Introduction

Businesses store and process vast amounts of personal data. When management of that data allegedly goes wrong, litigation can follow. Recently, a number of significant collective actions related to data have surfaced in the UK, including those involving Google,^[1] YouTube,^[2] Marriot,^[3] Morrisons Supermarkets,^[4] British Airways^[5] and easyJet.^[6]

Data related collective actions can generally be divided into two broad categories: (i) “unauthorized use of personal data” cases, where the firm controlling personal data allegedly uses it in an unauthorized manner; and (ii) “unauthorized access to personal data” cases where a third party (e.g. hackers) improperly accesses private data for malicious reasons.

This article discusses some of the key legal and economic issues that arise in matters involving the unauthorized use of, or unauthorised access to, personal data in the UK.^[7]

Data Protection Laws in the UK

“Personal data” can refer to diverse information types. The EU’s General Data Protection Regulation (GDPR), which was implemented in the UK and supplemented by the UK Data Protection Act of 2018 (DPA 2018),^[8] classifies personal data as any information relating to an identifiable individual. Examples of personal data include names, email addresses, financial information, health data, biometric and genetic data, data revealing racial or ethnic origin, and data about criminal convictions or offences. The form of personal data can vary and may include private photographs or videos.

Inter alia, the GDPR requires that “personal data must be collected for one or more specified and legitimate purposes”,^[9] and that it “must be processed lawfully, fairly, [and] in a transparent manner”.^[10] The GDPR also requires firms to store personal data for “no longer than necessary”,^[11] and to take “appropriate technical and organisational measures against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, and damage to, personal data, to ensure a level of security appropriate to the risk”.[12]

When a firm does not meet its GDPR obligations, the GDPR provides the aggrieved person(s) the right to compensation for both “material” and “non-material” harm, including distress,^[13] unless the controller or processor “proves that it is not in any way responsible for the event giving rise to the damage”.^[14] In each case, damages as a matter of English law are designed to put claimants in the same position they would have been had the breach not occurred. The GDPR notes, in its recitals, that "a personal data breach may … result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned." ^[15]   Thus the categories of damage are potentially broad.  A point being actively contested in the English Courts is whether a data subject can claim damages for "loss of control" of personal data, as we discuss further below.

Means of Bringing Collective Claims n

There are two principal means of bringing collective claims in personal data–related matters in the UK:

• A common route is a Group Litigation Order (GLO), which is brought on an “opt in” basis, where multiple claims give rise to “common or related issues”. While there is a trial of common questions of fact or law (e.g., whether there was a breach of relevant legislation), the amount of damages is assessed for each claimant. For example, the claimants have used a GLO in British Airways.^[16]

• Alternatively, a Representative Action (RA) is brought on an “opt out” basis. Historically, RAs have been less common than GLOs since the representatives and the represented class are required to have the “same interest”, which is a more stringent test than “common or related issues” for a GLO. However, recently the Court of Appeal (CoA) decision in Lloyd v Google suggested that RAs may prove a feasible way to launch a claim despite the “same interest” restriction.^[17] If the Supreme Court agrees with the CoA, Lloyd v Google may encourage further RAs on behalf of parties who have not necessarily suffered pecuniary loss or distress, but who are (according to the CoA) entitled to damages for “loss of control” over their personal information. The claim is structured to try to meet the “same interest” requirement by only seeking damages that represent the “lowest common denominator” of loss of control damages. Even so, the “opt out” nature of RAs means that actions involving substantial numbers of claimants are likely to result in damages claims for very significant aggregate amounts.   

Beyond GLOs and RAs, other means of bringing collective claims include multi-claimant litigation. Companies may also propose their own remediation programmes to compensate affected data subjects. Looking ahead  there may be an expanded role for class actions because of the EU Collective Redress Directive, albeit Brexit will mean that this will not directly impact the UK.^[18] In addition, the UK government will need to decide whether to introduce legislation to provide for class actions similar to those currently available for competition matters.

Theories of harm in unauthorised use of, or access to, personal data matters

While the specifics of each case will determine the precise nature of claims, experience suggests that claimants in cases involving unauthorized use of personal data may take the position that privacy has an “intrinsic value” which is lost when personal data is misused or used without consent.^[19] Thus, claimants may assign economic value to the integrity of private information, and argue for a common measure of damage, regardless of the nature of information at issue.

This view is consistent with the CoA’s ruling in Lloyd v Google that there was economic value to a person’s control over personal information and “loss of control” was therefore sufficient to attract damages.^[20] In addition to appealing to the “intrinsic value” of privacy, claimants in unauthorized use of personal data matters may also seek compensation for intangible harms, such as distress and anxiety without the need to first prove financial loss, as in Morrisons.^[21] 

While claimants may argue that privacy has intrinsic value in unauthorised access to personal data cases as well, US experience suggests they are also likely to claim compensation for more tangible harm. Such claims may include compensation for identity theft monitoring and prevention costs, time spent and/or loss of productivity to address the breach, future risk of identity theft, diminished value of private data, overpayment for service, and loss of access to account funds or adverse credit effects.^[22]

Valuing Personal Data and Potential Harm due to Loss or Breach of Privacy 

The range for the quantum of damages awarded by the Court in past UK data-related cases varies at least from £10 to £18,000 per claimant.^[23] Damages estimates will necessarily vary significantly across cases when the facts of the case determine the quantum.   

