The announcement
that 5.9 million Dixons Carphone customers’ personal records have been accessed
without authorisation has put a renewed focus on the prospects of group
litigation based on data protection claims.
The incident
happened before the new data protection rules under the GDPR came into force on
25 May 2018, which has brought with it tougher penalties of up to 4% of global
turnover or 20 million euro, whichever is greater.
In the new
regime we can certainly expect a growing dispute climate, not least because the
GDPR has focused the minds of data subjects on their rights.
Article 79 of
the GDPR gives a right to an effective judicial remedy for data subjects
against any unlawful processing of their personal data by a data controller or
data processor. Article 82 gives any
person suffering damage as a result of a breach of the GDPR with the right to
compensation.
Perhaps one of
the main more immediate practical impacts of the GDPR is that we will see data
protection claims bolted onto other causes of action including breach of
confidence and infringement of privacy, rather than as standalone claims.
The UK has no
direct equivalent to opt-out class actions outside the specific framework of
the Consumer Rights Act 2015 relating to competition law. However, the Civil Procedure Rules do provide
a basis for group claims to be made in a data protection context.
No comments:
Post a Comment