Actions for non-material damages following (alleged) infringements of the General Data Protection Regulation (GDPR) are increasingly being brought before courts across Europe.
In our new blog post series, we explain the situation in several countries across Europe (see our introduction). Please find out below about GDPR damages claims in England and Wales.
In England and Wales the principal data protection laws are the UK GDPR (GDPR assimilated into UK law post-Brexit, with some amendments) and the Data Protection Act 2018. There are several ways collective proceedings can be brought in the courts. The two main mechanisms are: (i) representative actions; and (ii) group litigation orders (GLOs) under Part 19 of the Civil Procedure Rules.
Representative actions are usually opt-in, however in Lloyd v Google the Court of Appeal allowed an opt-out representative action for loss of control of data. The ‘opt-out’ approach is attractive to those bringing claims (and their funders) as it makes it far easier (and cheaper) to assemble a large class of claimants. Following the Court of Appeal’s decision, a number of mass data privacy claims were brought on this basis.
However, on appeal, the UK Supreme Court ruled in 2021 that the Data Protection Act 1998 (the predecessor to the Data Protection Act 2018 and the UK GDPR) did not provide an automatic right to compensation for any (non-trivial) contravention by a data controller of any of the requirements of the Data Protection Act 1998 (such as a mere ‘loss of control’ of data), unless it was proven that the contravention caused material damage or distress to each individual (see our previous blog post). As a result, the Supreme Court held that the representative claimant, Mr Lloyd, did not have the ‘same interest’ as the other class members, which is required to form a representative action. Although this case related to preceding data protection law, it is widely assumed the court would take the same approach under the UK GDPR.
The Supreme Court’s finding that a claim of ‘loss of control’ is not a relevant head of damage on its own under the Data Protection Act 1998 acknowledged that claimants must suffer financial loss or distress from any unlawful data processing in order to be compensated (which will usually be a higher threshold than a mere ‘loss of control’). By precluding damages for a loss of control of data (in the absence of financial loss or distress), the judgment poses significant hurdles for opt-out representative actions for data breach / data privacy claims. The EU Court of Justice’s decision that a breach of the EU GDPR does not automatically give rise to a right to compensation is seen by many commentators as reinforcing that conclusion. Following the Supreme Court’s decision, the high-profile mass data privacy claims brought on an opt-out representative action basis were eventually withdrawn or dismissed.
Instead, claimants have sought to pursue data privacy / data breach claims by way of individual claims or by way of GLO, which provides for the case management of claims which give rise to common or related issues of fact or law. This is a lower threshold than the ‘same interest’ test for representative actions. However, GLOs come with far higher upfront costs, since all individuals who want to be in the group must be verified as ‘proper’ claimants within the scope of the GLO and placed on a register maintained by the claimant firm.
Another alternative model that is emerging in the data privacy / data breach mass claims context (as seen in Police Federation v Beck) is the ‘lead claimant model’, which involves claimants joining an opt-in action, and certain ‘lead claimants’ being selected to act as test claimants. The Court will determine the common issues, as well as determining the quantum payable to each test claimant. This can then be used to approximate the damages payable to non-lead claimants, which is designed to assist with settlement. Any specific issues arising in particular cases could then be heard by lower courts, which will also determine the quantum of each claim. In some instances, this model might offer a cheaper and quicker route to resolving mass claims, as the up-front costs incurred by claimant firms in book-building for a GLO are avoided, and issues may be determined at an earlier stage. See here for our recent blog on this topic.
The next blog post in our data and tech mass claims series will focus on France.