In this section, after a brief description of the types of methodologies that scholars have considered when seeking to value personal data, we discuss the challenges in attaching a monetary value to personal data and privacy.

Methodologies for Valuing Personal Data and Potential Harm due to Loss or Breach of Privacy

Marketing and economics scholars have considered several methodologies for quantifying the value of personal data and any harm resulting from a loss or breach of privacy. These methodologies, also used for example in competition investigations, fall under two broad categories:

• Stated Preference Methods such as contingent valuation and conjoint analysis ask survey respondents questions in a manner that allows the investigator to learn about their preferences about data privacy and/or data breaches. To provide reliable results using these methods requires the expert to take great care when designing, implementing, and interpreting the survey. Done poorly, stated preference methods can produce unreasonably large damages estimates.

• Revealed Preference Methods such as natural experiments, event studies, and difference-in-differences analyses rely on real-world data that measures actual behaviour following a “data event” rather than consumers’ stated responses. For example, it may be possible to measure changes in private browser usage before and after the news about an infringement was made public. Alternatively, one could assess whether affected individuals took the time and effort to delete the information on their user profiles after the disclosure. If they did not, then it may indicate that they place little value on the data breach at issue. While revealed preference methods can have advantages over stated preference methods, they can also be susceptible to modelling choices, causality issues, and confounding factors, and do rely on assumptions. Applying these methods in a litigation context therefore requires careful thought.

Once any harm resulting from a loss or breach of privacy has been estimated, it is also important to account for relevant benefits that may have accrued to claimants from a company’s use of their data. For example, empirical methods could be used to measure whether consumers value online advertising that is targeted to match their preferences. If such targeted advertising provided a positive benefit to the claimant, then the damages calculation – which aims to put the claimant in the position it would have been absent the breach – should reflect the damage from the loss in privacy net of the benefits arising from the breach.

Challenges Inherent in Attaching Value to Personal Data and Privacy 

There are several inherent challenges in valuing personal data and any loss of control of personal data. Some of the key issues are discussed below.

The “Privacy Paradox”

A central challenge in quantifying the value of privacy is the “Privacy Paradox”. Specifically, consumers may behave as if they do not value privacy but, when asked, they may state that they attach a substantial value to it.^[24] For instance, consumers typically do not read terms and conditions, and willingly give up a lot personal information when interacting online, yet survey respondents often claim that they attach significant value to at least certain types of personal data.^[25]

Heterogeneity in individuals’ perceptions of privacy

The literature on privacy finds that the perception of privacy varies considerably across individuals and across contexts.^[26] Individuals differ significantly in terms of their expectations regarding whether their information is public or private, and hence their concern for the privacy of their information. For instance, a 2014 survey conducted by UK Information Commissioner’s Office showed that 24 per cent of respondents considered their internet browsing history to be “Not sensitive” while the rest considered it “Sensitive” or “Extremely sensitive”.^[27] In fact, even a given individual’s preference for privacy for the same information can vary by context.^[28] Such evidence sits uncomfortably with a notion there is a unique, intrinsic value to privacy or harm due to loss of control of privacy.  

The value a firm derives from personal data does not necessarily reflect the damage to claimants from a loss of privacy or personal data

Any value a firm derives from personal data will be affected by numerous factors other than the data itself. For example, it may reflect, in part, the value added from data aggregation and processing using the firm’s proprietary algorithms. Any approach that relies on the value of the data to the firm would have to separate out the contributions of the other (confounding) factors that influence a firm’s valuation, revenues and profits. Moreover, personal data may only be valuable to firms to the extent that it is part of a large dataset. If so, the value of an individual’s data may not be easily inferred from the value the firm derives from an aggregation of personal data. Finally, the fact that a firm may benefit from private information does not preclude benefits to users. For example, the information collected may be used to provide better search results and, if so, this benefit must also be quantified and accounted for.

Establishing causality is not always straightforward

Establishing that any loss was directly linked to a specific data breach is important when calculating damages in data breach matters. Given how common data breach incidents are becoming,^[29] it may not be straightforward to determine whether a given claimant was impacted by a given data breach (as opposed to a variety of other data breaches that may have affected that same claimant). In addition, there can be other confounding factors—for example, some of the private information may be accessible through means other than the data breach.

Markets where an individual’s personal data can be priced legitimately do not ordinarily exist

Evidently, where markets don't exist, there can be no reliable “market price” for an individual’s data. While personal data may be available for purchase on the dark web, the price data available from such transactions will reflect a valuation relevant for illicit activities such as identity theft, and may therefore be very different from the value of that data for legitimate activities like targeting online ads. Thus, the price of stolen data on the dark web may not reflect either an individual claimant’s valuation or a “minimum” valuation common to all claimants

Conclusion