In SMO (A Child) v Tiktok Inc. & Ors  EWHC 489, the High Court considered an alternative basis for bringing a representative claim for loss of control under the GDPR and the Data Protection Act 2018 (DPA 2018) following the Supreme Court’s decision in Lloyd v Google.
This case is a pre-Lloyd decision representative claim brought by the former Children’s Commissioner for England, Anne Longfield, on behalf of all children in the UK and the EEA that used the TikTok app after May 2018. The Claimants are claiming damages for breach of the DPA 2018 and misuse of private information arising from TikTok’s alleged misuse of children’s data without parental consent.
As in Lloyd, the Claimants made an application for permission to serve the claim form on various TikTok entities out of the jurisdiction. One of the factors that the Court had to consider as part of the application was whether the Claimants could demonstrate that there was a serious issue to be tried on the merits.
Claimant Arguments – DPA 2018 and UK GDPR
Notably, the Claimants argued that the remedy under Article 82(1) of the UK GDPR was materially different from the remedy under s.13 Data Protection Act 1998 (DPA 1998) that was applicable in Lloyd. In this regard, the Claimants pointed to the specific reference to “non-material damage” in Article 82(1) and Recital 85, where ‘loss of control over a subject’s personal data’ is cited as an example of non-material damage.
The Claimants also argued that this case was distinguishable from Lloyd on the grounds that (unlike Lloyd) it involved the actual use of TikTok by children and (again, unlike Lloyd) the most basic or ‘lowest common denominator’ claim within the class exceeded the de minimis threshold.
Mr Justice Nicklin held that there was a serious issue to be tried but did so with caution, relying in large part on the fact that he had only heard submissions from the Claimant on the issue and that, to reach an alternative conclusion, he would effectively have had to make the Defendants’ case for them.
Tiktok is the first illustration into how claimants are seeking to maintain representative actions post-Lloyd. Whilst the judge may have decided that there was a serious issue to be tried, it is possible that a different outcome would have been reached had the Defendants had an opportunity to make submissions. It should also be emphasised that this judgment does not in any way determine the question of whether loss of control is a species of ‘non-material damage’ that entitles data subjects to a remedy under the UK GDPR. That question will be resolved at a later stage, when the Claimants will face the challenge of establishing that the conclusions reached in Lloyd on loss of control are confined to the DPA 1998.