Posted: 12/11/2021
The highly anticipated judgment in the case of Lloyd v Google [2021] UKSC 51 was handed down by the Supreme Court on 10 November 2021.
The case was brought on behalf of an estimated four million Apple iPhone users whose web browsing activity was tracked by Google LLC over several months in 2011 and 2012. Most controversially, those users’ private browser generated information (BGI) was subsequently sold to advertisers without their knowledge or consent.
A more detailed examination of the judgment and an analysis of the practical impacts the decision may have will be published shortly, but, in summary, the Supreme Court unanimously allowed Google’s appeal, ruling that Mr Lloyd’s representative class action for compensation should not proceed. When handing down the judgment, the Court provided a two-stage breakdown as to why.
Firstly, the Supreme Court confirmed that an award of compensation for a non-trivial breach of the Data Protection Act 1998 can only be made if the data subject has suffered some form of material damage, or if they have suffered distress. A mere “loss of control” of personal data is insufficient for a data subject to obtain an award of compensation.
Secondly, even if damages were available for loss of control, the Court held that it would still be necessary to prove what unlawful processing of personal data relating to each individual data subject had occurred. That would have precluded a representative action, as it would require individualised assessment.
As such, it is clear that, in order to advance a claim seeking compensation for an individual under the Data Protection Act 1998, it is necessary to show some material damage or distress suffered by that individual. This will no doubt close the “floodgates” in respect of individual claimants who previously sought to rely on the very fact of the breach to substantiate their claim, rather than any substantive damage or distress that they had suffered. However, Lord Leggatt specifically contained the judgment’s reach, stating that it referred only to the DPA 1998. The UK GDPR expressly refers to “non-material” damage as a basis for compensation, potentially paving the way for another battle over loss of control claims under that regime.
This article was co-authored by trainee solicitor Oliver Simpson.
© 2024 Penningtons Manches Cooper LLP.
All rights reserved.
Website design by Frontmedia / Dynamic Pear
Penningtons Manches Cooper LLP is a limited liability partnership registered in England and Wales with registered number OC311575 and is authorised and regulated by the Solicitors Regulation Authority under number 419867.
Return to news headlines 
