01 July, 2021
The Rise of Group Data Breach Claims
We are currently awaiting the Supreme Court's decision in the case of Lloyd v Google LLC . The decision will have a significant impact on the availability of damages for the loss of control of personal data, and for the viability of 'opt-out' style group litigation.
Background of the Case
The consumer rights advocate, Richard Lloyd, issued a claim in which it was alleged that Google had breached its duties as a data controller under the Data Protection Act 1998. The basis of Mr Lloyd's claim is the allegation that Google tracked the internet activity of millions of iPhone users for commercial purposes without their consent or knowledge.
The claim was brought as a representative action under the Civil Procedure Rules. Under this procedure, the action is brought on behalf of a defined class of individuals who share the same interest in the claim. The process is similar to opt-out large class actions in the US but is uncommon in the UK.
When the case came before the Court of Appeal, it decided that damages were, in principle, capable of being awarded for loss of control of data, even where there is no monetary loss or distress suffered by an individual. Google appealed this decision and the hearing was held at the Supreme Court at the end of April 2021.
Supreme Court Hearing
At the Supreme Court hearing, the judges were keen to explore the issue of proof of loss and whether the claim should be actionable without any proof of harm. Submissions were made by the ICO's barrister, who said that the right to control one's own personal data is an intrinsic right and that, like other fundamental rights, it is important for society to preserve data protection. They noted that points had been made that no actual harm was suffered, however, in his submission the loss of control presents intrinsic harm and harm has been suffered where data controllers breach their obligations to keep data safe.
What are the Implications?
As we've seen an increase in the number of data breach claims being made against our clients, this case could have implications making it easier to bring large group actions in the event of large scale data breaches.
For more information contact Bethany Paliga in our Governance, Procurement & Information department via email or phone on 01254 222347. Alternatively send any question through to Forbes Solicitors via our online Contact Form.