United Kingdom: UK Court of Appeal decision in Lloyd v Google LLC

On 2 October 2019, the UK Court of Appeal (CoA) has delivered its decision in Lloyd v Google LLC ([2019] EWCA Civ 1599) in favour of the appellant Mr. Lloyd. Mr. Lloyd had claimed that Google had unlawfully processed the data of over 4 million iPhone users in England and Wales for the period between late 2011 and early 2012. Mr. Lloyd filed a claim for damages under section 13 of the Data Protection Act (DPA) 1998 and argued that he could act as a representative for all 4 million affected users. Since Google is based outside of the jurisdiction of England and Wales, Mr. Lloyd required permission from a court to initiate the proceedings. The High Court had held in favour of Google and denied permission to the appellant. On appeal, however, the CoA held that damages under section 13 of the DPA 1998 could be recovered without proving material loss or mental distress, and that a class-action lawsuit could be brought against Google as part of which Mr. Lloyd acts as the representative of the users whose data had been allegedly unlawfully processed. The CoA also specifically held that Mr. Lloyd could initiate proceedings against Google despite the company being outside of the jurisdiction of England and Wales. The DPA 1998 is no longer in force in the UK - its current data protection regime is comprised of the Data Protection Act 2018 and the UK General Data Protection Regulation.