Print Article

A mere “loss of control” of personal data does not mean you are owed compensation (£££££)


The supreme court says to claim compensation for a data breach individuals must show the [1] suffered a breach of their rights and [2] suffered damage as a result of that breach.

The case concerned Google's placing of advertising tracking cookies on iPhones using Apple's 'Safari' browser in England and Wales between August 2011 and February 2012.

Recap of what went wrong:

  1. The technical background is not straightforward.
  2. In essence, however, Google rolled out a new feature known as “social ads” on its now discontinued Google+ service.
  3. In rolling out this feature Google sought to protect user-privacy through segregation of data.
  4. Whilst this approach worked effectively on other browsers, there were difficulties in implementing the feature for users of the Safari browser due to Safari’s handling of third-party cookies.
  5. Google therefore identified a workaround to implement the feature on Safari browsers. However, a by-product of this workaround was that Google’s ‘DoubleClick’ advertising cookie was also set in a third-party context, even though Apple’s stated policy at the time was that this would not be possible with the Safari browser.
  6. On that basis it was alleged that DoubleClick cookies were set without the consent of users.

The Supreme Court:

  1. The Supreme Court’s unanimous decision that a representative action brought against Google should not proceed is a very positive development for data controllers of all sizes.
  2. The judgment will be read closely by those interested in the wider UK class actions landscape.

Key points

  1. The Supreme Court has rejected the notion that every data subject affected by a non-trivial data breach is entitled to an award of compensation for the mere “loss of control” of their personal data.
  2. Rather, the court has confirmed that an award of compensation for a non-trivial breach of the Data Protection Act 1998 can be made only if the data subject has suffered some form of material damage, i.e. tangible financial loss, or if they have suffered distress.
  3. The Supreme Court also found that the claim raised against Google is not viable as a representative action for damages.
  4. Richard Lloyd, a former executive director of consumer watchdog Which? who brought the claim, expressly sought to disavow the individual circumstances of each of the millions of individuals who he said formed part of the represented class.
  5. The Supreme Court found this approach impermissible in principle. It said that,
    • In order to advance a representative action on behalf of each member of the proposed represented class,
    • Lloyd had to show that each of those individuals had both suffered a breach of their rights and suffered damage as a result of that breach.
  6. Several other representative actions based on alleged data protection breaches have been on hold pending the Supreme Court’s judgment in this case. These include claims against
    • TikTok, Facebook and Marriott Hotels.
  7. It now seems unlikely that litigation funders will have any appetite to pursue these claims.

Lloyd v Google: Supreme Court unanimously rejects claimant’s representative action (


The Team

Meet the team of industry experts behind Comsure

Find out more

Latest News

Keep up to date with the very latest news from Comsure

Find out more


View our latest imagery from our news and work

Find out more


Think we can help you and your business? Chat to us today

Get In Touch

News Disclaimer

As well as owning and publishing Comsure's copyrighted works, Comsure wishes to use the copyright-protected works of others. To do so, Comsure is applying for exemptions in the UK copyright law. There are certain very specific situations where Comsure is permitted to do so without seeking permission from the owner. These exemptions are in the copyright sections of the Copyright, Designs and Patents Act 1988 (as amended)[]. Many situations allow for Comsure to apply for exemptions. These include 1] Non-commercial research and private study, 2] Criticism, review and reporting of current events, 3] the copying of works in any medium as long as the use is to illustrate a point. 4] no posting is for commercial purposes [payment]. (for a full list of exemptions, please read here]. Concerning the exceptions, Comsure will acknowledge the work of the source author by providing a link to the source material. Comsure claims no ownership of non-Comsure content. The non-Comsure articles posted on the Comsure website are deemed important, relevant, and newsworthy to a Comsure audience (e.g. regulated financial services and professional firms [DNFSBs]). Comsure does not wish to take any credit for the publication, and the publication can be read in full in its original form if you click the articles link that always accompanies the news item. Also, Comsure does not seek any payment for highlighting these important articles. If you want any article removed, Comsure will automatically do so on a reasonable request if you email