Court decision · 10 November 2021
Lloyd v Google LLC
[2021] UKSC 50 · UK Supreme Court
What it means for your code
UK opt-out class actions for data misuse are hard, but individual claims and regulator action remain; do not treat this as immunity for tracking without consent.
What happened
A representative action was brought on behalf of millions of iPhone users whose browsing data Google allegedly collected via the 'Safari workaround' in 2011-2012.
What was decided
Damages under the Data Protection Act 1998 require proof of material damage or distress for each individual; 'loss of control' alone does not ground a uniform per-person award in an opt-out representative action.
The legal test applied
- Compensation under s.13 DPA 1998 requires material damage or distress; 'loss of control' alone is not compensable
- An opt-out representative action fails where damages need individual assessment
What would have changed the outcome
- Claims framed under UK GDPR Art. 82, or individual claims with proven distress
- Regulatory enforcement is unaffected by the ruling
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.