By Kellie O’Flynn

With the EU General Data Protection Regulation (GDPR) now in effect, one of the emerging considerations is whether its provisions – specifically Article 80 – open the door to ‘class action’ style privacy cases. Several European countries have already legislated for varying degrees of collective actions, particularly in the area of consumer protection, and post the coming into effect of the GDPR on 25th May, GDPR privacy class-action suits were commenced in several jurisdictions.

Class action in any similar form would be a dramatic departure in this jurisdiction. Coupled with the extension of damages to non-material (as well as material) losses, many businesses are concerned that the financial ramifications of GDPR from data subject claims may be even more severe than the threat from GDPR’s well-publicised administrative fines.