Rather quietly, the Government has announced the outcome of its review of whether the UK should implement the representative action provisions of Article 80(2) of the General Data Protection Regulation (GDPR). Article 80(2), which was a discretionary provision, allowed EU member states to enable certain bodies to bring complaints or claims on behalf of a data subject or subjects, without the latter's mandate – effectively, this would allow such bodies to represent data subjects in legal claims, on an "opt-out" basis for data subjects. The UK chose not to implement this, but did – in section 189 of the Data Protection Act 2018 (DPA) – require the Government to review the issue, within 30 months of the DPA being enacted (in May 2018).
There are a few interesting things to note about the news that the UK will not implement Article 80(2). First, when the review began, GDPR still applied directly in the UK. Now, it doesn't – we have the "UK GDPR". The DPA itself has been amended, so that – rather bizarrely – it reads as though the Secretary of State had to review Article 80(2) of the UK GDPR within 30 months, when - of course - Article 80(2) of the UK GDPR only emerged on 1 January 2021. No matter. What is clear is that there is no intention on the part of the Government to legislate for an express right for representative bodies to act for data subjects with the data subject's mandate.
The Government's reason for this is, broadly twofold. First, it takes the view that the regulatory scheme (under which the Information Commissioner enforces data protection law) is operating well: "there is no strong evidence to suggest the ICO cannot or will not investigate serious, singular breaches of the legislation or systemic failings across whole sectors" (it is not controversial to say that this is a view not shared by all). Second – and more importantly – the case of Lloyd v Google "shows [that] a form of collective action can proceed under the current framework where the parties to the claim share the same interest" (the case has been appealed to the Supreme Court, and is listed for hearing at the end of April). Lloyd v Google is a claim brought under part 19.6 of the Civil Procedure Rules (CPR), in which a representative claimant brings an action on behalf of a class of approximately 4.5 million people for damages arising from Google's use of the "Safari Workaround".
It is true that Lloyd v Google shows that a form of collective action "can proceed", but what it doesn't yet show (because the Supreme Court is yet to rule, and even then, this will only be on a preliminary issue), is whether it can succeed (at least to the extent that the courts will allow massive data protection claims for non-material damage). However, the irony of the Government's refusal to implement Article 80(2) in domestic law is that it could well be a compelling factor for the Supreme Court to take into account. If there is no need for Article 80(2) to be commenced, then should CPR 19.6 be read in such a way as, effectively, to include the Article 80(2) provisions?