Floodgates open in respect of data breach representative actions

We noted in a previous blog post that opt-out representative class actions in respect of data breaches appear to be on the rise.

In line with that uptick, a representative class action has now been issued against YouTube owner, Google Ireland Ltd, in the UK High Court on behalf of every child under the age of 13 in England and Wales who has used YouTube since 25 May 2018, and their parents or guardians.

The action, instigated by privacy activist Duncan McCann, alleges that YouTube has breached the UK Data Protection Act and the General Data Protection Regulation by collecting and processing children's personal data without obtaining the requisite parental consent and seeks more than £2.5billion in damages.

As with several other recent class actions filed in the UK, the claim relies on the permissive interpretation taken by the Court of Appeal in Lloyd v Google LLC to representative actions (see here) for which there is an outstanding Supreme Court decision. Whether or not the Supreme Court's decision will be influenced by this trend, given Google's arguments in relation to the risk of opening the floodgates to mass class action litigation in the UK, will be a point to watch.

YouTube has previously been investigated by US authorities in relation to its collection of children's data without consent. Those investigations were settled in September 2019 with YouTube agreeing to pay a $170million fine and make changes to its processes. Prior to that, unsuccessful attempts had been made to bring similar class actions in the US. If the action now issued in the UK is successful, that comparison will only further increase the attractiveness of data breach representatives actions in this jurisdiction - it will be interesting to see if UK regulators take note given the rapidly rising tide.

If you found this interesting, there's a lot more comment you may find helpful on UpData, which provides regular updates on contentious, criminal and insurance risks relating to data, from cyber-attacks to regulatory enforcement.