Sussex Police experienced a GDPR breach involving the misdelivery of annual pension benefit statements to outdated addresses of pension scheme members. The exposed data included sensitive personal information such as salaries, dates of birth, and accrued pension entitlements. While there was no evidence that the misdelivered statements were opened or that the data was misused, affected members filed a collective action lawsuit under UK GDPR, citing psychiatric injury and fear of third-party misuse. Each claimant sought £1,250 in compensation. The UK Court of Appeal ruled that emotional distress and fear of misuse—even without concrete harm—could constitute non-material damage under GDPR, lowering the threshold for future mass claims. The breach was self-reported by Sussex Police to the UK Information Commissioner, and notifications were sent to affected individuals, which triggered the class action. The case highlights the rising risk of private litigation for GDPR non-compliance, even in low-risk scenarios.

Former Police Officers Admit to Unauthorized Data Access and Sharing in UK Court Case Two former police officers, Sean Picton and Anthony Bolaños, pleaded guilty to charges of unlawfully obtaining and sharing personal data without consent between October 2022 and January 2023. The case, heard at the UK Supreme Court, centered on Picton’s unauthorized access to sensitive information, which he then shared with Bolaños, who subsequently disclosed it to a third party. Originally, Picton had denied more severe charges, including misconduct in public office and unauthorized computer access, while Bolaños faced allegations of aiding and abetting misconduct. However, both admitted to the reduced charges of data protection violations. Judge Matthew Happold acknowledged that the original charges carried a potential life sentence, whereas the data offenses typically result in fines. He noted that while a conviction for the more serious offenses was plausible, the prosecution had opted for the lesser charges after careful consideration. The case underscores concerns over unauthorized data handling within law enforcement, highlighting the legal consequences of mishandling sensitive information.