Lloyd v Google: Supreme Court finds claim for compensation under data protection legislation cannot proceed on “opt-out" basis

In its judgment this morning the Supreme Court has overturned the Court of Appeal’s decision in the high profile Lloyd v Google case, which would have opened the floodgates for class actions for compensation for loss of control of personal data to be brought on behalf of very large numbers of individuals without identifying class members: Lloyd v Google LLC [2021] UKSC 50.

The decision will be of interest to financial institutions which, as businesses controlling high volumes of personal data, are exposed to the risk of group claims relating to any loss of control of that personal data. In particular, it highlights the difficulties for claimants in using the representative action procedure under CPR 19.6 to bring a data breach class action. This procedural mechanism allows an action to proceed on an “opt-out” basis, meaning that individual class members do not need to be identified, but those represented must share the “same interest” in the claim. The Supreme Court’s decision shows that it will not be possible to use this procedure to bring a data breach class action under section 13 of the Data Protection Act 1998 and obtain damages for the class as a whole on a uniform or tariff basis, without proof of individual circumstances.

The decision also highlights the risk for financial institutions that such claims could instead be brought using a “bifurcated process” in which the representative action procedure is used to determine common issues (such as whether there has been an actionable breach), leaving any individual issues to be dealt with subsequently. That could, in effect, introduce a half-way house between a fully “opt-out” claim and an “opt-in” procedure such as the Group Litigation Order, since individual claimants would (presumably) only have to be identified once the common issues had been determined. Indeed the Supreme Court went so far as to comment that the initial “opt-out” representative claim would be sufficient to stop the limitation period running for subsequent members of the class bringing individual or group damages claims.

In terms of impact on the general class action landscape in the UK, the Supreme Court's decision adds to the growing body of case law affirming that (subject to limited exceptions) the collective action regime in England and Wales works on an “opt-in” basis, and the scope for “opt-out” actions remains limited.

For a more detailed discussion of the decision, please see our litigation blog post.