Takeaways

• The U.K. Supreme Court, in its much-anticipated decision in Lloyd v Google, held that “opt-out” representative (class) actions cannot proceed unless the plaintiff proves material damage and shows that each class member is seeking the same compensation.
• The unanimous judgment limits the potential for in terrorem claims involving significant sums that create settlement pressure.
• Representative actions remain viable, however, where harm is quantifiable on a common basis across the class, i.e., where monetary loss need not be assessed on an individualized basis.
• Antitrust “opt-out” class actions, which are expressly provided for by statute, are not affected by Lloyd, and have gained momentum following the Supreme Court’s landmark judgment in Merricks v Mastercard in late 2020.

The class action landscape in the U.K. is quickly evolving, with the availability of “opt-out” class actions taking center stage. Lloyd v Google, the latest landmark judgment from the U.K. Supreme Court (UKSC), serves as a reminder of the hurdles plaintiffs face in bringing opt-out representative actions, the U.K.’s primary counterpart to American class actions. However, the Lloyd judgment has left the door open for such actions where damages can be quantified on a common basis across the putative class members.

Background: Data Protection Claims and Representative Actions

In the U.K., increased regulatory enforcement of data protection obligations has not been accompanied by successful “opt-out” representative class actions arising from breaches of the Data Protection Act 1998 (DPA 1998). The courts have not yet been asked to adjudicate representative actions under the Data Protection Act 2018 (DPA 2018, successor to the DPA 1998) or the U.K. General Data Protection Regulation (UK GDPR).

Representative actions under U.K. civil procedure rules (CPR 19.6) may be pursued on an opt-out basis, meaning that the claim is brought on behalf of every individual falling within the class unless they expressly opt out. Framed this way, with classes defined very broadly, the potential damages can be enormous, generating significant pressure on defendants to settle.

In Lloyd v Google, Richard Lloyd brought a representative action on behalf of over four million data subjects, seeking damages for an alleged breach of data protection law. Mr. Lloyd claimed that, by placing a “Safari workaround” on iPhones, Google was able to track users’ data without their knowledge or consent and create user profiles for targeting advertising. Mr. Lloyd sought a uniform amount of approximately £750 in damages for each class member — over £3 billion in total.

Under CPR 19.6, a representative action cannot be brought unless all class members share the “same interest” in the claim. Given the facts of Lloyd, any claim for personal distress or pecuniary loss would have been inherently individual. Therefore, Mr. Lloyd sought damages for loss of control over personal data, contending that each class member had suffered this damage equally, with the quantum based on the lowest common denominator of damage across the class.

Google prevailed in the High Court, but the decision there was overturned in the Court of Appeal. When that decision was appealed, the UKSC was required to decide two principal issues:

• whether damages could be recovered under the DPA 1998 for loss of control of personal data, even if no material damage had been proven; and
• whether each class member had the “same interest” in the claim.

On the first issue, the UKSC decided damages could not be awarded purely for the loss of control of personal data, as explained in our November 2021 Privacy & Cybersecurity Update. Below, we discuss the “same interest” issue.

No ‘Same Interest’ Where Damages Must Be Calculated on an Individual Basis

The UKSC unanimously found that the class members did not have the “same interest” in the claim. The Safari workaround’s impact was not uniform because the plaintiffs were profiled to differing extents, based on various aspects of their personal data, depending on their use of Safari. Damages could therefore only be calculated on an individualized basis, and therefore the “same interest” requirement was not met. The argument that each user had suffered a lowest common denominator of damage was rejected, too, on the grounds that this level of damage would be trivial.

The UKSC accepted that representative actions may be appropriate where all class members have suffered equal damage — for instance, where each class member is wrongly charged a fixed fee or suffers an identical reduction in value arising from the same defect in a product. Furthermore, the UKSC confirmed that representative actions may be viable where damages can be ascertained on a top-down basis (i.e., without needing to evaluate the losses suffered by individual class members). Alternatively, proceedings could be brought on a bifurcated basis: a representative action seeking a declaration of breach, followed by individual claims for compensation, relying on the declaration.

The Implications of Lloyd

• The judgment restricts the availability of “opt-out” class actions, which now appear to be limited to antitrust claims or claims where individualized assessments of loss are not necessary. While the findings in Lloyd were expressly confined to the DPA 1998 and are therefore untested against the DPA 2018 and UK GDPR, the decision made clear that it will be difficult to bring representative actions for breaches of any such laws.
• To the extent that class members have suffered universal losses, or their losses need not be calculated on an individualized basis, representative actions may still be brought. Hence, there is some potential for in terrorem suits alleging significant sums in damages.
• While Lloyd leaves open the possibility of bifurcated proceedings where individualized assessments of harm are necessary — with liability established as a preliminary step and individuals’ damages then proven separately — such proceedings face major hurdles, not least because of the economics of litigation funding. Such financing is integral to representative actions, and funders require the prospect of a monetary award in order to obtain a return on their investment. In bifurcated proceedings, the first stage — seeking a declaration of breach — would not generate any monetary award. The second stage may generate such awards, but requires individual claims for relatively small sums. That may be uneconomical and would make it very difficult to forecast at the outset how much could ultimately be sought and awarded. For litigation funders, who must underwrite the litigation costs and potentially pay the defendants’ expenses if the suit fails, bifurcated proceedings may be commercially unattractive, perhaps even prohibitively so.
• Claimant law firms and litigation funders may still pursue group litigation claims under CPR 19.11, where class members need only show that their claims give rise to common or related issues of fact or law. However, such claims can only be brought on an “opt-in” basis, where class members must affirmatively choose to participate. Absent a large class opting in (which has been rare), these may not be commercially viable, either.
• Finally, the UKSC’s 2021 ruling in Merricks v Mastercard provided a strong endorsement for antitrust cases, where collective actions are expressly provided for by statute. In Merricks, the UKSC considered the claims suitable for collective proceedings, finding that it was relatively more appropriate to litigate the claim collectively rather than individually. These collective proceedings may be brought by businesses or consumers, on either an opt-out or opt-in basis. (See our January 7, 2021, client alert “Merricks v Mastercard — UK Supreme Court Clarifies Low Bar for Class Action Certification.”)

[View source.]