The rise of group data breach claims

Together we are Forbes

Governance, Procurement & Information Article

01 July, 2021

Bethany_Paliga
Bethany Paliga
Senior Associate

The Rise of Group Data Breach Claims

We are currently awaiting the Supreme Court's decision in the case of Lloyd v Google LLC . The decision will have a significant impact on the availability of damages for the loss of control of personal data, and for the viability of 'opt-out' style group litigation.

Background of the Case

The consumer rights advocate, Richard Lloyd, issued a claim in which it was alleged that Google had breached its duties as a data controller under the Data Protection Act 1998. The basis of Mr Lloyd's claim is the allegation that Google tracked the internet activity of millions of iPhone users for commercial purposes without their consent or knowledge.

The claim was brought as a representative action under the Civil Procedure Rules. Under this procedure, the action is brought on behalf of a defined class of individuals who share the same interest in the claim. The process is similar to opt-out large class actions in the US but is uncommon in the UK.

When the case came before the Court of Appeal, it decided that damages were, in principle, capable of being awarded for loss of control of data, even where there is no monetary loss or distress suffered by an individual. Google appealed this decision and the hearing was held at the Supreme Court at the end of April 2021.

Supreme Court Hearing

At the Supreme Court hearing, the judges were keen to explore the issue of proof of loss and whether the claim should be actionable without any proof of harm. Submissions were made by the ICO's barrister, who said that the right to control one's own personal data is an intrinsic right and that, like other fundamental rights, it is important for society to preserve data protection. They noted that points had been made that no actual harm was suffered, however, in his submission the loss of control presents intrinsic harm and harm has been suffered where data controllers breach their obligations to keep data safe.

What are the Implications?

When the Supreme Court hands down its judgment, the decision is likely to have wide ranging implications. If the Supreme Court permits Mr Lloyd to serve the representative action on Google, on behalf of the over four million iPhone users, this could open the doors to "opt-out" representative actions (as often seen in the US). It would also allow for claims to be made for loss of control of personal data, without individuals arguably identifying any specific financial loss or distress suffered. This could lead to substantial group claims, including in relation to large cybersecurity breaches and claims regarding the improper use of cookies.

As we've seen an increase in the number of data breach claims being made against our clients, this case could have implications making it easier to bring large group actions in the event of large scale data breaches.

For further information, please contact Bethany Paliga via email Bethany Paliga or telephone 0800 689 3206.C

For more information contact Bethany Paliga in our Governance, Procurement & Information department via email or phone on 01254 222347. Alternatively send any question through to Forbes Solicitors via our online Contact Form.

Learn more about our Governance, Procurement & Information department here

School photographs and the GDRP

Charity Fined £25,000 for Data Breach

Contact Us

Get in touch to see how our experts could help you.

Call0800 689 0831

CallRequest a call back

EmailSend us an email

Contacting Us

Monday to Friday:
09:00 to 17:00

Saturday and Sunday:
Closed