Law note · United Kingdom
UK GDPR Article 82, Data Protection Act 2018 Section 169, and ICO Enforcement
The Information Commissioner's Office (ICO) is the UK's single supervisory authority, unlike Germany's 17-authority structure, with UK General Data Protection Regulation (GDPR) Article 83 fines up to the greater of GBP 17.5 million or 4 percent of global turnover. Section 169 DPA 2018 supplies a private right of action for contravention of data protection legislation other than UK GDPR itself, while UK GDPR's own Article 82 covers contraventions of the Regulation directly; both cover material and non-material damage.
The UK's own Supreme Court has gone further than the CJEU in limiting what counts: Lloyd v Google LLC [2021] UKSC 50 (10 November 2021) unanimously rejected a representative claim brought on behalf of 4.4 million iPhone users, holding that compensation for a non-trivial data protection breach requires the individual to show tangible financial loss or distress, not a bare loss of control alone, and that such a claim cannot succeed without showing unlawful use and resulting damage for each individual claimant rather than the group as a whole.
What it asks of an app
- Expect the ICO to have jurisdiction and fining power, up to the higher of GBP 17,500,000 or 4 percent of global annual turnover, over your processing of personal data of a person in the United Kingdom.
- Expect any person who suffered material or non-material damage from an infringement to have a direct right to claim compensation from you as controller or processor, under UK General Data Protection Regulation (GDPR) Article 82, but expect a UK representative claim to require proof of unlawful use and resulting damage for each individual claimant, not a bare loss-of-control theory, per Lloyd v Google.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: legislation.gov.uk, official consolidated text, verified by direct crawler fetch
Lloyd v Google LLC [2021] UKSC 50