent and unintended, but there was nevertheless publication.

144.

For the purposes of clearly isolating the principle, it is helpful to consider the cases of the cohort of Claimants who ultimately did receive their ABS unopened. For those Claimants, an inferential case that the ABS was opened (and read) by a third party cannot be sustained. On the contrary, there is positive evidence that the ABS had not been opened (or read) by anyone else. Can these Claimants nevertheless bring a claim for misuse of private information and/or data protection in respect of the period before the ABS was returned? In my judgment, the answer is no.

145.

I reject the submission that these Claimants can advance a claim on the basis that, until returned, their personal information/data was “ in danger ” or “ at risk ”. The general law of tort does not generally allow recovery for the apprehension that a tort might have been committed; a person crossing a road cannot recover damages (whether for distress or otherwise) for almost being struck by a passing lorry or for a defamatory letter that was never actually received by its intended recipient. To be entitled to any remedy, a claimant must demonstrate that s/he is the victim of a tortious wrong. A near miss, even if it causes significant distress, is not sufficient. Without the contents of the ABS coming to the attention of a third party there is no viable claim for misuse of private information. In simple terms, there has been no interference with the Article 8 rights of the relevant Claimant because the privacy of the information contained in the ABS has not been compromised at any stage.

146.

The same is true for a civil claim for data protection. Data breach cases are premised on the personal data of the relevant claimant having been compromised; usually accessed by, or provided to, a third party. Shorn of the claim for “ loss of control ”, the Claimants’ claim is essentially one for Unlawful Processing by sending the ABS to the wrong address. But, if the ABS has not been opened or read by a third party, there has been no real “ processing ”. It was a near miss. I accept that there are wider policy considerations underpinning the data protection regime. Concepts of placing the data “ at risk ” have greater resonance in the regulatory context. A person who leaves a laptop on a train, from which unencrypted personal data could readily be accessed, may face regulatory action even if the laptop is recovered without any data having been compromised.

147.

In consequence, the claims in which the ABS was returned unopened fail to disclose reasonable grounds for bringing a claim for misuse of private information and/or data protection and will be struck out under CPR 3.4(2)(a). In the alternative, I would have found that these claims should be summarily dismissed under CPR Part 24 as having no real prospect of success.

148.

Next, I will consider the cases in which the ABS has not been safely returned and where the relevant Claimant relies upon an inferential case that the ABS has been opened and read by a third party (see [33]-[34] above). In my judgment, in these claims, the relevant Claimant has no real prospect of success. As pleaded, I would also hold that the bare inferential case on publication falls to be struck out pursuant to CPR 3.4(2)(a). Unless the relevant Claimant can plead a viable case, with a real prospect of success, that his/her ABS was actually opened and read by a third party, the claim will be struck out and/or dismissed under CPR Part 24.

149.

The drawing of inferences is an evidential process. It is a process whereby a Court concludes that the evidence adduced enables a further inference of fact to be drawn. It is to be contrasted with speculative guesswork or wishful thinking: see Amersi -v- Leslie [2023] EWHC 1368 (KB) [158]; Blake -v- Fox [2024] EWHC 146 (KB) [53].

150.

The authorities relied upon by Mr Sharland KC (see [98]-[99] above) demonstrate that there may be cases where the Court will draw the inference of publication of a letter beyond the named recipient. But the factual premise for drawing such an inference is, in those cases, solidly based. Absent some facts that would compel a different conclusion, the Court will not draw the inference that a letter addressed to a named recipient, clearly marked “ private and confidential ”, will be opened by a third party who is not the named recipient or authorised by him/her to open correspondence addressed to named recipient.

151.

In the Claimants’ MPoC, the case that the ABSs were opened (and read) by third parties is pleaded as a bare inference. No further particulars are provided. It is impossible, therefore, to identify the facts that are being relied upon to support the invited inference. Such a pleading fails to disclose a proper basis for the inferential case and falls to be struck out under CPR 3.4(2)(a). But beyond that, and looking at the evidential position, the Claimants’ position does not improve.

152.

The fact that, in a handful of cases, there is some evidence that the relevant ABS was opened does not supply a reliable evidential foundation for the drawing of an inference that ABSs were generally opened by third parties. On the contrary, the very few instances when this happened is evidence that (if anything) supports an inference that private correspondence is not generally opened by someone who is not the addressee. Effectively, the Claimants have tried to reverse the burden of proof and require the Defendant to demonstrate that the ABS was not opened (and read) by a third party in each claim. As a matter of principle, that is impermissible, but the evidence paints an entirely different picture. Of the 14 cases where there is direct evidence that the ABS was opened, 11 were opened by a relative of the addressee (opened perhaps believing that it was acceptable for him/her to open the envelope or in error) (see further [61] above). In only 2 cases, in a cohort of some 450 individuals, is there evidence that the ABS was opened by someone other than a family member or colleague. That evidence speaks for itself. It effectively destroys any inferential case that the ABSs were generally opened and read by third parties.

