The UK Supreme Court’s recent and long awaited judgment in Lloyd v Google was good news for data controllers.

On the other side of the debate consumer groups and litigation funders, who have been patiently waiting in the wings for the decision, are disappointed.

A lot has been written about the Supreme Court judgment putting the brakes on an anticipated wave of “opt out” group claims in England in the data privacy sphere.

Meanwhile, in Scotland we are seeing an uptick in group proceedings being raised since the introduction of a new group action procedure in August 2020.

Group proceedings are reportedly now underway, at various procedural stages, in relation to a varied range of topics – from emissions, to personal injury sustained overseas, to historic sexual abuse allegations.

A far cry from data privacy claims, you might say, but what does the Lloyd v Google decision mean for group proceedings in Scotland?

The data privacy question

The data privacy regime is UK wide, and so applies equally in Scotland as in England.

The Lloyd decision was significant in determining whether a claim in damages could successfully be made under Data Privacy Act 1998 for “loss of control” of personal data without needing to show that the breach caused material damage or distress to the claimant.

The Supreme Court rejected Lloyd’s argument, holding that an award of damages may only be made if the data subject has suffered material damage (such as financial loss) or distress.

The Lloyd case was brought under the DPA 1998, not the DPA 2018 or the UK GDPR, and Lord Leggatt was clear that, as a matter of principle, his decision did not deal with the latter.

Claimant firms and litigation funders will no doubt be poring over the judgment and the legislation to identify potential points of distinction, but there are strong arguments that the outcome of Lloyd would have been the same had it been brought under UK GDPR.

In particular, both regimes distinguish between the act giving rise to the damage (the breach) and the damage itself. In other words, entitlement to damages does not automatically follow a breach.

We will soon have more clarity in the context of GDPR as the European Court of Justice considers these issues on referral from the Austrian Supreme Court.

Although such a judgment will no longer bind the UK court, it will provide useful guidance in relation to UK GDPR.

Collective proceedings in England

The “loss of control” argument put forward by Lloyd was an inventive one, constructed primarily in order to make use of the “opt out” style representative action in English civil procedure which allows an individual to bring a claim on behalf of a wider class where all members of the class have the “same interest” in the claim.

In order to avail himself of this rule, Lloyd disregarded each group member’s individual circumstances and asked the court to award damages to each class member on the basis of the hypothetical class member least affected by the breach.

However, this approach was rejected by the Supreme Court. Most significantly, the judge stressed that the data subjects need to be able to demonstrate material damage or distress on an individual basis and therefore damages could not be awarded on a representative basis.

This does not close the door to group claims in respect of data privacy issues where individual loss and damage can be demonstrated. The English procedural rules also allow collective proceedings to be brought by way of a Group Litigation Order (“GLO”).

However, the GLO procedure is purely “opt in” and so individuals must take active steps to join the action. As a result, the group will inevitably represent only a proportion of potential members.

Earlier this year, the GLO procedure was used to bring proceedings (which reportedly settled in the summer) against British Airways in respect of data breaches caused by a cyber attack in 2018.

Scottish group litigation procedure

While England has a long history of group procedure, Scotland’s first group procedure was introduced in August 2020.

Prior to this, claims had to be raised at court individually, before ad-hoc grouping of common cases could take place if required.

The new Scottish group procedure allows for a nominated “representative party” to bring group proceedings. On first glance, you would be forgiven for thinking this sounds exactly like the English “representative procedure” used by Lloyd, but that is not the case.

Perhaps most significantly, the Scottish group procedure is an “opt in” procedure, unlike the “opt out” representative procedure in England, and so individual group members must actively sign up to be involved. In this sense, the Scottish group procedure is more akin to the English GLO procedure and will result in smaller groups.

In addition, group proceedings can be brought in Scotland by the representative party in respect of claims giving rise to the same or similar issues of fact or law. This is broader than the English representative action, which requires all class members to have the same interest. For claims giving rise to similar issues, the GLO procedure is more appropriate.

In Scotland, where the group gives rise to similar issues of fact or law, as opposed to exactly the same issues, the representative party in Scotland is more of a figurehead. The procedure allows the judge broad case management powers to determine the various similar issues of fact and law which arise, for instance through selection of lead cases.

The Lloyd v Google decision has taught us that the scope for representative claims is limited as, ultimately, every group member must be able to demonstrate loss on an individual basis. That is certainly the case in the new Scottish group procedure, as the underlying legislation implementing the procedure makes it clear that every group member has their own distinct claim.

Last year the UK government consulted on the possibility of introducing a bespoke “opt out” class action procedure specifically for data protection claims, but concluded that this was not necessary. As the UK’s data protection regime is UK-wide, any such tribunal would likely have jurisdiction over claims arising in Scotland, as well as England.

The government is likely to come under some pressure from consumer groups to revisit this decision in light of the Lloyd v Google judgment.

What next for data privacy group claims and group proceedings in Scotland?

Lloyd v Google is likely to stymie “opt out” representative actions in the English courts on behalf of millions of data subjects - but data controllers should be aware that data subjects can still bring group claims in respect of contraventions of the DPA 1998 or infringements of UK GDPR and may successfully claim damages where material damage (such as financial loss) or distress can be demonstrated.

That is true in England, using the GLO procedure, and also in Scotland where our new group procedure is now in full swing.

However, whether north or south of the border, individuals will be required to “opt in” to any group claim and, importantly, following the decision in Lloyd v Google, individualised assessment of loss will be fundamental.

Whether within the data sphere or another sector, if you have a potential group litigation issue our top-ranked team of experts are on hand to advise on all aspects using their decades of experience in international group litigations, including under the new Scottish group procedure.

Please visit our Group Action page to find out more about our team and how we can help.

Related News, Insights & Events