Supreme Court decision could pave way for more mass action lawsuits in UK

Simon Fawell, a partner in Dechert’s London office, explains how two upcoming data privacy cases could pave the way for more mass action lawsuits in the UK and Ireland

On 16 April 2021, Digital Rights Ireland (DRI), a civil rights organisation focusing on data privacy issues, announced that it was launching a “mass action” legal claim against Facebook. The claim centres on information published on a hacking forum in April, which allegedly contained personal data from some 533 million Facebook users worldwide.

DRI claims the data was scraped as a result of an address book contacts import feature and alleges that Facebook breached a number of obligations under Irish data protection legislation and the GDPR in failing to protect user data.

DRI itself notes that Irish law does not provide for class actions in the way the US law does. Instead, it is likely to have to make use of the ‘representative action’ mechanism in Ireland, which allows court proceedings to be brought on behalf of everyone with the same interest in a claim.

There are, though, strict limitations on the use of representative actions in Ireland, which mean they have generally been restricted to cases where there are small numbers of claimants. It is, therefore, unclear for the moment how DRI’s claim before the Irish courts will progress.

Some pointers on how DRI will try to run its claim may be found in England, where there has been a recent increase in attempts to bring mass actions on the back of high-profile data breaches. The likely success of those claims in England will be greatly influenced by how the UK Supreme Court rules in a case it heard in the last week of April.

England, like Ireland, does not currently have an ‘opt-out’ class action system as exists in the US. It does have a mechanism for representative actions to be brought but difficulties in meeting the required procedural tests have meant the mechanism has been used relatively infrequently.

The UK Supreme Court’s consideration of Lloyd v Google may be about to change that. In the case, Richard Lloyd, the former executive director of consumer rights group Which!, seeks to bring a claim on behalf of some 4.4 million iPhone users for alleged tracking and sale of personal data without the users’ consent.

He is using the English representative action mechanism and, importantly, argues that the damage suffered by each individual user affected can be calculated using a uniform formula based on a standard contractual value for use of the compromised data.

Essentially, Mr Lloyd argues that every affected user should receive a set sum without having to prove specific loss or damage in each case. Importantly, Mr Lloyd says this allows him effectively to bring a US-style opt-out class action (i.e. one where every affected user will be included unless they expressly say they do not want to be).

Until now, the need for each individual claimant to prove the specific damage it has suffered has been a significant barrier to mass litigation in England, particularly for data breach cases. If the UK Supreme Court finds in Mr Lloyd’s favour, while there will still be a long way to go before the door is opened to wider use of mass actions in England, it will remove some of the barriers and give encouragement to the spate of recently commenced claims following a similar strategy.