Lepani Secake & Ors v Shared Services Connected Ltd

This is a data breach claim brought by 2,502 Claimants. By an Application Notice dated 5 September 2025 ("the Application"), these Claimants seek an anonymity order under which their identities as Claimants in these proceedings will be confidential, and the publication of identifying details will be restrained by the court. I set out the fuller terms of what is sought in the draft order by way of anonymity at [9] below.

The underlying claim itself concerns an alleged data breach in which it is said that third parties obtained unauthorised access to the Claimants' personal data held by the Defendant. The Claimants are current or former members of HM Crown Forces (or partners/children of such persons). For the purposes of this judgment, “ the GDPR” means the EU GDPR (up to 31 December 2020) and the UK GDPR (from 1 January 2021); and “UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as it forms part of the law of the United Kingdom by virtue of section 3 of the European Union (Withdrawal) Act 2018 .

The Claimants were all originally represented by the firm of solicitors, Barings Law. Since issue of the Claim Form on 5 September 2025, 1,898 of the Claimants have moved to new solicitors, Abbleys. However, the solicitor handling the claim, Mr Adnan Malik, remains the same and it is his witness statement of 16 January 2026 ("Malik 1") that is relied upon in support of the Application. I was informed by Mr Philip Coppel KC, Leading Counsel for the Claimants, that it is expected that most, if not all, of the remaining Claimants represented by Barings will move their instruction to Abbleys. For the purposes of the Application before me, it makes no difference whether a Claimant is represented by Abbleys or by Barings. Mr Robin Hopkins KC, who appeared for the Defendant, submitted that although the Defendant is formally neutral on the Application, it did not consider that the high threshold for anonymity had been met. I am grateful to both Mr Coppel KC and to Mr Hopkins KC for their concise and focussed submissions. Following the conclusion of oral arguments yesterday, 29 April 2026, I indicated to Counsel that I proposed to refuse the Application, for reasons to be provided.

The Factual Background

The Defendant is a private limited company that is jointly owned by HM Cabinet Office and Sopra Steria Limited. The Defendant is responsible for: (a) the provision of critical business support services for Government departments, the Metropolitan Police, the Ministry of Defence ("the MoD") and the Construction Industry Training Board; (b) the provision of payroll services for over 500,000 public sector employees; and (c) pension administration for over 2 million veterans and their families.

The MoD is responsible for administering the schemes for pensions, grants and allowances for current and former members of the armed forces of the Crown (and family members). The Defendant processed personal data of service personnel for the purposes of administering such pension schemes, including each of the Claimants’ full name, date of birth, place of birth, current address, rank, service record, including places of service, national insurance number, bank details, including sort code and account number. The Defendant processed this personal data on behalf of the MoD and was, accordingly, the processor of that personal data.

For present purposes, it is not in issue that each of the Claimants enjoyed the benefit and protections of the continuing obligations imposed by the GDPR (including those imposed by Arts 29, 30(2), 31, 32(1), 32(2) and 33(2)) upon the Defendant as a processor of personal data of which that Claimant was the data subject.

The Order sought and the evidence in support

The core terms of the draft anonymity order sought by the Application are as follows:

“1. The identity of each of the Claimants as a party to these proceedings is confidential and shall not be published.

Pursuant to CPR Rule 39.2(4), there shall not be disclosed in any report of these proceedings or other publication the name or address of any of the Claimants or any details (including other names, addresses, or a specific combination of facts) that could lead to the identification of that Claimant in these proceedings. Each Claimant shall be referred to as set out at paragraph 3 of this Order.

In any judgment or report of these proceedings, or other publication (by whatever medium) in relation thereto: (i) Each Claimant shall be referred to by Roman numeral, starting with 0001. (ii) Any other details which, on their own or together with other information publicly available, may lead to the identification of that Claimant shall be redacted before publication.

Pursuant to CPR Rules 5.4C and 5.4D: (i) A person who is not a party to the proceedings may not obtain a copy of a statement of case, judgment or order from the Court records unless the statement of case, judgment or order has been anonymised in accordance with subparagraphs 3(i) to (ii) above. (ii) If a person who is not a party to the proceedings applies (pursuant to CPR r.5.4C(1B) or (2)) for permission to inspect or obtain a copy of any other document or communication, such application shall be on at least 7 days’ notice to the Claimants’ solicitor".

Mr Malik, in the body of the Application Notice explains the reasons for the Application as follows:

“1. This is an application for an anonymity order to be made at the same time as the Court seals the Claim Form. The Defendant is a large company that processes personal data on behalf of (inter alia) the Ministry of Defence. It is the Claimants' case that the potential exfiltration was able to take place because the Defendant did not have in place adequate security measures to protect the Claimants' personal data: the Defendant is legally obliged under the UK GDPR to have adequate security measures in place. This is only a simplified summary of the claim: further detail can be found in the attached Particulars of Claim.

