As big online companies “move fast and break things,” there are beneficiaries and victims. No one denies the benefits of digitalisation, but seemingly beneficial technology has in many respects turned into a free-for-all assault on users’ attention and privacy.

This new social space, in which we interact, and the workplace, in which we earn a living, is often turned into a battle ground as a result. In the process, collateral damage is sustained by individuals’ data protection rights, their privacy and livelihoods. This damage is both at an individual and societal level. 

“Class actions” and “mass actions” are a way of bringing together large groups of people who have been hurt at an individual level, allowing them to band together to get redress.

The power of the action is the scale. The damage in each case is very small: some location data here, some information about religious affiliation there. Each piece on its own is almost harmless. The harm comes when it is combined with data from other sources, and with data about billions of other users, and sold or traded for a purpose like advertising.

The harm is like one of a thousand cuts. Each one could be survived, but the combination has a real effect. Even then the damage in each case is probably relatively small. But the impact overall is large, because platforms like Facebook, Gooogle and Amazon collect and use personal data about billions of users.

The harm is like one of a thousand cuts. Each one could be survived, but the combination has a real effect

As with any legal field, there is a multitude of jargon and technicalities, but it might help to explain the most important distinction between a “class action” and a “mass action.” In a “class action,” the plaintiffs in court and their lawyers represent everybody in the same situation as they are in, regardless of whether they have formally joined the action and regardless of whether they even know about it. This type of action emerged in the United States in the 1960s and became an important mechanism for redressing breaches of consumer rights, civil rights and environmental standards.

Since then, Australia has adopted “class actions” and some countries in Europe have adopted limited forms of “class actions” which allow consumer groups to take actions on behalf of a class of consumers. 

A “mass action” is a more general, less legally specific term. In a “mass action,” large numbers of people are represented in a single complaint, with the same or very similar facts and laws applying to all their situations. They may or may not represent a class in the sense of a “class action.” Nonetheless, a single complaint with thousands of complainants pursuing a shared goal has the potential to set an important and impactful legal precedent. 

Hitting Companies Where it Hurts

Damages, namely a payment to the complainant by the responsible party as compensation, are a critical issue. Not all actions will involve damages, but the prospect of damages will make the cause a much bigger concern for the digital company involved. 

The obvious benefit of successful class or mass actions is that they provide justice to individuals involved, especially if damages are payable. But the benefit is potentially much bigger.

The prospect of class and mass actions is going to be a major deterrent for major online companies, especially for the largest and most profitable of them

The prospect of class and mass actions is going to be a major deterrent for major online companies, especially for the largest and most profitable of them. These companies simply cannot afford to lose a series of cases like this, because it would inevitably result in a snowball of follow-on cases from victims in a similar situation. The company would have to make a financial provision for losses and potential losses through damages awards, and this would impact adversely on its stock price. Needless to mention that even if no damages were payable in one case, follow-on claims for damages would be a very real prospect.

In the medium to long term, the effect of these actions will be that the digital companies will have to avoid such ill effects by controlling their own behaviour, by having regard to the rights of their users, and by improving their data protection and other human rights practices to the point where they are able to stand over them and win in court.

How to Harness Mass Action

So, what does it take to mount a mass or class action?

The cause of action is very much the starting point. There needs to be wrongdoing, and ideally damages need to be due as a result of that wrongdoing.

One example of such a wrong is breach of data protection rights. The GDPR provides specifically that damages are payable where data protection rights are breached. Equally if a group of people (for example, an ethnic group) suffered harm as a result of something that happened online and which could have been prevented, then there might well be a case that could be brought as a mass or class action.

One example of such a wrong is breach of data protection rights. The GDPR provides specifically that damages are payable where data protection rights are breached

The practicalities of a class or mass action are manifold. Firstly, there needs to be a clear case that is applicable to large numbers, preferably millions or tens of millions of people.

Secondly, the action needs to be publicised to get an adequate pool of claimants. It needs public awareness and complainants need to sign up to participate. Each of these individual clients needs to be dealt with and their particular case may need to be managed.

Thirdly, the action needs the right legal representation. These cases will break new ground and will likely be complex, and this will place great demands on the legal team.

Fourthly, the case needs to be funded because a case of this type will be expensive to undertake, due to the complexity of the subject matter and because the online company will fight tooth and nail to avoid the precedent a loss would set. 

Maybe it goes without saying that the case needs an appropriate legal form. The laws of the jurisdiction need to provide strong enough protections to allow you a prospect to win the case, and they also need to provide for a mechanism for you to operate your class or mass action.

By way of example, the GDPR provides for non-profit organisations to take cases on behalf of a group of affected individuals, but only in countries that have opted into this particular provision in their national law. The case has to be in the “right” jurisdiction, taking into account where the target company has a presence and where the complainants are located. The mechanism chosen has to provide adequate redress.

The judicial forum chosen also matters. Typically, data protection authorities do not have the power to award damages to wronged data subjects. The complainants must usually bring their complaint to the courts of the country to collect such damages.

There are many obstacles to class and mass actions and many pitfalls to be avoided. But class and mass actions have the potential to make a big practical difference in relation to digital rights.

Online companies move famously fast and their bad behaviour affects billions of people in small but insidious ways

Online companies move famously fast and their bad behaviour affects billions of people in small but insidious ways. Class and mass actions can be a way for the legal system to provide a retrospective judgment on these companies’ actions, and orders which result in payment of money as damages give these judgments strong “teeth.” Companies cannot take these judgments lightly, because they can no longer just think about what they can get away with in the short term.

Class and mass actions are a way to send a message to digital companies (and their investors) that they will ultimately need to face up to and pay for the negative consequences of their profit-making activities.

Antoin O Lachtnain is a Director of Digital Rights Ireland, and is Managing Director of ex muris, a firm providing data services to the energy industries.