Decision in Lloyd v Google

Earlier today the Supreme Court unanimously allowed the appeal in the case of Lloyd v Google. This is a positive outcome for data controllers of all sizes and will have significant impact on claims in this area going forward. Hear our team’s instant reactions to the judgment in the short 6 minute video below.

Immediate key takeaways

We will provide a more detailed analysis of the judgment over the coming days, including what this means for businesses going forward, however wanted to provide some initial key takeaways after the initial reading:

• The Supreme Court rejected the argument that compensation could be claimed for mere ‘loss of control’ of personal data. Rather, compensation for a breach of s13 of the DPA 1998 should only be awarded if the data subject suffered “material damage or distress”.

• The Court also rejected the Claimant’s attempts to use the representative action procedure (CPR19.6) to implement a US style opt-out class action. In order to decide whether any material damage or distress was caused, it is necessary to establish the extent of that damage in the case of each affected individual. This meant that the model of opt-out style class action being proposed by Richard Lloyd in this case was not viable.

• This closes the floodgates and prevents data subjects from bringing claims for breach of data protection law without proof of actual loss. This is good news for data controllers and is an additional hurdle for claimants and litigation funders looking to bring class-action claims who will now need to consider alternative avenues if they are to issue these types of claim.