Landmark Supreme Court Decision Curtails Representative Claims For Data Protection Breaches (Lloyd v Google LLC)

• Published date: 01 December 2021
• Law Firm: Bryan Cave Leighton Paisner LLP
• Author: Rachel Ziegler

Dispute Resolution analysis: The Supreme Court handed down its judgment in Lloyd (Respondent) v Google LLC (Appellant) on 10 November 2021, upholding the decision of Mr Justice Warby at first instance. The outcome (a unanimous decision from the Supreme Court) has enormous implications not just for data protection cases but for the UK class claims landscape as a whole. The Supreme Court result is undoubtedly good news for data controllers although bad news for the many data protection claims waiting in the wings. It seems likely that this result may well lead to a drop off, or at least a dampening, of the surge of cases in this area. Written by Rachel Ziegler, senior associate and Nazia Sohail, trainee solicitor at Bryan Cave Leighton Paisner LLP.

Lloyd (Respondent) v Google LLC (Appellant)[2021] UKSC 50

What are the practical implications of this case?

This case was brought under the Data Protection Act 1998 (DPA 1998) and the Supreme Court expressly stated their judgment had not considered the position under the current United Kingdom General Data Protection Regulation, Retained Regulation (EU) 2016/679 (UK GDPR) (as supplemented by the Data Protection Act 2018) that has since replaced it.

Nevertheless, any future claims in relation to unlawful data processing activity subject to the UK GDPR regime (or other historic claims under DPA 1998) may struggle to use the representative claims mechanism under CPR 19.6.

That is because this judgment was clear that to do so under DPA 1998 would require a claimant to conduct an exercise to collect evidence of the unlawful processing on a per-individual basis and then provide evidence of the individual harm suffered. Lord Leggatt noted that a general claim could have been brought to establish whether Google was in breach of...