‘Explosive’ growth in UK data breach litigation

The number of UK data breaches has been falling due to improved cybersecurity but lawyers are reporting an “explosion” in costly data breach and privacy litigation. According to figures from the Information Commissioner’s Office (ICO), the number of data breaches in the UK has fallen steadily during recent years, despite a shift to remote working and internet commerce during the pandemic. Since Q1 2019/2020, the number of breaches per quarter has fallen from 3,091 to 2,404. But while the number of data breach incidents has reduced in recent years, UK companies continue to face significant risk of litigation from data breaches and privacy issues. Data breaches provide fertile ground for litigation in the UK, including class actions, according to Hans Allnutt, partner at DAC Beachcroft and leader of its cyber and data risk team. Data and privacy breaches typically involve large numbers of claimants, while UK legislation has a low threshold for distress damages. Class actions are also often supported by litigation funders, said Allnutt. However, data breach class actions in the UK have met with limited success and many settle before going to court. For example, British Airways settled a data breach class action for its 2018 data breach. One particular hurdle for UK data breach class actions is the need to demonstrate damage. Last year, the Supreme Court blocked a £3bn lawsuit against Google claiming damages on behalf of iPhone users, who alleged the tech company had tracked their internet activity. The court ruled that the claimants had failed to prove that individuals suffered damage from Google’s use of their data. Class actions do face an “uphill battle” but the “spoils are significant”, Allnutt explained. As a result, the main focus of litigation is often on individual claims and privacy issues, he said. “For a security breach class action to show that there is a financial loss or distress element is always going to be tricky. However, for a privacy breach – where there is a misuse of data for a commercial outcome – there might be a greater chance of getting a landing. The ICO recently fined Clearview AI for collecting more than 20 billion images of individuals around the world for commercial gain. On a class action level, the courts might have more sympathy around that,” said Allnutt. While some insurers are reporting a slight reduction in cyber claims during recent months, DAC Beachcroft is as busy as ever dealing with incidents, according to Eleanor Ludlam, partner at the firm. “We are seeing a lot of activity and litigation in the data protection and privacy space at the moment,” she said. In particular, there has been an “explosion” in individual privacy litigations during the past couple of years that are generating costly “attritional losses” for companies and their insurers, according to Ludlam. “People often talk about big class actions following significant breaches, but actually these are few and far between. The volume of litigation we see lays in the individual privacy litigation world. It is lower value and lower cost on a per-claims basis but when you multiply it up, it becomes quite an exposure and a risk for business,” she said. For example, DAC Beachcroft has been working on an incident where 3,000 people were accidently copied into an email, which has resulted in 1,000 individual claims. “The exposure for that company is huge,” said Ludlam. And following Brexit, UK companies now face potential fines for data breaches in the UK and Europe. “One of the biggest risks that businesses are not always aware of is that you can have a breach by an international company that merits a fine from the ICO and then from EU regulators. Pre-Brexit, we were able to participate in a one-stop shop and would be issued with one fine from regulators. Now you can face multiple fines, so the risk to businesses is far greater,” said Ludlam. Malicious and accidental data breaches are still the biggest source of cyber insurance claims for Marsh in the UK and account for more than 40%, according to Brian Warszona, UK cyber deputy practice leader at the broker. Improved cybersecurity and more secure data storage have helped reduce the number of large data breaches, he explained. But human error and ‘culture’ continue to drive smaller breach incidents, such as missent emails containing personal data, he added. In fact, three quarters of breach incidents reported to the ICO were non-cyber, with data emailed to the wrong recipient being the most notable cause of breach and making up 15% of total incidents. But ransomware incidents increasingly result in data breaches, Warszona said. The ICO reported a steady increase in the number and severity of personal data breaches caused by ransomware during 2020/2021. Marsh has also noted an uptick in breaches and disruption related to supply chains, where a growing reliance on third-party vendors and IT services is creating vulnerabilities for companies and a risk of systemic events, said Warszona.

‘Explosive’ growth in UK data breach litigation

Want to read this article?

Read Next

Multinationals in China to enjoy relaxed data transfer rules

Coface names country manager for Italy

IASB meets in China to discuss climate reporting

‘Pressure rising’ on developing Asian aging risk: ADB

European business confidence in China plummets

Multinationals in China to enjoy relaxed data transfer rules

Coface names country manager for Italy

IASB meets in China to discuss climate reporting

‘Pressure rising’ on developing Asian aging risk: ADB

European business confidence in China plummets

Want to read this article?

Read Next

Multinationals in China to enjoy relaxed data transfer rules

Coface names country manager for Italy

IASB meets in China to discuss climate reporting

‘Pressure rising’ on developing Asian aging risk: ADB

European business confidence in China plummets

Related Articles