判决理由
Damages under the Data Protection Act 1998 require proof of material damage or distress suffered by each individual claimant. 'Loss of control' over personal data does not, without more, give rise to a claim for damages. Representative actions under CPR 19.6 require that each represented person has 'the same interest' — this is not satisfied where individual assessment of damage is needed.
事实
Richard Lloyd, a former director of the consumer organisation Which?, brought a representative action on behalf of approximately 4.4 million iPhone users in England & Wales against Google. He alleged that Google had used the 'Safari Workaround' to track users' internet activity through cookies without their consent, in breach of the Data Protection Act 1998. He sought damages of approximately £750 per person for 'loss of control' of personal data, without proving individual damage or distress.
判决摘要
The Supreme Court unanimously held that the claim could not proceed as a representative action. Lord Leggatt, giving the lead judgment, held that: (1) damages under the DPA 1998 are compensatory and require proof of material damage or distress — 'loss of control' alone is not sufficient; (2) the representative action procedure (CPR 19.6) requires all represented claimants to have 'the same interest', which is not met where individual assessment of damage is required; and (3) it was therefore not possible to award a uniform sum per person without assessing what data was collected about each individual and what impact it had.
关键引述
"To recover compensation under the DPA, it is not enough to establish that Google's use of personal data was in breach of the requirements of the Act. The claimant must also show that the breach caused them material damage or distress."
— Lord Leggatt
"The representative procedure does not permit an action to be brought where the amount of any damages would require individual assessment."
— Lord Leggatt
后续处理
Definitive authority on the requirements for data protection damages and the limitations of representative actions for mass data breach claims.
Extensively discussed in subsequent privacy litigation and academic commentary on the viability of mass data protection claims in English courts.