Data breach claims – the Supreme Court has spoken in Lloyd v Google

The Supreme Court handed down judgment in the case of Lloyd v Google LLC on 10 November 2021, finding in favour of Google. This decision will have a significant impact on claims management companies and brings good news for data controllers.

This judgment is undoubtedly one of the most important and eagerly awaited data protection judgments to date, and follows on from other recent decisions that were also very positive for data controllers.

We will provide a more detailed update in due course. However, here is what your business needs to know for now:

• The Supreme Court overturned the Court of Appeal's decision and held that data subjects were not automatically entitled to compensation merely for (non-trivial) loss of control of personal data.
• Financial awards of this nature can be made only if there is material damage or financial loss or distress. This will need to be established on an individual case by case basis and harm is not to be assumed.
• Further, in the case of large class actions, the consequences for each claimant will not be the same. This means that the same award for each person is not appropriate. (Claims management firms bringing class action claims of this nature may well think twice in the future. A number of pending large class action claims may therefore be affected.)
• "Kitchen sink" claims seeking damages for misuse of private information and breach of data protection law do not necessarily give rise to the same remedies. Personal data is not always private information.
• The decision relates to the wording under the Data Protection Act 1998 which has been superseded by the GDPR and Data Protection Act 2018. However, the language of the GDPR is very similar to the former legislation. It therefore remains to be seen how claimants proceeding under the current legislation will be able to distinguish their own case(s).

This decision is a significant victory for Google, a much desired result for data controllers, and a blow to claimants, firms and litigation funders behind the recent surge in data protection claims. We hope the decision serves to keep the floodgates for class actions firmly closed.