153.

If, as I have found, each Claimant must demonstrate that his/her ABS was opened and read by a third party, then any claim which relies solely upon this inferential case has no real prospect of success. Ordinarily, the consequence of this finding would be that the relevant claim would be dismissed under CPR Part 24. The Claimants have not suggested that further evidence is likely to be available at trial on this issue. I will hear submissions when this judgment is handed down as to the consequential orders to be made. A Claimant who believes that s/he might be able to provide actual evidence that the ABS was actually opened and read by a third party may, even at this late stage, be able to persuade the Court to give him/her one last chance. Against that, the Defendant may very well say that the Claimants have known that an attack was being made on the viability of claims that relied solely on an inferential case as to publication and that they have had ample opportunity to advance a reformulated claim but did not do so.

154.

The effect of the decisions I have made would be to leave 14 claims in which the relevant Claimant has a real prospect of demonstrating that his/her ABS was opened and read by a third party.

155.

From the information that has been put forward in the Individual Schedules, the 14 claims where the ABSs were opened would appear to be very far from being serious cases (see [61] above). If the claims go further, the Claimants may face further attacks on the viability of the relevant claim depending upon the evidence that is ultimately adduced at trial. Some may ultimately be found to be trivial and fall to be dismissed on the basis that they fail to surmount the threshold of seriousness.

156.

In particular, the 14 Claimants may yet have to surmount the evidential hurdle that the ABS was read by the person who opened the envelope (or someone else). In all but one of the cases it is not clearly stated, in terms, whether the ABS was read, and if so, how much of it was read. In the case of the 258 th Claimant (see [61(9)] above), she was told that her family had not looked at the contents. In half of the cases, the relevant Claimant’s case is that the ABS was (or may have been) opened (or received) in error (see cases of the 75 th , 111 th , 307 th , 342 nd , 359 th , 386 th and 472 nd Claimants [61] above). Unless the Defendant concedes that the ABS was read by a third party in each of these cases, then the Claimants will bear the burden of demonstrating, at trial, that it was. Given the evidence as to the layout of the first page of the ABS, the Claimants may also need to demonstrate that more than the first page of the letter was read.

157.

Some aspects of individual Claimants’ claims for loss and damage can be seen, even now, to be hopeless. For example, the 359 th Claimant’s ABS was opened by his father in error (he shares the same first initial of the Claimant) (see [61(12)] above). It was then forwarded to him. On this Claimant’s case, the extent of the “ misuse ” of his private information and/or processing of his personal data (even assuming that his father read the whole ABS) arose from publication to one person; the Claimant’s father. Set against those basic facts, the expressed fears of the 359 th Claimant (in support of his claim for distress damages) that the information within the ABS might be used to identify and target him, his family or his current home appear to be completely unreal. Unless it is to be suggested that the Claimant’s father took a copy of the ABS (or the information it contained) before returning it, the Claimant’s concern that the information in the ABS could be “ misused at any time ” would appear to be equally baseless. A Claimant’s prospects of success are not going to be improved by making exaggerated claims as to the impact of the ABS being opened (and read) by a third party.

158.

Nevertheless, the appropriate time for an assessment of the evidence in relation to each of the Claimant’s claims is at a trial. In part because of the way these claims have been pursued, the Court has not been able to drill down into the details of these 14 claims. I cannot be satisfied, at this stage, that none of these Claimants has a real prospect of surmounting the threshold of seriousness in his/her claim. The ABS did contain some information that went beyond the banal and anodyne. If, for example, details of the individual Claimant’s expected annual pension were published to (i.e. read by) a third party, the relevant Claimant does have a real prospect of demonstrating the constituent elements of a misuse of private information claim (and so to a data protection claim). The fact that any award of damages might be very modest, if a claim were to succeed, does not affect the viability of the claim. In respect of that claim, each Claimant has provided details of the distress (or equivalent) that s/he claims to have suffered. On first impression, it might seem unlikely that the opening of the ABS could have caused much distress to a police officer, but each Claimant is advancing a claim, verified with a statement of truth, that s/he has been caused distress (or equivalent). A Court could only reject evidence in support of such a claim after all the relevant evidence has been tested at trial. In short, the claim cannot be struck out or dismissed under Part 24.

159.

