Hundreds of police officers sue pensions firm over serious data breach

474 British police officers have recently issued a compensation claim in the High Court against Paymaster 1836, the pensions part of Equiniti Group, which provides pensions services to 70% of FTSE 100 companies. The claim, which has been issued by specialist group action law firm Keller Lenkner UK, is estimated to be worth in excess of £1 million.

In August 2019, Equiniti distributed 750 annual pension benefits statements on behalf of Sussex Police force after receiving updated contact details for the force’s officers. But Equiniti failed to properly update their database, resulting in pension statements being sent to the wrong addresses. 

The Equiniti data breach exposed the names, National Insurance numbers, salary banding, dates of birth, police service details, and pensions information of police officers. Due to privacy concerns emanating from the case, the Judge has ordered that the names of the claimants be kept confidential.

Head of data breach at Keller Lenkner UK, Kingsley Hayes, commented: “A data breach of this scale has a significant impact on the individuals affected. Equiniti has thus far failed to recognise the seriousness of the data violation and the impact on the large number of police officers affected. The breach included highly confidential information which, placed in the wrong hands, could have significant consequences, including identity theft or other fraudulent activities resulting in significant financial losses. Equiniti had a duty to protect this information and should be held accountable for their failure to do so. They should compensate victims fairly.”

One of the police officer claimants commented: “Equiniti’s actions have caused a great deal of distress to myself and my family, resulting in us having to review all of our accounts and changing our passwords. I removed myself from social media platforms to protect our privacy and joined a credit checking service, which I now feel the need to check on a regular basis. I have even considered the need to move house to protect myself. Knowing that my personal information may potentially be used to defraud me or others is deeply troubling.”

Equiniti is presently being courted for a £600m takeover by American private equity firm Siris Capital, which was due to make a further offer in the coming days. At the start of this month Equiniti announced a pre-tax loss of £6.6m for 2020.

In January 2020, five months after the data breach, Equiniti published an article on their website entitled: “Importance of Data Privacy”. Ironically, the article noted that “safeguarding personal data is now the minimum expected of businesses”, and that consumers expect that their data be “stored and used responsibly and relevantly”.

News of this has been published in Actuarial Post, Financial Reporter and Law360 on 27 April 2021 and in The Times, 28 April 2021, in print.