Lepani Secake & Ors v Shared Services Connected Ltd

This is a data breach claim brought by 2,502 Claimants. By an Application Notice dated 5 September 2025 ("the Application"), these Claimants seek an anonymity order under which their identities as Claimants in these proceedings will be confidential, and the publication of identifying details will be restrained by the court. I set out the fuller terms of what is sought in the draft order by way of anonymity at [9] below.

The underlying claim itself concerns an alleged data breach in which it is said that third parties obtained unauthorised access to the Claimants' personal data held by the Defendant. The Claimants are current or former members of HM Crown Forces (or partners/children of such persons). For the purposes of this judgment, “the GDPR” means the EU GDPR (up to 31 December 2020) and the UK GDPR (from 1 January 2021); and “UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018.

The Claimants were all originally represented by the firm of solicitors, Barings Law. Since issue of the Claim Form on 5 September 2025, 1,898 of the Claimants have moved to new solicitors, Abbleys. However, the solicitor handling the claim, Mr Adnan Malik, remains the same and it is his witness statement of 16 January 2026 ("Malik 1") that is relied upon in support of the Application. I was informed by Mr Philip Coppel KC, Leading Counsel for the Claimants, that it is expected that most, if not all, of the remaining Claimants represented by Barings will move their instruction to Abbleys. For the purposes of the Application before me, it makes no difference whether a Claimant is represented by Abbleys or by Barings.Mr Robin Hopkins KC, who appeared for the Defendant, submitted that although the Defendant is formally neutral on the Application, it did not consider that the high threshold for anonymity had been met. I am grateful to both Mr Coppel KC and to Mr Hopkins KC for their concise and focussed submissions. Following the conclusion of oral arguments yesterday, 29 April 2026, I indicated to Counsel that I proposed to refuse the Application, for reasons to be provided.

When I set out the factual background to the claim in Section II below, it is with the caveat that these proceedings are at an early stage and the Defence is yet to be filed. At this stage, the version of events I describe is based only on what it said in the Claimants' pleadings and evidence. I should record that it is the Defendant's position that there is no evidence of there having been unlawful access to the Claimants’ personal data.

The Defendant is a private limited company that is jointly owned by HM Cabinet Office and Sopra Steria Limited. The Defendant is responsible for: (a) the provision of critical business support services for Government departments, the Metropolitan Police, the Ministry of Defence ("the MoD") and the Construction Industry Training Board; (b) the provision of payroll services for over 500,000 public sector employees; and (c) pension administration for over 2 million veterans and their families.

The MoD is responsible for administering the schemes for pensions, grants and allowances for current and former members of the armed forces of the Crown (and family members). The Defendant processed personal data of service personnel for the purposes of administering such pension schemes, including each of the Claimants’ full name, date of birth, place of birth, current address, rank, service record, including places of service, national insurance number, bank details, including sort code and account number. The Defendant processed this personal data on behalf of the MoD and was, accordingly, the processor of that personal data.

For present purposes, it is not in issue that each of the Claimants enjoyed the benefit and protections of the continuing obligations imposed by the GDPR (including those imposed by Arts 29, 30(2), 31, 32(1), 32(2) and 33(2)) upon the Defendant as a processor of personal data of which that Claimant was the data subject.

The Claimants say that over the period 1 July 2023 to 7 May 2024 (inclusive) (“the Data Security Breach Period”) the Defendant processed significant amounts of personal data relating to each of the Claimants. It is the Claimants’ case that over the Data Security Breach Period, third parties engaged in unauthorised and unlawful processing of the Claimants’ personal data held by Defendant. They also say that this unauthorised and unlawful processing of their personal data included obtaining access to and/or exfiltrating personal data of each of the Claimants from the Defendant’s servers. The Claimants say that they cannot at this stage be more specific or give a complete list of the Claimants’ personal data accessed or exfiltrated, and they do not know the identity of the third parties, or whether they reside outside the United Kingdom. Their case is that the third parties committed a number of criminal offences in effecting the Data Security Breach; and that it is reasonable for them to believe that the third parties may seek to sell some or all of the Claimants’ personal data accessed and/or exfiltrated.

