Ambulance chasers in A&E as £100m Equifax claim axed

The army of “no win, no fee” compensation lawyers have been hit by a second body blow in as many days after the firm which launched a £100m claim against Equifax in the UK has been forced to withdraw its action.

The rise of the ambulance chasers was predicted in the run-up GDPR, with many sniffing out the opportunity to launch US-style class actions in the UK; some even predicted that data breach compensation pay-outs could dwarf those made following the PPI mis-selling scandal, which at the last count had topped £50bn.

These days, as soon as a breach is reported there are a rash of ads from law firms pledging to take guilty firms to the cleaners. There are currently class action cases being drawn up against British Airways, Dixons Carphone, Marriott International, Ticketmaster, Yahoo, the Police Federation, T-Mobile, and even Watford Community Housing.

And, just this week, Chesterfield-based Your Lawyers claimed that Virgin Media could be forced to pay up to £4.5bn in compensation for leaving the personal data of 900,000 customers unprotected online for 10 months.

The UK Equifax case was launched in October 2019 and was sparked by the firm’s disastrous data breach, which first emerged in 2017, and affected 147 million people around the world, including an estimated 15 million Brits.

The action was launched by Hayes Connor Solicitors under Atkinson v Equifax Ltd, and was said to be the first “representative data breach claim” in the High Court.

The action followed the Court of Appeal’s decision on the Lloyd v Google “iPhone tracking” case on October 2 last year, which ruled that a law firm could bring a claim for compensation for just one affected individual following a data breach and be awarded compensation for the entire affected population.

It was brought on the basis that, along with all the members of the class action he represented, Atkinson had suffered damage in the form of a “loss of control” over his data, resulting from Equifax’s alleged failure to maintain appropriate security around the data affected in the attack.

However, following service of Equifax’s defence, which among other things challenged the Court of Appeal’s judgment in Lloyd v Google and questioned whether the judgment was relevant to a cyber-attack case, Hayes Connor withdrew the action.

Anya Proops QC, who acted for Equifax and its law firm Hogan Lovells LLP said: “This is a major development, and one that carries within it an important cautionary message for all those claimants (and their representatives) who may be inclined to rush precipitately to mount large-scale privacy actions.”

Hayes Connor has also confirmed in writing that Equifax is entitled to recover the costs it had incurred responding to the action, which Proops said: “As you can imagine, [these are] not insignificant.”

Yesterday, the Supreme Court ruled that Morrisons will not have to pay compensation to the 100,000 staff whose data was stolen and leaked by a disgruntled IT auditor, after it held that the retailer was not vicariously liable for his actions.

Commenting on the case, Mishcon de Reya partner Adam Rose said: “With this judgment, employers – and the insurance sector (which might have been asked to cover a lot of the risk) – can breathe a sigh of relief that they will not be vulnerable to expensive claims arising from the unauthorised actions of rogue employees. They must still comply with the security requirements of GDPR, but – as long as they have done so – they shouldn’t find themselves defending an action in which they were also arguably a victim.”