Lloyd v Google in the Supreme Court - what's the impact?

The Supreme Court has issued an important decision clarifying the potential scope of claims in a data protection context (Lloyd v Google LLC). 

The Court considered a number of points but importantly they were asked to confirm whether-

1. a claimant could bring a claim on behalf of a represented class for a violation of privacy (which could have the impact of making claims substantially bigger in size); and 
2. individuals could obtain compensation for mere ‘loss of control’ of their data where this was more than trivial, without demonstrating any loss or distress (which would have the impact of making claims easier to prove). 

The judges, in essence, rejected both of these points. 

They confirmed that, while a single stage representative action could be used to bring a claim these were appropriate, primarily, for claims where the individuals had all clearly suffered the same loss. Where each individual’s loss needed to be separately assessed a single decision on the amount due could not be given. This was the case here as the impact of the breaches varied in their impact on the different individuals. 

They also confirmed that individuals did not suffer loss merely because their data was used in contravention of data protection law. Each individual needed to demonstrate the loss or distress they had suffered as a result of the misuse.  

This decision should assist in cutting down on speculative claims and in reducing the potential scale of those claims which are brought where breaches of the data protection legislation are alleged. 

This is a relief for those processing personal data. 

We should highlight that the decision looked at the old data protection law, rather than the regime which is currently in place. There is an Austrian court looking at a similar question under the EU GDPR however, which will be of interest in the UK when it is delivered.