The core terms of the draft anonymity order sought by the Application are as follows:

Mr Malik, in the body of the Application Notice explains the reasons for the Application as follows:

In Malik 1, further reasons (essentially reflecting what is set out above) are provided by Mr Malik for seeking anonymity on behalf of all the Claimants. I note that this evidence was served in compliance with an Order of Master Eastman dated 17 December 2025 under which he directed at [1] that such evidence be served “…detailing why in this case anonymity is specifically considered appropriate, the court being concerned that the information provided in the N222 Application Notice is insufficient to determine the issue”.

As to why anonymity is necessary, Malik 1 says as follows:

I will refer in more detail to further aspects of Mr Malik’s evidence below.

Pursuant to CPR PD16 a Claim Form must include: (1) the full name of each party: §2.4; and (2) an address (including the postcode) "at which the claimant lives or carries on business, even if the claimant's address for service is the business address of their solicitor": §2.1. Subject to certain conditions, the Claim Form is one of the documents that is publicly available from the records of the Court as of right. It was not in dispute that the default CPR procedural position is that the name and address of a party to civil litigation is required to be publicly available. Aside from procedural rules, it was not in issue that the names of parties to litigation are important matters that should usually be available to the public. See ZAB v Persons Unknown [2026] EWHC 669 (KB), per Heather Williams J at [28].

There was equally no dispute in relation to the legal principles which apply when a party seeks to override the open justice principle. In Baroness Lawrence and Others v Associated Newspapers [2025] EWHC 3237 (KB) (“Lawrence”), Nicklin J at [16]-[26], provided a comprehensive and helpful summary. In that case, there was an application for witness anonymity based on fears for personal safety, said to engage rights under Articles 2 and 3 ECHR. As to the overarching principles, Nicklin J explained:

In accordance with the requirement to establish the necessity for any derogation from open justice with clear and cogent evidence, the Court will scrutinise with care any application that the Court should withhold the name of a party or other details about the claim (including the party's address) from the public. Mere assertion that a party may suffer some harm is unlikely to discharge the burden to justify the order: see Farley & Ors v Paymaster(1836) Ltd (Trading As Equiniti) [2024] EWHC 383 (KB) ("Farley") at [120], per Nicklin J, and R (Marandi) -v- Westminster Magistrates' Court [2023] 2 Cr App R 15, per Warby LJ at [43].

As explained by Nicklin J in Farley at [131], the fact that a claim is being brought on behalf of a large number of claimants does not lessen the obligation to provide proper evidence in support of each individual Claimant's application. Unless there are very unusual circumstances in a particular case, there are no categories of litigant who are entitled to anonymity or other derogations from open justice. Each Claimant who wishes to seek such a derogation must demonstrate, by evidence of the required cogency, that such an order is necessary, and its terms proportionate. Of course, some of those in the class may fall into particular sub-groups at particular risk, and specific evidence may not be necessary for everyone in that sub-group. But attention must be given in making and presenting an anonymity application to the position of the particular Claimants. Wide class-based claims made without specific evidence, are likely to fail to meet these evidential standards.

It is not sufficient to point to the "data protection" context of the claim in and of itself as a basis for anonymity. The principles outlined above apply with equal rigour in data protection claims, including those involving (like the present claim) a large group of claimants alleging that their personal data has been compromised by reason of a data security incident. In this regard, see e.g. Various Claimants v IPSA [2021] EWHC 2020 (QB) ("IPSA") per Nicklin J at [33]-[41] and [46-52]. That case concerned an application by a large cohort of MPs’ staff members. See also Farley, per Nicklin J at [116]-[136]. That was an application by a large cohort of police officers.In short, there is nothing special about data protection claims, and there are many examples of claimants in other areas who would wish to avoid the publicity of legal proceedings which are likely to cause them additional stress and hurt over and above the civil wrong to which they have been subject.