In light of my conclusions, it is not necessary (nor is it desirable) for me to reach a concluded view on the very interesting points as to whether the law in this jurisdiction imposes a threshold of seriousness in data protection claims. Given its potential importance, and the way the point arose (and had to be argued) in this case, I think it is better for me not to express any view. It is sufficient, for the claims of the remaining Claimants, that I have decided that whether each Claimant could surmount a threshold of seriousness (were one found to apply in data protection claims) is a factual question that, like the similar question that applies in misuse of private information claims, can only fairly be resolved at a trial. Given the potential importance of the point, this is a case where the Court should resolve the point of law on threshold of seriousness on the basis of facts found after a trial rather than facts assumed for the purposes of a summary judgment or striking out application (see [87(10)] above).

160.

Therefore, and finally, I turn to the Defendant’s submission that I should nevertheless dismiss these 14 claims, under the Jameel jurisdiction on the grounds that their continued litigation is an abuse of process. The starting point for this analysis must be that each Claimant has a viable cause of action with a real prospect of success. In the final analysis, it may well be that, if successful, the claims of the remaining 14 Claimants will only achieve very modest damages, but for the reasons explained in Alsaifi ([113] above) that is only one factor that the Court considers when deciding whether continued litigation of the claims would be Jameel abusive.

161.

The decisions I have made earlier in this judgment mean that (subject only to a last-ditch effort to amend – see [153] above) only 14 claims (from a remaining cohort of over 450) will be going forward. The scope and complexion of this remaining litigation has therefore changed radically (and most of Mr Sharland KC’s objections based on the vast sums in costs that have been expended substantially fall away). The Court is no longer dealing with an unwieldly number of Claimants litigating a pseudo-class action in a way that is alleged to be wholly disproportionate to the likely sums that would be achieved in compensation were the claims to succeed. There are now 14 claims. The question for me is whether, for these claims, the Court can fashion a procedure by which the claim can be adjudicated in a proportionate way. I have no difficulty in answering that the Court can meet this challenge.

162.

Given what has happened to the bulk of the cohort of claims, the figures for costs (both incurred and budgeted) that have been produced to the Court have now substantially been overtaken by events and have limited continuing relevance to the issue that now presents for decision. Put simply, I do not have reliable costs information as to how much it will now cost to progress the remaining 14 cases to resolution at a trial. I suspect that there is also likely to be a degree of taking stock to be done on both sides and there may well be a narrowing of issues. At this stage, I lack the basic material upon which to make the assessment of the value of what the remaining Claimants hope to achieve by way of compensation and the likely costs of doing so.

163.

Had liability been admitted by the Defendant in this case, leaving only an assessment of damages, the most appropriate directions would appear to be to transfer the remaining 14 cases to the County Court to be allocated to the small claims track (as happened in Cleary -v- Marston (Holdings) Ltd [2021] EWHC 3809 (QB) ). The cost/benefit analysis would change significantly if the remaining claims were transferred to the County Court small claims track.

164.

Nevertheless, one of Mr Campbell KC’s strongest points remains that, for as long as the Defendant continues to dispute liability on the grounds that it was a data processor, rather than a data controller, there is a common issue between the 14 claims that must be resolved. The most convenient way to resolve that issue may well be for it to be determined, as a preliminary issue, in the High Court. Once that has been resolved, the way would be clear (if liability has not been determined against the Claimants or the claims do not otherwise resolve by agreement) to transfer to the County Court for an assessment of damages.

165.

For all these reasons, I am very far from satisfied that the Court has reached the point whereby it is impossible to fashion a procedure for resolving the remaining 14 claims at proportionate cost. I decline therefore to strike out the remaining 14 claims as an abuse of process.

K. Conclusion and next steps

166.

For the reasons given in this judgment:

(1)

save for the 14 claims identified in [61] above, the remaining claims will be struck out or dismissed;

(2)

the Anonymity Application is granted in respect of the 9 Claimants who pursued it;

(3)

the Claimants’ Application for the Court to continue to withhold their addresses from documents available to third parties from the Court record pursuant to CPR 5.4C(1) is granted; and

(4)

the Claimants’ Application for a 5.4C Order is refused.

167.

At the hearing when this judgment is handed down, I shall hear arguments on the consequential orders, including directions for the 14 remaining claims. The parties are invited to identify what they can agree, and what matters the Court will need to resolve. There are likely to be substantial issues as to costs, including the costs of the various applications and the costs of the Second Claim. The parties will need to identify clearly all the issues that need to be resolved (either by agreement or decision of the Court).

Emeklilik Bildirimindeki Veri İhlali Taleplerinin Elenmesi

Türkçe özet

Hukuki mesele

Sonuç

Karar metni