Lloyd v Google: A Good Day For Claimant Lawyers; A Bad Day For Google And Organisations Defending Privacy Group Litigation

On 2 October 2019 the Court of Appeal allowed an appeal in Lloyd v Google1, a significant case in the continued evolution of the UK class action and data protection regimes.

The Court of Appeal held that:

Damages are, in principle, capable of being awarded for loss of control of data under section 13 of the Data Protection Act 1998 (the DPA), even if there is no pecuniary loss and no distress. Although this case relates to the old DPA regime, the new GDPR and Data Protection Act 2018 are likely to be interpreted in the same way. Whilst Lloyd's use of the representative action procedure pursuant to CPR 19.6(1) to bring an opt-out-style class action is “unusual”, it is permissible. The members of the represented class all had their browser generated information (BGI) taken without their consent, in the same circumstances and in the same period. They are all victims of the same alleged wrong and all sustained the same loss. The High Court ought to have exercised its discretion to allow this representative action to proceed. Summary

Richard Lloyd is bringing a US-style (opt-out) “class action” against Google in the English courts, relying on the representative claims procedure set out in Civil Procedure Rule (CPR) 19.6. He brings his claim on behalf of more than 4 million Apple I-Phone users; allegedly affected by Safari Workaround in the period from 9 April 2011 to February 2012. Lloyd's innovative claim seeks a uniform amount of damages without seeking to prove damage for each individual, significantly reducing the complexity and cost of the claim.

Before this claim can get off the blocks, Lloyd...