Mr Coppel KC fairly and properly recognised that because orders of the type sought by the Claimants are derogations from the principle of open justice, they can only be justified in exceptional circumstances when they are strictly necessary as measures to secure the proper administration of justice or to protect the legitimate interests of the Claimants. He submitted that in considering whether there should be such a derogation I must have regard to the respective Convention rights of the parties, but also the general public interest in open justice and in the public report of court proceedings; and he accepted that the burden is on the Claimants to justify the order being sought. Taking up that challenge, he forcefully submitted that the Claimants had discharged that burden, and underlined the following points. He said that unless the order sought is made, personal details of the Claimants (who are the victims of a personal data breach within the meaning of Art 4(12) of the UK GDPR) will be disclosed to the public for an indeterminate period; and to disclose the names and other personal details of the victims of a personal data breach is not a neutral thing – by placing these details in the public domain and associating them with a data breach will "magnify" the victims’ "harm and hurt", and strikes at the Claimants’ privacy right that the GDPR is designed to protect (see UK GDPR Recitals (2), (3), (47), (68), (69), (75), (76), (77)). He also argued that because the personal details are those of HM Armed Forces, and their immediate families, in relation to their service to the country, this places a "premium" on their anonymity, given the animus that may be borne towards them. Mr Coppel KC said that the identity of the Claimants, in conjunction with the other personal details that would fall to be revealed in the proceedings, if made known could be exploited by "malicious persons", including "hostile nation states". Mr Coppel KC submitted that the countervailing harm to Convention rights and open justice is modest when balanced against these considerations.

Mr Hopkins KC made helpful and brief submissions to assist me. He provided a summary of the legal position and outlined on behalf of the Defendant what he called a number of "key concerns" as to why that test has not been met in this case. He relied in particular on the matters his Instructing Solicitors, CMS, had set out in their letter of 6 February 2026 to Barings. While remaining neutral, Mr Hopkins KC submitted that the exceptionality and strict necessity tests posed serious difficulties for the Application, as presently framed. He relied in particular on the fact that this was a class-based claim with no attention having been given to the position of specific Claimants.

In my judgment, on an application of the uncontroversial legal principles summarised in Section IV above, this application for anonymity fails by some margin. In particular, I was unpersuaded by the evidence deployed in support of the application for wide and unfocussed class-based anonymity.

My specific reasons for this conclusion are as follows:

The risks of a wide-ranging class-based anonymity application which does not consider individual claimants is demonstrated by the fact that four of the Claimants have LinkedIn profiles which positively assert their services in HM Armed Forces. I will provide two examples. So, the First Claimant, Mr Lepani says in his profile that he was a "Section Commander in the British Army full-time between 2007-2022". Another Claimant says in his profile that he has served a number of years in the Queen’s Royal Hussars. They make no secret of the fact of their service – it is in the public domain. It is hard to see how the fact that they will be named as Claimants in this claim puts them at any greater risk of harm than they may already face.

In my judgment, it is not good enough to rely on generic assertions of possible harms to justify an order seeking a wide class-based anonymity order (and thus constituting a substantial curtailment of open justice). In short, the Claimants have not discharged the evidential burden of demonstrating that anonymity is necessary to secure the proper administration of justice or to protect their legitimate interests in the balance against the powerful open justice principle. Their draft order goes far beyond anything they are able to justify with evidence.

The principle of open justice prevails. If in a specific case of a particular Claimant the sensitivity of their name or data can be shown, the court retains the ability to make orders of a protective nature. Nothing in this judgment precludes such an application.

Equally, if steps are needed to protect the confidentiality of particular parts of the personal data, under established principles the court will be able to fashion a protective procedure by using case management techniques and targeted orders that will properly protect the confidential/private information of each Claimant.

Finally, as I observed at the hearing, I consider prior notice of the Application should have been provided to the media. See the approach of Nicklin J in IPSA at [13]-[17], where he directed that the Press Association (PA) be served with the relevant documents via the Injunction Application Alert Service. Had I been otherwise persuaded that this was a case fit for an anonymity order, I would have provided the media with an opportunity to address the court before making any order. Those who apply for such orders in the future should always consider serving notice of such an application on the media through an organisation such as the PA. The court can then give directions as to which of the application papers should be provided if the media seeks further details. It is far from ideal that the media may be later able to make an application to set aside an order. I consider they should have the opportunity in advance to make submissions in a case of the present type.

The Application is dismissed with costs in the sum I summarily assessed at the end of the hearing.