Lloyd vs Google: Government must provide mechanism for collective redress
Responding to the decision in Lloyd vs Google, at which the Open Rights Group (ORG) was an intervener, Executive Director of Open Rights Group, Jim Killock, said
“There must be a way for people to seek redress against massive data breaches, without having to risk their homes, and without relying on the Information Commissioner alone.
“The ICO cannot act in every case, and is sometimes unwilling to do so. We have waited over two years for action against the Adtech industry, which the ICO says is operating unlawfully. There is no sign of action.
“Yet it would be completely unreasonable for someone to risk their home over court fees in cases like this. Without a collective mechanism, that is where we are left: in many cases data protection is very hard to enforce against tech giants.
“The Government should keep its word, and consider implementing collective action under GDPR, which is specifically rejected in February on the grounds that Lloyd vs Google showed that existing rules could provide a path for redress.”
ENDS
Contact
Press 07951265812 / press@openrightsgroup.org
NOTES
1 The ICO has not yet enforced against the Adtech industry and “Real Time Bidding”, including Google, which it stated in its report in 2019 was unlawful and breaching GDPR rights for millions of UK citizens. The ICO’s investigation concluded that:
- Adtech companies collect and share people’s browsing histories but have no practical control where this information ends up
- Given this astounding lack of basic security, other rights such as consent access to data are unobtainable
- That the industry relies on spurious legal arguments to justify widespread poor practice
2 UK GDPR says at 80 (2) that “The Secretary of State may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject’s mandate, has the right to lodge a complaint with the Commissioner and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing”.
3 The Government responded in February 2021 to its consultation to implement collective complaints under Article 80(2) GDPR.
“6.17. Finally, the government is mindful of developments in the LLoyd v Google case which is due to be heard in the Supreme Court, in early 2021. Although cases brought under the civil procedure rules are different from claims brought under Article 80(2) of the UK GDPR because they rely on an affected individual to act as the lead claimant when representing the interests of others, they demonstrate the potential for a form of representative action to succeed under the existing Rules. The government will continue to monitor developments in this area closely.“