UK data breach group claims are opt-in. You only share in the result if you actively join the court-managed group register before the cut-off. US class action settlements are normally opt-out.
You are included automatically if you fit the class definition unless you request exclusion. A Group Litigation Order, or GLO, is the usual English vehicle for large data-breach groups. The court groups together individual claims that share common fact or law issues and manages them together.
Official resources:
- Equifax settlement announcement — Use this primary source to review the underlying data.
- Rule 23 text — Use this primary source to verify the official announcement.
Table of Contents
- Do you have to sign up?
- What must you prove to get damages?
- How do payouts reach people?
- Who carries the cost risk?
Do you have to sign up?
In England, you must take action to join. The Ministry of Justice explains in its Part 19 rules that a GLO collectively manages claims with common issues and each victim must enter the group register.
In the United States, membership is usually automatic. Cornell Legal Information Institute reproduces Federal Rule 23 requiring numerosity, commonality, typicality, adequate representation, predominance and superiority for a damages class, with members included unless they opt out. For readers, the practical check is different on each side of the Atlantic:.
- In the UK, look for the GLO, the breach definition, and the join-by date.
- In the US, look for the class definition, the opt-out date, and the claim-filing date.
- Missing the UK join date can leave you outside the settlement entirely.
What must you prove to get damages?
English courts have rejected US-style opt-out damages for data claims alone. In Lloyd v Google in 2021, the Supreme Court unanimously blocked a representative claim for about 4 million iPhone users, as analyzed by Pinsent Masons, because mere loss of control was not compensable without proven material loss or distress. The regulator also cannot award you money.
Information Commissioner's Office guidance says an affected individual must ask the organisation for payment and then sue in court if refused, even when the ICO agrees the law was broken. US federal courts take a different gatekeeper role at settlement. The court must give notice, hold a hearing, and find the deal fair, reasonable and adequate before it can bind absent members, who keep rights to object and to request exclusion in damages classes.
How do payouts reach people?
The British Airways Data Event GLO shows the UK pattern. Herbert Smith Freehills Kramer notes in its BA settlement note that the order followed the 2018 breach affecting roughly 400,000-plus notified customers, set an opt-in cut-off of 17 Jan 2021, and settled in July 2021 on confidential terms with no admission of liability for joined claimants only.
Equifax shows the US pattern. The Consumer Financial Protection Bureau announced in its Equifax settlement announcement a government-brokered deal of up to $700 million with federal and state enforcers, run by a settlement administrator where consumers had to file claims for credit monitoring or cash reimbursement. The result is that a UK payout follows joinder plus individual loss, while a US payout often follows a broad fund plus a timely claim form.
Who carries the cost risk?
England generally makes the loser pay a share of the winner's costs. GLO claimants share common costs across the group, according to an Orrick comparative guide.
The US generally leaves each side to bear its own costs. That difference shapes funding. UK claimants therefore typically need conditional-fee, damages-based or third-party-funded backing plus adverse-costs insurance to proceed.