Al-Masarir v Kingdom of Saudi Arabia -[2026] EWHC 119 (KB)- (26 January 2026)

Key Facts

Issues

• The court determined that the KSA's installation of Pegasus spyware on the Claimant's iPhones constituted a trespass to goods. The spyware altered the devices' configurations and functionalities without consent, leading to the conclusion that the KSA had no defense for this tort.
• The court considered whether the Kingdom of Saudi Arabia's use of Pegasus spyware to access the Claimant's personal information on his iPhones constituted a misuse of private information. Applying the two-stage test from McKennitt v Ash and ZXC v Bloomberg, the court found that the Claimant had a reasonable expectation of privacy in his data and that the KSA's conduct was not justified. The court concluded that the KSA had no real prospect of defending this claim.
• The court evaluated if the KSA's alleged surveillance activities, including the use of Pegasus spyware and other intimidating acts, amounted to harassment under the Protection from Harassment Act 1997. The court found that the KSA's conduct constituted a course of conduct that caused alarm, fear, and distress to the Claimant, with no valid defense under the Act.
• The court assessed the liability of the KSA for the physical assault committed against the Claimant in London. The attack was found to be without lawful justification, and the KSA's failure to contest the claim led to the conclusion that it had no reasonable prospect of defending this tort.

Holdings

• The court found the KSA responsible for the physical assault on the Claimant in London, with no lawful justification for the attack.
• The court found the KSA liable for misuse of private information, as the hacking constituted an exceptionally grave invasion of the Claimant's privacy, accessing personal data, location, calls, and using devices for surveillance.
• The court determined that the KSA's surveillance and hacking amounted to harassment, causing severe psychiatric injury to the Claimant through covert monitoring and data exfiltration.
• The court concluded that the KSA's installation of Pegasus spyware on the Claimant's iPhones amounted to trespass to goods, altering device configurations and functionalities without consent.

Remedies

• The Claimant was awarded general damages of £100,000 for severe psychiatric injury and £500 for physical injury. Special damages included past medical costs (£594), past lost earnings (£317,600.60), future medical costs (£4,500), future travel costs (£260), and future lost earnings (£2,562,578.48), totaling £3,025,662.83. The award reflects the catastrophic impact of surveillance and assault on the Claimant's life and career.
• The court granted summary judgment to the Claimant on his claims for misuse of private information, harassment, trespass to goods, and assault against the Kingdom of Saudi Arabia. The judgment concluded the KSA had no real prospect of defending these claims. However, the full extent of YouTube income-related financial relief was not justified, resulting in a lower special damages award than claimed.
• The Claimant was awarded 80% of his costs on an indemnity basis due to the KSA's unreasonable conduct, including failure to comply with multiple court orders since December 2023. The KSA's deliberate non-engagement in proceedings justified the indemnity costs order under CPR 24.4(1)(a).

Monetary Damages

Legal Principles

• The court applied costs principles by awarding 80% of the Claimant's costs on an indemnity basis due to the KSA's unreasonable conduct in the proceedings. The KSA's failure to comply with orders and lack of engagement justified the higher costs award.
• The court applied the principle of sovereign immunity under the State Immunity Act 1978, determining that the Kingdom of Saudi Arabia (KSA) was not immune from the court's jurisdiction in this case. This allowed the proceedings to continue, as the KSA's previous appeals based on immunity were dismissed.

Precedent Name

• Hayes v Willoughby
• Shehabi v Bahrain
• Majrowski v Guy's & St Thomas's NHS Trust
• Re Al M (Fact-finding)
• European Union v Syrian Arab Republic

Cited Statute

• Protection from Harassment Act 1997
• State Immunity Act 1978

Judge Name

Passage Text

• In my judgment, the Claimant plainly had a reasonable expectation of privacy in respect of the information accessed by the deployment of Pegasus on his iPhones.
• I conclude that the KSA has no real prospect of defending the allegation of hacking.
• The total damages awarded to the Claimant amount to £3,025,662.83.