In making this application, the Claimants do not in any way diminish or seek to weaken the fundamental importance of open justice. To that end, the application seeks to anonymise only the names of the claimants and other details from which they can be identified. Importantly, the names and other identifying features of the claimants do not in themselves impinge on the determination of liability in the claim, although attributes of a particular Claimant will inform the quantum of loss and damage should liability be established. Thus, the impact on the principle of open justice by the making of the order sought will be limited.

In saying this, I fully recognise that the identities of the parties are an integral part of civil proceedings and that the starting point is that the principle of open justice requires that they be available to anyone who may wish to attend the proceedings or who wishes to provide or receive a report of them. Thus, it is inevitable that any order that prevents or restricts publication of a party's name or other information which may enable him/her to be identified involves a derogation from the principle of open justice and the right to freedom of expression. I fully recognise that whenever the court is asked to make an order of that kind, it is necessary to consider carefully whether a derogation of any kind is strictly necessary, and if so what is the minimum required for that purpose.

This case is such a case. Specifically, the data protection regime established by UK GDPR and the Data Protection Act 2018 recognise and seek to protect the privacy of information relating to an individual from disclosure that is not necessary by reference to interests that are described in those instruments. By the very nature of the claim made (an alleged unlawful disclosure of the Claimants' personal information), this is a disclosure that is alleged to be not only unnecessary but also unlawful.

There is, moreover, a particular sensitivity attending this information here. The individuals whose personal data has been disclosed, and who are the Claimants, are either members or ex-members of the armed forces of the Crown, or their spouses or dependents. Protection of their interests from the ordinary incidents of civil law and its processes has long been recognised, both by common law and statute (see eg Reserve and Auxiliary Forces (Protection of Civil Interests) Act 1951 and the Armed Forces Act 2006 ). These reflect the fact that those who are in the armed forces act for and in the name of the Crown, not as named individuals. Disclosure of the names of the Claimants would not be consistent with the spirit and intendment of this principle, and it is an added reason why the interests of justice should displace, just so far as names and other identifying details of the Claimants are concerned, the principle of open justice.

I therefore respectfully invite the Court to make the order in the terms sought. The draft order goes no further in terms of not disclosing details than is strictly necessary to protect the above-mentioned interests and does not impair the ability of the Court to do justice between the parties in a way that the public can see and comment upon".

In Malik 1, further reasons (essentially reflecting what is set out above) are provided by Mr Malik for seeking anonymity on behalf of all the Claimants. I note that this evidence was served in compliance with an Order of Master Eastman dated 17 December 2025 under which he directed at [1] that such evidence be served “…detailing why in this case anonymity is specifically considered appropriate, the court being concerned that the information provided in the N222 Application Notice is insufficient to determine the issue”.

As to why anonymity is necessary, Malik 1 says as follows:

“23. The Claimants, who are directly impacted by the data breach, include current and former members of the armed forces, their spouses, and dependents. Their privacy is a matter of both legal right and public policy, given their service to the Crown and their exposure to elevated risks as a result of their personal data being unlawfully accessed.

These individuals do not perform regular jobs like a large portion of the population. Their jobs depend on their details remaining private.

Disclosure of the Claimants’ identities poses serious risks, including: (a) Further exposure to security threats resulting from the potential misuse of their compromised data. (b) Harm stemming from the public disclosure of their information, leading to jigsaw identification facilitated by the publication of names and associated case details, compromising their anonymity and exposing them to additional personal and familial risks. (c) Disruption to their personal lives and heightened vulnerabilities to harassment or exploitation due to the sensitive nature of their roles as Crown- affiliated personnel".

Legal Principles

Pursuant to CPR PD16 a Claim Form must include: (1) the full name of each party: §2.4; and (2) an address (including the postcode) "at which the claimant lives or carries on business, even if the claimant's address for service is the business address of their solicitor": §2.1. Subject to certain conditions, the Claim Form is one of the documents that is publicly available from the records of the Court as of right. It was not in dispute that the default CPR procedural position is that the name and address of a party to civil litigation is required to be publicly available. Aside from procedural rules, it was not in issue that the names of parties to litigation are important matters that should usually be available to the public. See ZAB v Persons Unknown [2026] EWHC 669 (KB), per Heather Williams J at [28].

