A High Court judge has ruled that thousands of people affected by a major data breach at Capita can continue with their legal action against the outsourcing group, in a decision being described as a landmark for large-scale data privacy claims in the UK.
In a judgment handed down on 9 February, Master Dagnall rejected arguments from Capita’s legal team that solicitors acting for more than 8,000 claimants had abused the court process. Capita had claimed that the use of repetitive or generic descriptions of mental distress following the 2023 cyber attack undermined the validity of the claims.
The ruling allows the case, brought by Barings Law, to proceed and is likely to be closely watched by companies, regulators and claimant law firms involved in data protection litigation.
Barings launched the action in 2023 after a cyber attack exposed the personal data of around 6.6 million individuals, including Capita employees. The compromised information is understood to include sensitive financial and pension details.
Capita’s lawyers had applied to have the claims struck out, alleging that Barings improperly influenced evidence relating to claimants’ anxiety and psychological distress following the breach. However, Master Dagnall concluded that Capita had failed to demonstrate that any abuse of process had occurred.
In his judgment, the judge said solicitors had a “real basis” and were entitled to a “wide latitude” when preparing evidence in cases involving large numbers of claimants. He also noted that clients had given informed consent to Barings to act on their behalf. Striking out the claims, he added, would have been a “draconian step”.
Adnan Malik, head of data protection at Barings Law, said the decision was a significant victory for those affected. “From day one this case has centred on the rights of ordinary individuals against a major corporation which catastrophically failed to protect their privacy,” he said.
“For Capita to attempt to play down the seriousness of the impact was wrong, and today’s judgment affirms that the welfare of data breach victims is being taken seriously by the courts.”
Robert Whitehead, chairman of Barings Law, said the ruling reinforced the firm’s commitment to pursuing accountability in large-scale privacy cases. “Capita has played fast and loose with its customers’ data, and that has had an inevitable impact on the health and wellbeing of those affected,” he said. “We see today’s decision as a vindication of our claimants’ rights and an important signal for future data breach cases.”
While the ruling does not determine whether claimants will ultimately succeed, it clears a major procedural hurdle. The court said substantive questions around the extent of harm suffered by victims will be examined at a later trial, as the case against Capita now moves to its next phase.
