The UK Supreme Court handed down its much-anticipated decision in the Lloyd v Google LLC [2021] UKSC 50 case on 10 November 2021 restricting claimants’ ability to bring data privacy class actions in the UK under the (now repealed) Data Protection Act 1998 (DPA 1998). This decision will be persuasive (though not binding) with respect to similar class actions brought under the (in-force) UK General Data Protection Regulation and the Data Protection Act 2018 (collectively, the UK GDPR). This decision will not directly impact litigation brought under the EU General Data Protection Regulation in EU member states.

Key takeaways

1. The Supreme Court determined that compensation under section 13 of the DPA 1998 may be awarded to affected individuals only where it is established that an individual has suffered damage (interpreted by the Supreme Court to mean material damages such as financial loss or mental distress) caused by a contravention of DPA 1998 by a data controller. Importantly, statutory infringement would not, in and of itself, constitute material damages for purpose of awarding compensation. Requiring claimants to prove that an infringement of DPA 1998, no matter how severe, has caused the claimant’s damage makes it more difficult for claimants to succeed in such claims.

2. The Supreme Court suggested that it may be appropriate for claimants to bring bifurcated proceedings in similar cases in the future, i.e., to first bring a representative action to establish the defendant’s liability, and to then pursue individual claims for compensation. This type of two-stage approach will make such claims less appealing for both prospective claimants (given the increased cost to pursue individual, low value claims through to the second stage) and litigation funders (who may only obtain an award for damages following the second stage of litigation and now will have to prove the damage caused to each particular individual).

3. Importantly, the Supreme Court’s decision was made under the now-repealed DPA 1998, and not the in-force UK GDPR. While the DPA 1998 is similar to the UK GDPR, there are potentially material differences in the statutory regimes. Therefore, while the Supreme Court’s decision will be persuasive with respect to similar class actions brought under the UK General Data Protection Regulation and the Data Protection Act 2018, it is unclear whether it would be formally binding with respect to such class actions.

Overall, this decision will have wide-ranging consequences for the future of class actions in the UK in general, and in the data protection field in particular. In turn, this decision is likely to be welcomed by many businesses who may be potential defendants in data privacy litigation in the UK. Nonetheless businesses will need to be wary with respect to potential UK class actions under the UK GDPR.

Our in-depth analysis of the wider impact of the Supreme Court’s decision on the class action landscape in the UK will be published shortly.