As regular readers of our blogs will know, by virtue of the Civil Litigation (Expenses and Group Proceedings) (Scotland) Act 2018, it has been possible, since late July 2020, for two or more people with the same, similar or related claims to raise proceedings as a single action in the Court of Session in Scotland. Such proceedings are referred to as 'Group Proceedings'. We have written previously about some of the practical implications for Scottish Businesses that have arisen as a result of the introduction of Group Proceedings (by way of example, see our blogs here, here and here). We have also previously considered how Group Proceedings (or 'Class Actions' as these types of cases are commonly referred to elsewhere) function in different jurisdictions (such as England, The United States of America and Australia). One of the obvious benefits of Group Proceedings is that these cases allow justice to be administered in an efficient manner – with multiple related claims being dealt with by a court in the one action.
In this article, we will briefly consider a recent incident that occurred in Finland which brings to light some of the issues that can arise when access to collective redress mechanisms is limited by a country's judicial system. In other words, we will look at some of the problems that can arise in jurisdictions where the option to raise Group Proceedings (or a Class Action) is not so readily available.
The Vastaamo Psychotherapy Data Breach
A recent mass data breach in Finland (discussed in this BBC article) has given rise to criticism of the Finnish legal system's apparent lack of provision for Class Actions/Group Proceedings.
Mr Julius Kivimäki, a ''notorious hacker'' from Finland, has been sentenced to prison for, among other related crimes, his role in a large-scale cyber-attack which resulted in the therapy records of around 33,000 patients being stolen from Vastaamo, a Finnish psychotherapy provider. The stolen data contained deeply personal, sensitive information pertaining to, for example, subjects' health and private affairs. Mr Kivimäki demanded ransom payments from Vastaamo, and, subsequently, from the victims themselves, to prevent this information from being published online. It has been reported that, although many of the ransom demands were met, a large number of patient files did end up being uploaded to the internet.
Commentators have noted that, in order to seek compensation for damages arising from this incident, the individuals affected have been ''forced to make claims on their own''. One person who has been affected reportedly told the BBC that "This [incident] really is historical in Finland because our system is not ready for this amount of victims. The Vastaamo hack has showed us that we have to have to be prepared for these large cases so I hope there’s a change".
Although provision is made for Class Actions in Finnish law (under the Finnish Act on Class Actions (444/2007)), such cases can only be pursued by the State (specifically, the Consumer Ombudsman) in relation to consumer disputes. The scope of the Act's application is limited. Therefore, individuals affected by incidents of the sort described above, must pursue individual claims against the relevant wrongdoers themselves. Given the large number of potential claims, it is reasonable to expect that it could take many years, a great deal of court resource and a lot of expense, to process all the potential actions arising from the incident. This has given rise to criticism, together with calls for reform of Class Action laws in Finland.
Position in Scotland
Whilst the Finish legal system is accused of being poorly equipped to deal with the many claims that can arise from large scale data breaches of the sort described above, the Scottish system (with its provision for Group Proceedings) is better placed to handle such claims effectively and efficiently. However, it should be noted that, attempting to raise a Class Action or Group Proceedings in relation to a data breach is not exactly straightforward – various difficulties and complications can arise, as we discussed in this recent blog.
Contributors
Partner & Solicitor Advocate
Trainee Solicitor