There was equally no dispute in relation to the legal principles which apply when a party seeks to override the open justice principle. In Baroness Lawrence and Others v Associated Newspapers [2025] EWHC 3237 (KB) ( “Lawrence ”), Nicklin J at [16]-[26], provided a comprehensive and helpful summary. In that case, there was an application for witness anonymity based on fears for personal safety, said to engage rights under Articles 2 and 3 ECHR. As to the overarching principles, Nicklin J explained:

“16. The fundamental principles of open justice remain clearly and succinctly set out in the Master of the Rolls' Practice Guidance (Interim Non-Disclosure Orders) [2012] 1 WLR 1003 :

[10] Derogations from the general principle can only be justified in exceptional circumstances, when they are strictly necessary as measures to secure the proper administration of justice. They are wholly exceptional: R -v- Chief Registrar of Friendly Societies, ex parte New Cross Building Society [1984] QB 227, 235; Donald -v- Ntuli [52]-[53]. Derogations should, where justified, be no more than strictly necessary to achieve their purpose.

In accordance with the requirement to establish the necessity for any derogation from open justice with clear and cogent evidence, the Court will scrutinise with care any application that the Court should withhold the name of a party or other details about the claim (including the party's address) from the public. Mere assertion that a party may suffer some harm is unlikely to discharge the burden to justify the order: see Farley & Ors v Paymaster (1836) Ltd (Trading As Equiniti) [2024] EWHC 383 (KB) (" Farley ") at [120], per Nicklin J, and R (Marandi) -v- Westminster Magistrates' Court [2023] 2 Cr App R 15 , per Warby LJ at [43].

As explained by Nicklin J in Farley at [131], the fact that a claim is being brought on behalf of a large number of claimants does not lessen the obligation to provide proper evidence in support of each individual Claimant's application. Unless there are very unusual circumstances in a particular case, there are no categories of litigant who are entitled to anonymity or other derogations from open justice. Each Claimant who wishes to seek such a derogation must demonstrate, by evidence of the required cogency, that such an order is necessary, and its terms proportionate. Of course, some of those in the class may fall into particular sub-groups at particular risk, and specific evidence may not be necessary for everyone in that sub-group. But attention must be given in making and presenting an anonymity application to the position of the particular Claimants. Wide class-based claims made without specific evidence, are likely to fail to meet these evidential standards.

The Arguments

Mr Coppel KC fairly and properly recognised that because orders of the type sought by the Claimants are derogations from the principle of open justice, they can only be justified in exceptional circumstances when they are strictly necessary as measures to secure the proper administration of justice or to protect the legitimate interests of the Claimants. He submitted that in considering whether there should be such a derogation I must have regard to the respective Convention rights of the parties, but also the general public interest in open justice and in the public report of court proceedings; and he accepted that the burden is on the Claimants to justify the order being sought. Taking up that challenge, he forcefully submitted that the Claimants had discharged that burden, and underlined the following points. He said that unless the order sought is made, personal details of the Claimants (who are the victims of a personal data breach within the meaning of Art 4(12) of the UK GDPR) will be disclosed to the public for an indeterminate period; and to disclose the names and other personal details of the victims of a personal data breach is not a neutral thing – by placing these details in the public domain and associating them with a data breach will "magnify" the victims’ "harm and hurt", and strikes at the Claimants’ privacy right that the GDPR is designed to protect (see UK GDPR Recitals (2), (3), (47), (68), (69), (75), (76), (77)). He also argued that because the personal details are those of HM Armed Forces, and their immediate families, in relation to their service to the country, this places a "premium" on their anonymity, given the animus that may be borne towards them. Mr Coppel KC said that the identity of the Claimants, in conjunction with the other personal details that would fall to be revealed in the proceedings, if made known could be exploited by "malicious persons", including "hostile nation states". Mr Coppel KC submitted that the countervailing harm to Convention rights and open justice is modest when balanced against these considerations.

Analysis

In my judgment, on an application of the uncontroversial legal principles summarised in Section IV above, this application for anonymity fails by some margin. In particular, I was unpersuaded by the evidence deployed in support of the application for wide and unfocussed class-based anonymity.

First, the application is pursued on behalf of the entire Claimant cohort (2,502 individuals) on an essentially generalised basis. In my judgment, there is no proper evidential basis on which the Court could grant anonymity to each individual Claimant without more person by person specificity. In particular, no attempt has been made to identify different classes of Claimants within the cohort and then explain why those classes meet the necessary threshold as set out in the case law. That this generalised approach is inappropriate is well-established: see IPSA at [46] and Farley at [131].

