CA-2024-000578 - [2025] EWCA Civ 1117

This is the second remaining head of damage pleaded in the Master Particulars. It arises in only 42 of the claims. In those claims the individual schedules summarise the appellant’s case and a medical report has been served which amplifies the pleading. In each of the three exemplar reports what is alleged is that the appellant suffered psychological effects consequential on distress or some other emotional reaction they experienced upon learning of the data breach. One of the exemplar reports identifies symptoms of “stress, mood disturbance and general anxiety” suffered for about five months, all being wholly or partly attributable to “the index accident”. The cause of these is identified as “persistent worries of what could happen to his children and wife ... when he was not at home if it was targeted by criminals.”

A second report identifies all of the above-mentioned symptoms, as well as “concentration problems” and “social withdrawal” partially attributable to the index event. These are said to flow from fear of the appellant’s data getting into the wrong hands, including fear of identity theft and a belief that people who want this appellant dead would be able to track him down using the “leaked” information which “could be easily sold and accessed on the dark web”.

The third exemplar report identifies the self-reported problems “immediately after the accident” in this way: the appellant was “distressed by the initial notification”, felt that it “did not recognise or acknowledge the gravity of the data breach or its implications” and was “worried about fraud and, more so, about the possibility of her sensitive personal information falling into the wrong hands”. The psychologist’s opinion in this case is that as a result of the “index event” this claimant suffered exacerbation of pre-existing symptoms of anxiety, low mood and symptoms of Obsessive Compulsive Disorder. These were “moderate” for about six months becoming “mild/minimal” thereafter.

It may be that for the purposes of Article 82 harm of these kinds should be classified as “material damage”. In domestic law recognisable psychiatric harm has long been categorised as personal injury and that approach appears consistent with international law: see Lloyd v Google [92], cited above, Shehabi v Kingdom of Bahrain [2024] EWCA Civ 1158, [2025] 2 WLR 467, and the recent decision of the Irish Supreme Court in Dillon v Irish Life Assurance [2025] IESC 37. We received no argument on that issue. I do not think the classification matters in this case, however. The principal reaction identified in these reports was the one I have discussed earlier: fear of what might be done with the information in the ABS. That is clearly pleaded as a head of loss.

We have no basis on which to reject the expert opinions in the psychologists’ reports or the factual assertions on which they are based. But the viability of these claims seems to me to depend on the issue I have already discussed. If the appellant’s fears of what might happen were objectively well-founded, compensation for any consequential impact on the appellant’s mental health is in principle recoverable. If, on the other hand, the fears were not well-founded, the claim for compensation must fail in its entirety. To that extent, it appears to me that this category of case raises no separate issue. These claims will stand or fall according to the court’s conclusions on the objective reasonableness of the stated fears.