MANAGING AND RESOLVING DATA PRIVACY CLASS ACTIONS
CD: Could you outline some of the key data privacy and protection trends over the past 12 months or so?
McIlwaine: Article 82 of the General Data Protection Regulation (GDPR) codified a European Union (EU)-wide entitlement to compensation for data subjects that suffer material or non-material damage as a result of infringement of data protection legislation. The UK has confirmed that ‘damage’ includes distress. Under the GDPR, national data protection authorities cannot order compensation – instead, claimants must turn to the courts for that. The UK has seen a very significant increase in the amount of litigation by data subjects for compensation, both where the infringement was allegedly deliberate, such as misuse of personal data by the controller, or where it was not, as in the case of a cyber attack. To put this in context, every single entity that has received a monetary penalty notice issued by the Information Commissioner’s Office (ICO) following a cyber incident is now also the subject of data subject claims, including British Airways, Marriott and Ticketmaster. With the exponential rise of cyber attacks during the pandemic, particularly ransomware, litigation in this area is expected to increase dramatically. The perfect storm has arisen with an increased awareness by data subjects of their data rights, an obligation to notify data subjects where there has been a personal data breach resulting in a high risk of harm to the individual, a number of high-profile data incidents, and a focus by claimant law firms to industrialise the process for data subjects to bring actions. Added to this is the fact that litigation rules in England and Wales potentially allow claimants to recover their legal costs reasonably incurred in progressing an action. Further, where claims include misuse of private information or breach of confidentiality, claimants also can recover the premiums incurred in obtaining ‘after the event’ insurance. Consequently, many claims include these allegations, even though they will be difficult to establish. This means that in the UK data claims are very much a hot topic, with claimant law firms looking at the various procedural routes for bringing actions efficiently.
Jul-Sep 2021 issue
Pinsent Masons LLP