First UK collective action cases in the pipeline
Based on the GDPR’s Article 80 on individuals’ right of redress via collective (class) action, a group of UK residents whose Facebook data was harvested by Cambridge Analytica, is now threatening to sue for damages. Represented by law firm ITN Solicitors, which has sent Facebook a 27-page letter, the individuals seek to launch a class action suit. Wired.com reports that nearly 1.1 million people in the UK could be eligible to join such a suit if it goes forward.
"People should realize that data rights are real rights, and we have a mechanism to enforce them," Ravi Naik, head of data rights at ITN Solicitors said. “Facebook has known about this breach since at least 2015. Taking steps to advise those effected, some three years later and following public pressure, may be too little, too late. Facebook should now take urgent steps towards accountability. An urgent first step would be to properly compensate those affected.”
Wired.com reports having reviewed a copy of the letter Naik has submitted to Facebook. ‘It reads like a checklist of Facebook's failures, dating back to its decision in 2009 to no longer allow users to keep their friend lists private. The letter also notes Facebook's decision to let app developers scoop up data not just on their apps' own users but on those users' friends. Facebook didn't put a stop to this practice until 2015. By then, Cambridge Analytica had already gained access to as many as 87 million Facebook users' data through a personality quiz app designed by a University of Cambridge researcher named Aleksandr Kogan.’
Another group, Fair Vote Project, working with Bindmans LLP, is also gathering names to possibly start a class action suit against Facebook in the UK. The ICO intends to fine Facebook £500,000, but this is not a sufficient remedy, the campaign says.
Privacy Laws & Business has organised, in association with the Brussels Privacy Hub, a workshop on 23 October in Brussels to raise awareness of upcoming challenges flowing from the GDPR’s Art. 80 on individuals’ right of redress via collective (class) action.
The workshop, ‘The future for collective action under the GDPR’ is a side event to the International Conference of Data Protection and Privacy Commissioners. The event is free of charge but requires pre-registration.