Heightened cyber risk spurs rise of data subject claims

Actual or threatened data subject claims were identified in 9% of cases Pinsent Masons’ cyber team worked on over the past 12 months, up from 8% in 2020 and 3% in 2019.

McIlwaine said: “The UK has seen a very significant increase in the amount of litigation by data subjects for compensation under data protection legislation, both where the infringement was allegedly deliberate, such as misuse of personal data by the controller, and where it was not, as in the case of a cyber-attack.”

“To put this in context, every single entity that has received a monetary penalty notice issued by the Information Commissioner’s Office following a cyber incident that occurred since the General Data Protection Regulation has been in force, is now also the subject of data subject claims, including British Airways, Marriott and Ticketmaster. With the exponential rise of cyber attacks during the pandemic, litigation in this area is expected to increase dramatically,” he said.

According to Pinsent Masons’ report, the scope for mass data subject claims differs across Europe.

In the Netherlands, 27 class actions have been filed since rules around class actions were reformed in early 2020. Mass actions are also on the rise in Germany, but they are still largely uncommon in France. In Ireland and Spain, under-developed legislation has impinged data-related class actions. However, across the EU, it is expected that the new EU Collective Redress Directive, once implemented, will be a significant of class action-style cases, including in the field of data protection and privacy.

In the UK, there are a number of routes available by which mass or collective actions may be brought.

“First, multiple claimants may group together to bring similar actions on the one claim form, and we see this occurring reasonably frequently,” said McIlwaine. “Secondly, the court may order a Group Litigation Order (GLO) allowing the individual claims made by multiple individuals to be managed together. Finally, a representative action may be available under the Civil Procedure Rules in England and Wales – where representative actions are permitted by the court, all individuals that meet the class criteria are included in the claim unless they opt-out. The introduction of a bespoke ‘opt-out’ class action procedure for data protection and privacy was considered, but ultimately rejected, by the UK government following a consultation exercise.”