Clarification on damages for data breaches handed down by Supreme Court

12 Nov 2021

On 10 November 2021, the Supreme Court handed down its judgment in Lloyd v Google LLC leading to a saving of £3billion in compensation claims.
Richard Lloyd, a former executive director of Which?, sought to act as a representative in respect of a claim against Google for damages allegedly suffered by iPhone users as a result of the unlawful processing of personal data. His claim for compensation revolved around the “loss of control” of each claimant’s personal data. Mr Lloyd’s claim sought to rely on Civil Procedure Rules 19.6 which allows one or more individuals to act as a representative for parties who have the same interest without the Court having to investigate each Claimant’s individual circumstances, in this case the other iPhone users whose rights were infringed by Google’s breach of Data Protection laws.
Google disputed the application on the basis that CPR19.6 was not applicable to this type of claim. They argued that damages cannot be awarded under the Data Protection Act 1998 (“DPA”) without proof that a breach of the Act caused financial loss or other material damage to the Claimant, or that they have suffered distress as a result of the breach. If accepted by the Court this would mean that each Claimant’s individual consequences would have to be reviewed to determine whether they suffered loss.
The High Court agreed with Google but that decision was later overturned by the Court of Appeal in favour of Mr Lloyd. The Supreme Court confirmed the original decision by a unanimous verdict on the basis of its interpretation of 13(1) of the DPA which states “An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage”.
Lord Leggatt in his judgment stated that the above wording “is inconsistent with an entitlement to compensation based solely on proof of the contravention”. Instead a Claimant must prove material damage or distress to be entitled to compensation under the DPA.
This year has seen an array of data controllers receiving record fines from ICO for data breaches and so this decision is likely to come as welcome clarification for those data controllers who may be subject to class actions by individuals following a breach, especially where the breach is trivial in nature. It is, however, worth remembering that a Claimant can still claim damages under tort law but that test is based on the value of that data and what may have been paid for it.
If you have been the subject of a data breach and want to discuss whether you are entitled to damages please contact Cathryn Culverhouse.

Further reading

Ganz v Petronz FZE & Goren – key decisions of the arbitration claim

Blog, Legal Updates
The recent Judgment in the arbitration claim Mordchai Ganz v (1) Petronz FZE (2) Abraham Goren [2024] EWHC 635 has already received attention from legal pundits.  The DMH Stallard’s legal team (Tim Ashdown, Beatrice Bass and Patrick Murray) acted for the Claimant. DMH Stallard was supported by the legal team of Altshuler Law in Israel which is a collaboration enabled through their membership of LEInternational.
Read more Read

Reversal of changes to High Net Worth Individual and Self-certified Sophisticated Investor criteria implemented

Blog, Legal Updates
As discussed in our recent update, the government announced in the Budget that the eligibility criteria for the exemptions, which allow shares and other financial instruments to be marketed to High Net Worth Individuals and Self-certified Sophisticated Investors without the regulatory protections
Read more Read

FCA to investigate personal guarantees in small business lending following a super complaint

The FSB has raised concerns that the demand for personal guarantees by lenders has a detrimental impact on small businesses accessing borrowing to grow
Read more Read

ECCTA: Fundamental changes for companies and considerations for lenders: Practical points to note

Tyne Harman outlines some of the key considerations for lenders and borrowers alike to be aware of.
Read more Read
  • Brighton - Jubilee St

    1 Jubilee Street


    East Sussex

    BN1 1GE

  • Brighton - Old Steine

    47 Old Steine


    East Sussex

    BN1 1NW

  • Gatwick

    Griffin House

    135 High Street


    West Sussex

    RH10 1DQ

  • Guildford

    Wonersh House

    The Guildway

    Old Portsmouth Road



    GU3 1LR

  • Hassocks

    32 Keymer Road


    West Sussex

    BN6 8AL

  • Horsham

    3rd Floor

    Afon Building

    Worthing Road


    West Sussex

    RH12 1TL

  • London

    6 New Street Square

    New Fetter Lane


    EC4A 3BF

  • Make an enquiry

    Make an enquiry


    Or head to our Contact us page