This post explores the future implications of recent decisions clarifying the availability of damages and the thresholds for claimants seeking redress in privacy and data protection class actions.

Recent English and Dutch court decisions indicate a clear trend towards lowering the barriers for claimants seeking redress in privacy and data protection class actions. Courts in both jurisdictions have indicated an increasing willingness to recognise a broader range of claims, making collective redress more accessible and expanding the scope of claims that can be brought in privacy class actions. These developments are set to shape the landscape of privacy litigation in the coming years, which claimants in other jurisdictions may seek to extrapolate from.

Two lessons from Farley v Paymaster (trading as Equiniti) [2024] EWHC 283 (KB)

In August 2019, Equiniti (which administered the pension scheme for Sussex Police) posted a large number of annual benefits statements to out-of-date addresses, prompting over 400 current or former police officers and members of the pension scheme to issue proceedings on a single claim form. The claimants alleged that this was an infringement of the GDPR and sought compensation for injury to feelings and (in some cases) psychiatric injury based on a fear of third-party misuse of their personal data.

In February 2024, following an application by Paymaster, the English High Court struck out all of the claimants’ statements of case as disclosing no reasonable basis for a claim, save for the 14 claimants who Mr Justice Nicklin concluded had a real prospect of demonstrating that their statements had been opened/read by a third party. The claimants appealed this decision.

The claimants did not challenge the High Court's conclusion that they could not show that their statements were opened/read. Instead, they contended that Nicklin J was wrong to regard disclosure as an essential ingredient of a viable data protection claim. The claimants' case was that they had a tenable case that the posting of their statements to the wrong addresses involved an infringement of their data protection rights.

Paymaster invited the Court of Appeal to uphold Nicklin J's decision to dismiss the claims on the basis that the claims for compensation were factually incredible, insufficient or untenable as a matter of law.

In August 2025, the Court of Appeal handed down its judgment.

• The infringement issue: Each claimant had pleaded a reasonable basis for alleging that Paymaster's mistake involved infringement of the GDPR. Proof that the data had been disclosed (i.e. the statements opened/read) was not an essential ingredient of an allegation of processing or infringement. The claimants' appeal was allowed.
• The compensation issue: The claims could not be dismissed for failing to meet a threshold of seriousness, as Paymaster contended. There is no such threshold under EU data protection law, and the Court found that there was no good reason to find that it existed under English law.

Paymaster was granted permission to appeal the Court of Appeal's decision by the UK Supreme Court in December 2025.

"User damages" in Gormsen v Meta

In February 2024, the UK Competition Appeal Tribunal ("CAT") certified the re-formulated opt-out collective proceedings brought by Dr Liza Lovdahl Gormsen (the Class Representative ("CR")) against Meta, the parent company of Facebook, under section 47B of the Competition Act 1998 for abuse of dominance in the Personal Social Network Market or the Social Media Market.

Two abuses were alleged. First, the CR claimed that in exchange for 'free' access to Facebook, a user had to agree to Facebook's Terms of Service or would in any event be deemed to have accepted them. These included giving Facebook permission to collect, share, and otherwise process users' personal data, both on- and off-platform, and to view targeted advertising alongside other content on the platform, without payment. The CR argued this was an abuse as it was a condition imposed on Facebook users pursuant to a "take-it-or-leave-it" offer, depriving them of an important choice as regards their data. Secondly, the CR alleged that Meta's collection of off-Facebook data involved the imposition of an excessive and unfair price.

The CR alleged that these amounted to an abuse of Meta's dominant position in the Personal Social Network Market or Social Media Market.

In September 2025, the CAT ruled on the CR's application to amend her case to introduce a new head of damage referred to as "user damages". User damages were sought to compensate the class for the loss of the value of exercising their right to control the collection and/or use of their personal data. The amendment aimed to combat an argument that Meta could run at trial that Meta would never have paid for the data in question, in which case the class would have suffered no loss.

The CAT concluded in their judgment that it was far from straightforward whether user damages are available in competition cases (contrary to Meta's submission that they definitively are not), but that the case had reasonable prospects of succeeding at trial (which is the threshold that has to be met for amendments introducing a new claim). Accordingly, the amendment was allowed.

Meta subsequently sought permission to appeal the judgment, but permission was refused by the CAT in October 2025. Trial is set for 2027 and is expected to answer the question as to whether user damages are, in fact, available in competition cases.

(Non-)material damage in the Dutch TikTok case

In the Dutch TikTok case, three claim organisations initiated proceedings under the Dutch Act on redress of mass damages in collective action ("Wet afwikkeling massaschade in collectieve actie" or "WAMCA"), seeking collective redress against several TikTok entities ("TikTok") for alleged privacy infringements.

The claim organisations seek compensation for both material (i.e. financial) damage and non-material (i.e. intangible) damage. Taking each in turn:

• according to the organisations, the compensation for material damage consists of the profits TikTok allegedly generated at the expense of its users and/or the economic value of the personal data over which users purportedly lost control as a result of TikTok's conduct; and
• the organisations claimed compensation for non-material damage resulting from negative emotions (such as anxiety, anger, stress and indignation) allegedly experienced by TikTok users as a consequence of losing control over their personal data.

In the first instance, the Amsterdam District Court (at the admissibility stage), found that the claims for compensation for material damage were sufficiently similar (amongst the persons represented by the claim organisations) to proceed, though this similarity would need to be examined in greater detail at the merits stage. However, the Amsterdam District Court held that claims for compensation for non-material damage were too dependent on the individual circumstances of the persons represented by the claim organisations. Consequently, the Court concluded that those claims did not meet the similarity requirement under Article 3:305a(1) of the Dutch Civil Code and therefore could not be pursued collectively.

However, in October 2025, the Amsterdam Court of Appeal overturned this decision. The Court of Appeal held that claims for compensation for both non-material and material damage arose from the same alleged breaches and factual circumstances, meaning that the assessment for each TikTok user involved sufficiently similar legal and factual questions. The presence of significant differences among TikTok users – such as those related to age categories or users who may not have suffered non-material damages – did not preclude collective proceedings. The Court noted that the explanatory notes assisting interpretation of the legislation recognises that not every member of the group will have suffered the same level of damage, and this can be addressed by categorising claimants for the purpose of determining compensation.

The Amsterdam Court of Appeal adopted a similar approach in its earlier judgment in the Oracle case in June 2024.