As part of our recent look at the rise of data protection representative actions across Europe (see here Part 1 and Part 2), we predicted a continued increase in such actions being pursued in various jurisdictions, including England.
In a significant recent development, a campaign group called Facebook You Owe Us has signalled its intent to launch a representative action against Facebook in the English courts before the end of this year. The proposed claim concerns the illegal use of 1 million UK based Facebook users’ data. Due to the nature of their sector, coupled with their extremely deep pockets, the ‘Big Tech’ companies (like Facebook), who have benefitted so much from the internet boom since the turn of the century, are finding themselves increasingly targeted by a public who have become better informed of their data protection rights in the GDPR era.
The illegal use of data by Facebook in this instance concerns the Cambridge Analytica scandal that rocked the tech giant following its exposure in March 2018. In short, an app called ‘thisisyourdigitallife’ was operating on Facebook and harvesting the data of Facebook users between 2013 and 2015. It is alleged by Facebook You Owe Us that in 2013 and 2014, Facebook allowed users’ data to be collected without permission and without properly informing users of what was being done. This took place by Facebook letting apps harvest the data of a user’s friends, without the knowledge or permission of that friend.
The claim appears to be strongly backed and includes support from Richard Lloyd (of Lloyd v Google fame), fresh from his victory over Google in the Court of Appeal and set to take that claim all the way to the Supreme Court in April 2021. Indeed, Facebook You Owe Us has indicated its intention to follow Lloyd’s lead and issue their representative action under Civil Procedure Rule 19.6 – which allows a claim to be brought by one person on behalf of every claimant who has the same interest in the claim – it seems the fate of the claim against Facebook will be closely linked to how the Supreme Court view the Court of Appeal’s finding in Lloyd that all claimants suffered the same loss, which was made on the basis that they all suffered loss of control over their personal data.
Should an action be commenced in the UK, it will be the latest in a string of European actions brought against the Silicon Valley giant in relation to the Cambridge Analytica scandal; shortly after it was exposed in March 2018, consumer groups in Belgium, Italy, Portugal and Spain launched a coordinated set of class actions in each of those jurisdictions. The European actions are thought to be pursuing Facebook for damages in the region of €70 million, a figure that was based on a modest compensation estimate of around €200 to €285 per claimant. If adopted in the UK action for 1 million affected users, even a low per-claimant sum such as this could quickly see Facebook facing a worst-case liability scenario north of £100 million.
The UK regulator, the ICO, has already fined Facebook £500,000 in respect of these events, which was the maximum fine that could be levied under the UK’s pre-GDPR data protection regime. Given the potential scale of the representative action, this could be but a drop in the ocean of the overall liability Facebook might find itself on the hook for.
Much now hangs on the appeal of Lloyd v Google to the Supreme Court, which will be heard in April 2021. For the time being though, representative actions in England are finding their feet, which is going to keep the giants of the tech sector on their toes.
The post Facebook the target for UK data breach representative action appeared first on mediawrites.law.