A High Court judge has ruled that thousands of people affected by a serious data breach at Capita can continue their legal action against the outsourcing group. This decision is considered a milestone for large-scale data protection litigation in the UK.
In a ruling handed down on February 9, Master Dagnall rejected arguments from Capita’s legal team that lawyers acting for more than 8,000 plaintiffs had abused the court process. Capita had claimed that the use of repetitive or general descriptions of psychological distress following the 2023 cyberattack undermines the validity of the claims.
The ruling allows the case brought by Barings Law to continue and is likely to be closely watched by companies, regulators and plaintiff law firms involved in data protection disputes.
Barings launched the operation in 2023 after a cyberattack exposed the personal data of around 6.6 million people, including Capita employees. The compromised information is believed to include sensitive financial and pension data.
Capita’s lawyers had asked for the claims to be struck out, claiming Barings had improperly influenced evidence relating to the plaintiffs’ anxiety and mental suffering following the breach. However, Master Dagnall concluded that Capita had not established that an abuse of process had occurred.
In his ruling, the judge said lawyers had a “genuine basis” and were entitled to “wide latitude” in preparing evidence in cases involving large numbers of plaintiffs. He also noted that the customers had given Barings informed consent to act on their behalf. Removing the claims would have been a “draconian step,” he added.
Adnan Malik, head of data protection at Barings Law, said the decision was a significant victory for those affected. “From day one, this case has focused on the rights of private citizens against a large corporation that has catastrophically failed to protect their privacy,” he said.
“Capita’s attempt to downplay the seriousness of the impact was wrong and today’s ruling confirms that the welfare of data breach victims is taken seriously by the courts.”
Robert Whitehead, chairman of Barings Law, said the ruling reinforces the firm’s commitment to pursuing accountability in large-scale data protection cases. “Capita has been fast and loose with its customers’ data and this has had an inevitable impact on the health and wellbeing of those affected,” he said. “We view today’s decision as a vindication of our plaintiffs’ rights and an important signal for future data breach cases.”
While the ruling does not determine whether the plaintiffs will ultimately succeed, it does remove a major procedural hurdle. The court said substantive questions about the extent of the harm suffered by the victims will be considered at a later trial as the case against Capita now moves to the next phase.
