Data access and privacy templates toolkit

Lloyd v. Google LLC (2021):

Facts: Mr. Lloyd brought a representative action on behalf of approximately four million iPhone users, claiming that Google had unlawfully collected their personal data without consent through the Safari Workaround, a technique that bypassed privacy settings in Apple's Safari browser.

Outcome: The Supreme Court ruled in favour of Google, stating that claimants must show material damage or distress caused by the data breach to claim compensation. The court emphaszed that mere loss of control over personal data, without proving actual damage, is not sufficient for a claim.

Key takeaway: This case underscores the importance of demonstrating actual harm when seeking damages for data breaches.

WM Morrison Supermarkets plc v. Various Claimants (2020):

Facts: This case involved a rogue employee of Morrison’s who leaked payroll data of around 100,000 employees. The employees claimed that Morrison’s was vicariously liable for the data breach.

Outcome: The Supreme Court ruled in favour of Morrison’s, stating that the company was not vicariously liable for the actions of the rogue employee. The court found that the employee was acting outside the scope of his employment when he committed the data breach.

Key takeaway: This case clarified the limits of vicarious liability for employers in data breach incidents.

Barclays Bank plc v. Various Claimants (2020):

Facts: The case concerned a doctor hired by Barclays Bank to conduct medical examinations of employees and prospective employees. The doctor was accused of sexually assaulting individuals during the examinations. The claimants argued that Barclays should be held vicariously liable.

Outcome: The Supreme Court ruled that Barclays was not vicariously liable because the doctor was an independent contractor rather than an employee.

Key takeaway: This decision highlighted the distinction between employees and independent contractors in cases of vicarious liability, impacting how companies handle data privacy and access issues involving third-party contractors.

R v. Mucavele (2020):

Facts: Mr. Mucavele was convicted under the Computer Misuse Act 1990 for unauthorised access to personal data stored on his employer’s systems. He accessed and shared personal data of clients and colleagues without permission.

Outcome: The court upheld his conviction, reinforcing that unauthorised access to personal data is a serious offense under the Computer Misuse Act.

Key takeaway: This case illustrates the criminal consequences of unauthorised data access and the importance of maintaining strict data access controls.

Driver v. Crown Prosecution Service (2020):

Facts: Mr. Driver requested access to personal data held by the Crown Prosecution Service (CPS) under the Data Protection Act 2018. The CPS failed to provide the data within the statutory time limit, leading to Mr. Driver filing a complaint.

Outcome: The court ruled that the CPS had breached its obligations under the Data Protection Act 2018 by failing to provide the requested data within the required time frame.

Key takeaway: This case underscores the importance of timely compliance with data access requests under data protection laws.

R (on the application of Bridges) v. Chief Constable of South Wales Police (2020):

Facts: Mr. Bridges challenged the use of Automated Facial Recognition (AFR) technology by South Wales Police, arguing that it violated his privacy rights under the European Convention on Human Rights (ECHR) and data protection laws.

Outcome: The Court of Appeal found in favour of Mr. Bridges, ruling that the use of AFR technology was unlawful because the police had not adequately assessed its impact on privacy rights and had not complied with data protection laws.

Key takeaway: This case highlighted the need for rigorous privacy assessments and compliance with data protection laws when deploying new surveillance technologies.