Prismall v Google [2024] EWCA Civ 1516

The Court of Appeal delivered judgment in Prismall v Google, a data privacy group litigation claim brought as a representative action under CPR 19.8. The claim alleged that Google had unlawfully processed personal data of UK users, in breach of the UK General Data Protection Regulation and the Data Protection Act 2018. The proceedings were supported by third-party litigation funding, reflecting the growing interest of litigation funders in data privacy claims as a significant category of group litigation outside the competition sphere. The appeal raised questions about the viability of representative actions as a mechanism for pursuing data privacy claims on behalf of large classes of affected individuals. Key issues included whether the claimants shared a sufficient “same interest” within the meaning of CPR 19.8 to be represented in a single action, whether the claim could properly be brought on a bifurcated basis dealing with liability and quantum separately, and whether individual issues of data processing and damage would overwhelm the common issues.

The decision built upon the evolving case law on representative actions following the Supreme Court’s decision in Lloyd v Google [2021] UKSC 50, which had imposed significant constraints on data privacy representative actions by requiring proof of individual damage. The Court of Appeal’s analysis in Prismall addressed how those constraints applied in practice and whether the representative action mechanism remained a viable vehicle for data privacy claims. For the litigation funding market, the decision had implications for funders’ assessment of data privacy claims as an investment category. Data privacy group litigation represents a potentially large market for funders, given the scale of modern data processing and the number of individuals affected. However, the procedural and substantive hurdles identified in Lloyd and subsequent cases created uncertainty about the commercial viability of funding such claims, making appellate guidance on the scope of representative actions in the data privacy context particularly valuable.