Ratio Decidendi
A representative action for breach of data protection legislation cannot succeed where the claim is for uniform, per capita damages without proof of individual loss. Each class member must show they suffered material damage or distress — 'loss of control' of personal data alone, without more, does not give rise to a right to compensation.
Fapte
Richard Lloyd brought a representative action on behalf of approximately 4.4 million iPhone users in England & Wales, alleging that Google had unlawfully tracked their internet activity through the 'Safari Workaround' between 2011 and 2012, in breach of the Data Protection Act 1998. He sought uniform damages of £750 per person without proving individual loss.
Rezumatul hotărârii
The Supreme Court unanimously held that the representative action could not proceed. Lord Leggatt held that compensation under the DPA 1998 required proof of damage (financial loss or distress) suffered by each individual. A claim for uniform per capita damages without individual assessment was not permissible. The mere loss of control of data, without proof of resulting damage, was not compensable.
Citate cheie
"Damages for loss of control of data are not available under the DPA 1998 without proof of material damage or distress."
— Lord Leggatt
Tratament ulterior
Significant authority on the limits of representative actions and the requirement to prove individual loss in data protection claims.
The position may differ under the UK GDPR, which uses the broader term 'damage' rather than 'damage or distress'.