UK Speedbrief: The importance of marking pensions correspondence ‘private and confidential’

Why should I read this?

This speedbrief will help you understand a pensions administrator’s liability if they breach data privacy law by accidentally sending someone’s data to unintended people.

What was the case about?

In summary, the case confirms the importance of marking postal communications as “private and confidential” in defending claims for compensation following a data breach.

As background, as a result of a Supreme Court decision in November 2021, it’s clear that the Courts don’t like to award compensation to someone whose data has been accidentally disclosed to unintended people simply because that person has ‘lost control’ of their data. The Courts want to see something more - such as a data subject’s financial loss or distress.

This latest case - Farley v Paymaster - is a decision of the High Court in February 2024 which continues this trend. The key facts are that:

• A pensions administrator sent the benefit statements of c 500 Sussex police officers to their former (i.e. outdated) home addresses. The statements included the member’s name, date of birth, NI number, and salary / pension information, and an indication that they were a police officer. The pensions administrator was acting as Sussex Police’s data processor.

• The ICO was informed and confirmed that no further action would be taken against Sussex Police, as controller. The ICO noted that Sussex Police had notified the administrator of the change of addresses, but that the administrator had failed to update its systems.

• The members then brought a group claim against the pensions administrator on the basis of a breach of data privacy legislation and misuse of private information.

• The letters containing the benefit statements were marked “private and confidential” and included a return address on the outside of the envelope.

What did the Court decide?

The Court dismissed almost all of the claims against the pensions administrator.

Importantly, most of the claims assumed (i.e. relied on an inference) that the benefit statements had been opened by the people that now lived at the person’s former home. The Judge however stated: “absent some facts that would compel a different conclusion, the Court will not draw the inference that a letter addressed to a named recipient, clearly marked "private and confidential", will be opened by a third party who is not the named recipient or authorised by him/her to open correspondence addressed to named recipient”.

The only claims which were allowed to proceed were those of 14 members who had pleaded a positive case that their benefit statement had been opened by a third party. However, the Judge indicated that even those cases may face difficulties going forwards.

What does this mean for me?

Pension trustees, administrators and other data controllers should focus on:

1. The importance of address verification, such as using tracking and tracing services to ensure addresses are correct
2. Generally, keeping data accurate and up-to-date
3. Marking envelopes containing correspondence as “private and confidential”, and including a return address on the envelope
4. Taking immediate steps to try to recover incorrectly addressed documents on discovery of a data breach

What else do I need to know about this case?

It is important to note that, while group claims like these may be difficult to bring, the ICO can take separate enforcement action in respect of data breaches.

For example, the Judge noted that a person who leaves a laptop on a train, from which unencrypted personal data could be readily accessed, could face regulatory action even if the laptop is recovered without any data being compromised.