A "perfect storm" of factors has worsened the outlook for data breach-related class actions after a recent lull, lawyers told the Australian Professional Indemnity Group conference.

After the high-profile 2022/23 data breaches and subsequent class actions involving Medibank, Optus and Latitude there has been a slowdown in similar cases.

However, Christine Tran, partner at Jones Day, told yesterday's event four ingredients have created a “pretty hostile environment for defendants in relation to privacy and data”.

“The first is that we have an active regulator and an active regulatory environment," she said.

"The Privacy Commissioner has said they are moving into an enforcement era and the regime for mandatory disclosures is maturing.

“Secondly, there is a new cause of action, for invasion of privacy, which could be brought through a class action vehicle.

“The third, for corporate defendants and stakeholder groups like insurers, there is a high risk of having to manage parallel exposures and the procedural complexities that come with that.

"Now you can have individual complaints before the Privacy Commissioner, representative complaints, civil penalty proceedings, consumer and shareholder class actions.” 

The fourth factor, she says, is a move from the classic class action involving an external actor infiltrating a company’s system towards "scrutinising and testing how corporates are collecting and using data and whether there’s been informed consent”.

But she did caution that it would not always be economic for plaintiff law firms to prosecute class actions, which would pose challenges for them in the new era of parallel proceedings.

Tim Finney, of litigation lawyers Phi Finney McDonald, says determining the financial impact of loss is challenging and litigation often focuses on "hurt and distress".

"It's not very common for there to be an absolute economic loss from a data breach that could be run as a class action. Information representative complaints and individual complaints have generally been in the realm of thousands of dollars, certainly less than $20,000.” 

Ms Tran pointed to a predicted wave of AI-related cases in the European Union, concerning personal data being "scraped" to train AI models, which could breach the EU’s General Data Protection Regulation and member states may put in a collective action mechanism.

There is also a potential rise in cases involving biometric data and the collection practices of smart devices.

But upcoming court judgments on Medibank and Optus will be crucial in determining the next direction of class actions in Australia, the lawyers say.

Mr Finney said he “would not be surprised to see either or both of those cases settled prior to trial”, given the risks on both sides and uncertainty surrounding the state of the law.