GLO-ing in the dark – further challenges for data protection group litigation

In Bennett v Equifax Ltd [2022] EWHC 1487 (QB), Senior Master Fontaine was dealing with an application for a GLO covering individuals affected by a cyber attack and data breach in respect of personal data held by the credit reference agency Equifax. The claims are under the Data Protection Act 1998, with Equifax denying liability despite an ICO finding of breach. The Senior Master agreed with Equifax that there were ‘real concerns about the entitlement to compensation under the DPA [1998] for a significant proportion of these claims’ given their very low asserted value. The issue of how to manage these claims, and whether to make a GLO, was referred to a High Court judge, but with a clear steer to the parties from the Senior Master that ‘an efficient and proportionate way of managing such [low value] claims must be found’, and that it is not feasible for so many low value claims to be handled as individual claims.

Following Lloyd v Google LLC in the Supreme Court, it is clear that low-value group litigation in the field of data protection is something of a minefield for claimants. The need for each claim to prove the fact and causation of actual damage (even if ‘non-material’ damage) is a real barrier, especially where liability is also in issue. SMO v TikTok (discussed in a previous Data Brief – this was a representative action, as was Lloyd) has now been discontinued, and Bennett now showcases some of the difficulties that might face the GLO route. While individual low-value cases will no doubt continue, the route for ‘class action’ claims of all types appears, if not blocked, then at least extremely challenging.

---

Authors

Aaron Moss

Call 2013

John Goss

Call 2015

Other articles in this edition

The Data Reform Bill – evolution not revolution?

---

Smith – another trip down the MPI warren

---

Access to Communications Data

---