techUK responds to the Judgement of the Supreme Court in the appeal of Richard Lloyd v Google LLC
techUK made a written intervention in the appeal of Richard Lloyd v Google LLC at the UK Supreme Court. The case was heard at the Court on 28 and 29 April 2021.
In its judgement on 10 November 2021 the Supreme Court accepted the appeal of Google LLC.
Please see below a statement by techUK on the judgement and an explanation of our reason for intervening in this case.
Responding to the Court’s Judgement techUK said:
techUK welcomes the Judgement of the Supreme Court which has upheld the existing interpretation of the law, allowing citizens to exercise their rights in relation to data breaches while also continuing to support the innovative capacity and competitiveness of the UK tech sector.
techUK was concerned that, had the appeal been rejected, this would have opened the door for speculative and vexatious claims to be made against data controllers, with far-reaching consequences for both public and private organisations. Such action could have been taken by individuals or firms claiming to represent a group of people without first attempting to show whether any damage or distress had been caused to the individual, as well as acting without their knowledge or seeking their consent.
techUK does not oppose representative legal action, however, we believe it is right that any action must first seek to establish whether damage has been caused to the individual as a result of a data breach before seeking compensation.
techUK’s written intervention:
On the permission of the UK Supreme Court techUK made a written intervention in the appeal of Richard Lloyd v Google LLC at the UK Supreme Court.
The appeal of Richard Lloyd v Google LLC concerned two issues of public importance with potential profound implications for the UK technology sector.
The first issue was whether monetary compensation should be available in respect of a data breach even where no damage or distress had been suffered by the individuals concerned. In its judgement the Supreme Court upheld the existing interpretation of section 13 of the DPA 1998 requiring a claimant to demonstrate the material damage or distress caused as a result of a data breach in order to make a claim for compensation.
The second issue relates to the bringing of representative class actions in respect of claims for compensation stemming from a data breach. In its judgement the Supreme Court did not accept the legal basis for this class action as it sought to try and seek damages under section 13 of the DPA 1998 for each individual member of the represented class without attempting to show that any wrongful use was made of personal data or that any material damage or distress was suffered on an individual basis.
techUK does not oppose representative action claims. What we do oppose is creating an opportunity for claims being made on behalf of members of the public without their knowledge or consent and without those members of the public having suffered any damage or distress.
Had both issues been upheld this would have meant a seismic transformation in the operation of UK data protection law, meaning that any data breach could be open to litigation for compensation without first having to demonstrate that individual damage or distress had been caused.
techUK was concerned that this would open the door for speculative and vexatious claims to be made against data controllers by individuals claiming to represent groups of people without attempting to show any damage or distress caused to the individual. We believed that the legal jeopardy this would introduce in the UK would damage the technology sector and the ability of individuals and organisations to avail themselves of the most innovative digital services.
techUK believes that the current law provides individuals with the appropriate tools to allow data subjects to obtain redress following data breaches. Claims for compensation arising from such breaches are routinely settled in accordance with the current legal and regulatory framework (the Data Protection Act 2018).
We therefore took action to intervene in this case to set out our view of the far-reaching consequences arising out of the Court of Appeal's judgement that were of significant concern to those in the technology sector who control and process significant quantities of personal data in the furtherance of economic and social developments.
We welcome the Judgement of the Supreme Court.
About techUK:
techUK is the trade association which brings together people, companies and organisations to realise the positive outcomes of what digital technology can achieve. With over 800 members (the majority of which are SMEs) across the UK, techUK creates a network for innovation and collaboration across business, government and stakeholders to provide a better future for people, society, the economy and the planet.
techUK instructed David Cran and Alex Vakil at RPC and Catrin Evans QC and Ian Helme at Matrix chambers.
The Supreme Court’s full judgement in the appeal of Richard Lloyd v Google LLC can be found here.
techUK's full written intervention can be viewed here.
Neil Ross
As Associate Director for Policy Neil leads on techUK's public policy work in the UK. In this role he regularly engages with UK and Devolved Government Ministers, senior civil servants and members of the UK’s Parliaments aiming to make the UK the best place to start, scale and develop a tech business.
Margherita Certo
Margherita is the Head of Press and Media at techUK, working across all communications and marketing activities and acting as the point of contact for media enquiries.
