On 10 November 2021, the Supreme Court of the United Kingdom handed down its much-awaited judgment in the case of Lloyd v Google LLC [2021] UKSC 50. The Supreme Court unanimously ruled that the claim, which is a representative action alleging breaches of the Data Protection Act 1998 (“DPA 1998”), could not proceed.
The Supreme Court ruled that the claim did not fulfil the requirement that individual claimants in a representative action must have the “same interest” under rule 19.6 of the English Civil Procedure Rules (“CPR”). Further, the Supreme Court held that it was not enough for a claim for compensation to be premised on mere contravention of a data controller’s statutory duties under the Data Protection Act 1998, but that “material damage” must result in order for a claim for compensation to be brought.
This judgment provides clarity to data controllers that data subjects cannot recover compensation for a breach (even if non-trivial) of the data controller’s statutory duties without demonstrating the damage or distress suffered as a consequence. It also provides important clarifications on when an “opt-out” style representative action can be pursued.
Please click here to read the full alert memorandum.