Lloyd v Google LLC: Host's Liability for Personal Data Loss

by

Sharon Mala

CyJurII Scholar

on 20 December 2025

Citation Number: Lloyd v Google LLC [2021] UKSC 50, Supreme Court of the United Kingdom.

Abstract

This case report examines the decision of the UK Supreme Court in Lloyd v Google LLC [2021] UKSC 50. The Court considered whether damages under the Data Protection Act 1998 could be awarded for loss of control of personal data without proof of material damage or distress, and whether the claim could proceed as a representative action under CPR 19.6.

 Background and Facts

The case concerned allegations that Google LLC unlawfully tracked data from iPhone users in England and Wales between 2011 and 2012 through the so-called Safari Workaround. The claimant sought to bring a representative action on behalf of approximately four million users for breach of statutory duty under the Data Protection Act 1998. No material damage or distress was alleged.

 Legal Issues

The Supreme Court considered whether damages under section 13 of the Data Protection Act 1998 could be awarded for loss of control of personal data alone, and whether the representative action satisfied the requirement that all claimants share the same interest under CPR 19.6.

  Decision

The Supreme Court unanimously allowed the appeal. It held that compensation under the Data Protection Act 1998 requires proof of material damage or distress, and that the representative action could not proceed.

 Court’s Reasoning

The Court held that loss of control of personal data does not constitute damage under section 13 of the Data Protection Act 1998. It distinguished misuse of private information claims and emphasised that damages require individual assessment, which was incompatible with the representative action procedure.

  Significance

The decision limits collective data protection claims that seek damages without proof of individual harm and clarifies the procedural boundaries of representative actions in UK law.

 Conclusion

Lloyd v Google LLC confirms that breach of data protection legislation alone does not entitle claimants to compensation and reinforces the requirement for individualised proof of damage or distress.