Louis Browne QC and Ian Whitehurst instructed on landmark £100 million data breach claim against Equifax

October 22, 2019

Hayes Connor Solicitors has instructed Louis Browne QC and Ian Whitehurst from Exchange Chambers to advise on the UK’s first representative data breach claim in the High Court. The action could see Equifax ordered to pay up to £100 million in compensation to its estimated 15 million UK customers affected by its 2017 data breach.

The action follows the Court of Appeal’s decision on the Lloyd v Google case on 2nd October which ruled that a law firm could bring a claim for compensation for just one affected individual following a data breach and be awarded compensation for the entire affected population.

Kingsley Hayes, managing director at data breach and cybersecurity specialist Hayes Connor Solicitors, said: “We are delighted to be the first firm to issue proceedings following the Court of Appeal’s recent ground-breaking ruling which allows us to pursue the total amount of compensation due to Equifax’s 15 million affected UK customers.

“We estimate the total value of the claim to be £100 million which, if won, Hayes Connor would distribute to all affected individuals. Equifax was found by the ICO to have failed in its data protection obligations on multiple levels including failing to comply with how customers’ personal information can be processed and stored and how that private data should be secured.

“Following hackers successfully accessing its systems in America to steal the personal information of a reported 143 million individuals, the personal data of its UK customers was also exposed including email addresses, usernames, passwords, security questions, phone numbers and credit card details.

“This is the first time that a data breach claim has been issued in the UK on behalf of all affected parties. The Court of Appeal ruling has made it easier for all data breach victims to be fairly compensated.”

Said Louis Browne QC:

“In Lloyd v Google, the Court of Appeal provided important guidance on three key points.

“Firstly, that a claimant can recover damages without proving pecuniary loss or distress under section 13 of the Data Protection Act 1998.   This removes an important barrier to class actions.

“Secondly, that the class members have the “same interest” on the facts under CPR 19.6 given that control over browsing data has value.

“Thirdly, that the High Court ought to have exercised its discretion to allow this representative action to proceed as a result of alleged ‘wholesale and deliberate misuse of personal data without consent, undertaken with a view to commercial profit’.

“Lloyd v Google is a ground breaking ruling with wide-ranging implications for litigants and organisations as it opens the door for data breach victims to be fairly compensated through representative data breach claims.”