United Kingdom: UK Supreme Court judgment in Lloyd v Google LLC

On 10 November 2021, the UK Supreme Court (UKSC) delivered its judgment in the case of Lloyd v Google LLC ([2021] UKSC 50). Specifically, the UKSC held that the action under section 13 of the Digital Protection Act (DPA) 1998 for damages for breach of data processing requirements could not be brought up as a class-action lawsuit. The claimant, Mr. Lloyd, had claimed that, in late 2011-early 2012, Google unlawfully processed the data of around 4 million iPhone users in England and Wales. Further, Mr. Lloyd had argued that, through a so-called 'representative procedure' contained in the Civil Procedure Rules, a representative for the affected users could file an action on behalf of all of them and recover damages without needing to prove infringement in every individual case. Mr. Lloyd intended to seek damages of around £3 billion. However, the UKSC rejected Mr Lloyd's arguments, holding that section 13 of the DPA 1998 required (1) proven material loss or mental distress, caused by unlawful processing (the mere fact of unlawful processing alone is insufficient) and (2) for unlawful processing to be proven in each individual case. The DPA 1998 is no longer in force in the UK - the UK's current data protection regime is comprised of the Data Protection Act 2018 and the UK General Data Protection Regulation.