Second, what is said in the Application and evidence by way of assertion, is wholly inadequate as a sound basis for establishing that the Claimants’ Convention rights are engaged. I note that Malik 1 simply makes reference (at paras. 12 and 22) to the Claimants’ Convention rights, but does not explain why those rights are said to be engaged and how. Malik 1 asserts that, without anonymity, the Claimants would be exposed to “serious risk” (para. 25) and even “grave harm” (para. 28(b)). This is apparently because they or their family members work or have worked for the armed forces, with such roles being “unique” in terms of risk and entitlement to privacy (paras. 22-25 and 28). Malik 1 goes as far as to say that the Claimants’ “jobs depend on their details remaining private” (para. 24). These are sweeping assertions and are difficult to understand as applying to each of the Claimants. See also in this regard, the observations of Nicklin J in Lawrence at [24]-[26], as to the nature of the evidence required in cases where Convention rights such as Articles 2 and 3 are concerned. The same goes for the Convention rights under Article 8 invoked in Malik 1. I am not willing to proceed on the basis that the mere fact that the Claimants currently or formerly worked in the armed forces is a fact which in and of itself puts them at risks of harm were they to be named.

Third, Malik 1 also suggests (see e.g. para. 14) that anonymity is needed in order that these proceedings do not exacerbate what the Claimants say they have suffered by reason of the incident which is the subject of their claim. This is essentially the point also made by Mr Coppel KC in his oral submissions about the added distress or hurt about being named. As I see it, the logic of this argument is that anonymity should always be granted in data breach cases. I reject that submission. Like Nicklin J in Farley at [131], I consider implications of such an argument would be potentially far reaching given that data protection claims commonly include similar claims for damages based on loss of autonomy/control; and this argument for anonymity would therefore be available in all of these claims. That would be a major and unjustified encroachment on the open justice principle.

Fourth, as far as any specific individualised factors go, Malik 1 says this at para. 16: “Claimants included in the cohort have sensitive roles. Included it is said within the cohort is the head of nuclear secrets for the United Kingdom who is also a reservist. Additionally, there are claimants who have served with the Armed Forces in Northern Ireland”. I note that CMS reasonably asked for further explanation, both as to who or what the “head of nuclear secrets for the United Kingdom” is, and which Claimants are said to be at what risk by virtue of having served in Northern Ireland. The Claimants’ representatives have failed to address these questions. One can see that particular and specific evidence about such persons might be a persuasive basis for anonymity, but that has not been provided.

Fifth, I am not willing to accept the assertions that "hostile nation states" will exploit knowledge of the details of the Claimants, or that because the third parties who have allegedly obtained the personal data may have committed offences and are bad actors, this puts all the Claimants at risk. That is pure speculation. Again, if a specific identification of risks relating to particular persons can be identified that would be a different matter.

Sixth, I also reject as speculative the theory advanced orally by Mr Coppel KC that if malign actors find out that the Claimants are the subject of a data breach, they might approach the third party hackers to buy that data and give it wider circulation or engage in blackmail.

The risks of a wide-ranging class-based anonymity application which does not consider individual claimants is demonstrated by the fact that four of the Claimants have LinkedIn profiles which positively assert their services in HM Armed Forces. I will provide two examples. So, the First Claimant, Mr Lepani says in his profile that he was a "Section Commander in the British Army full-time between 2007-2022". Another Claimant says in his profile that he has served a number of years in the Queen’s Royal Hussars. They make no secret of the fact of their service – it is in the public domain. It is hard to see how the fact that they will be named as Claimants in this claim puts them at any greater risk of harm than they may already face.

In my judgment, it is not good enough to rely on generic assertions of possible harms to justify an order seeking a wide class-based anonymity order (and thus constituting a substantial curtailment of open justice). In short, the Claimants have not discharged the evidential burden of demonstrating that anonymity is necessary to secure the proper administration of justice or to protect their legitimate interests in the balance against the powerful open justice principle. Their draft order goes far beyond anything they are able to justify with evidence.

The principle of open justice prevails. If in a specific case of a particular Claimant the sensitivity of their name or data can be shown, the court retains the ability to make orders of a protective nature. Nothing in this judgment precludes such an application.

Equally, if steps are needed to protect the confidentiality of particular parts of the personal data, under established principles the court will be able to fashion a protective procedure by using case management techniques and targeted orders that will properly protect the confidential/private information of each Claimant.

Finally, as I observed at the hearing, I consider prior notice of the Application should have been provided to the media. See the approach of Nicklin J in IPSA at [13]-[17], where he directed that the Press Association ( PA ) be served with the relevant documents via the Injunction Application Alert Service. Had I been otherwise persuaded that this was a case fit for an anonymity order, I would have provided the media with an opportunity to address the court before making any order. Those who apply for such orders in the future should always consider serving notice of such an application on the media through an organisation such as the PA. The court can then give directions as to which of the application papers should be provided if the media seeks further details. It is far from ideal that the media may be later able to make an application to set aside an order. I consider they should have the opportunity in advance to make submissions in a case of the present type.

The Application is dismissed with costs in the sum I summarily assessed at the end of the hearing.