Supreme Court holds that mass data breach claim against Google cannot proceed as a representative action

10/11/21

The Supreme Court has handed down judgment in Lloyd v Google. Mr Lloyd sought to represent a class of more than 4 million iPhone users, who were affected by the “Safari Workaround” (which allowed Google to secretly track and collate users’ internet browsing and then use the data collected for commercial purposes).  

In a single judgment, Lord Leggatt (with whom Lord Reed, Lady Arden, Lord Sales and Lord Burrows agreed) upheld Google’s appeal and restored the order of Warby J refusing permission to serve out of the jurisdiction. In particular:

1. So far as the representative procedure under CPR 19.6 is concerned, Lord Leggatt’s judgment is essentially liberalising. He addresses various aspects of that regime, but overall emphasises its flexibility and that it serves the interests of justice, and that it can and should be used to address modern mass wrongdoing.
2. So far as damages under s.13 of the Data Protection Act 1998 are concerned, Lord Leggatt holds that neither “loss of control”/Gulati damages nor user damages are available. Instead, only material damage or distress can be compensated for under s.13. In contrast, both those types of damages are available in claims for misuse of private information.

The judgment is here.

Victoria Wakefield QC will present a short webinar about the judgment on Tuesday 16 November at 12.30pm.  Please register here.