Search
The Supreme Court today handed down judgment in Lloyd v Google [2021] UKSC 50.
Allowing Google’s appeal, the Supreme Court held that damages cannot be awarded under the Data Protection Act 1998 for “loss of control” of data without proof that it caused financial damage or distress. On that basis, it concluded that the claim was not suitable to proceed as a representative action, because compensation for the alleged breaches of data protection law would need to be individually assessed. Delivering the single agreed judgment of the Court, Lord Leggatt stated: “In order to recover compensation under the DPA 1998 for any given individual, it would be necessary to show both that Google made some unlawful use of personal data relating to that individual and that the individual suffered some damage as a result” (§8).
The Supreme Court, however, limited its analysis to the old data protection framework and did not opine on the wider merits and desirability of a representative action of this kind. It thus left open the possibility of future representative actions in data protection cases being brought under the UK GDPR and the Data Protection Act 2018, or for misuse of private information.
The judgment is available here. A detailed case note by Laura Elizabeth John is here.
Gerry Facenna QC and Nikolaus Grubeck acted for the First Intervener, the Information Commissioner.
Robert Palmer QC and Julianne Kerr Morrison acted for the Second Intervener, Open Rights Group.