On 10 November 2021, the UK Supreme Court handed down its long-awaited decision in Lloyd v Google LLC. In what will be seen as a landmark decision in the fields of data protection and collective actions in the UK, the Supreme Court found unanimously for Google and overturned the decision of the Court of Appeal. The Supreme Court’s decision was also contrary to the Information Commissioner’s preferred outcome. The claim will not now proceed (at least as currently formulated).
The judgment rejects the proposition that data subjects affected by a non-trivial breach of data protection law may recover compensation for the “loss of control” of their personal data under the Data Protection Act 1998 (“DPA 1998”). The Supreme Court decided that such claims may only succeed where each data subject, on an individual basis, can evidence some form of damage, such as distress or financial loss. The requirement that each claimant individually must show (i) a breach of their individual data rights, and (ii) damage as a result, is likely to prevent future large-scale representative actions for data protection breaches. Many such representative actions have been waiting on the sidelines pending the outcome of Lloyd. It seems likely that they will not now be funded and pursued.
To read the full alert, click here.