Class Actions – Scarier Than A GDPR Fine?

To date, the main risk identified in respect of a personal data breach has been the regulatory penalties. With the advent of GDPR, the discussions regarding liability focused on fines of €20 million or four percent of worldwide turnover. However, in the past year or so, a potentially far greater financial risk has emerged: class actions from large groups of affected data subjects.

Personal data breaches – particularly cyber-attacks – are perhaps obvious targets for litigation funders and claimant law firms. There is often a large pool of potential claimants, but each may only have a low value claim. The mandatory breach notification under the GDPR also helps with establishing a claim, as individuals will be informed by the controller that they have been affected. In August 2020, the UK Government launched a 'call for views' on allowing non-profit organisations and children's rights organisations to bring data protection claims on behalf of individuals, even without