One of the most long-awaited rulings in the UK last year was the Supreme Court judgment in Lloyd v. Google, a case that is important not just for data claims and data protection, but also for collective actions in England and Wales.
The case concerns a decade-old data breach focused on Google DoubleClick Ad cookies placed on users of Apple’s Safari browser without their consent between 2011-12. Approximately more than 4 million people might have been victims in the breach. The US company contested the issue of permission to serve proceedings outside of the jurisdiction, the basis for the damages without proof of financial damage or distress, and the fact that the claim was not suitable to proceed as representative action.
Google was successful at first instance but the Court of Appeal overturned that judgment. The Supreme Court considered both questions and rejected the application for permission to serve out of the jurisdiction and effectively brought the claim to an end.
Case Background
The claimant, Mr Richard Lloyd, with support from a commercial litigation funder, brought
a claim against Google LLC seeking compensation under section 13 of the Data Protection Act 1998 (“the DPA 1998”). Lloyd alleged damages suffered by a class of Apple iPhone users as
a result of unlawful processing by Google of their personal data in breach of the requirements of the Act. The claim is based on the factual allegation that, for several months in late 2011 and early 2012, Google secretly tracked the internet activity of some 4 million of Apple iPhone users in England and Wales, and used the data collected without the users’ knowledge or consent for commercial purposes (by enabling advertisers to target advertisements at users based on their browsing history). The DPA 1998 has since been replaced but it was in force at the time of the alleged breaches.
Because Google is a Delaware corporation, the claimant needs the court’s permission to serve the claim form on Google outside the jurisdiction. Google opposed the application on the grounds that: (1) damages cannot be awarded under the DPA 1998 without proof that a breach caused an individual to suffer financial damage or distress; and (2) the claim in any event is not suitable to proceed as a representative action.
Discussion
The court discussed the following issues:
(1) to permit the service of the proceedings on Google of the jurisdiction;
(2) whether Lloyd has the right to bring an opt-out class action in respect of data protection rights, and
(3) whether a violation of data protection rights attracts compensation without proof of individual harm.
- Collective redress issue
The UK has not enacted legislation providing for class actions, in which a single person can claim redress on behalf of a class of people similarly affected by alleged wrongdoing. Lloyd sought to rely, however, on an old procedure which allows a claim to be brought by (or against) one or more persons as representatives of others who have the “same interest” in the claim. Lloyd argued that the “same interest” requirement is satisfied in this case and that this representative procedure can be used to recover a uniform sum of damages for each person whose data protection rights have been infringed, without having to investigate their individual circumstances.
The court continued that the phrase “the same interest” needs to be interpreted purposively and pragmatically. The premise for a representative action is that claims are capable of being brought by (or against) a number of people which raise a common issue (or issues). The purpose of requiring the representative to have “the same interest” in the claim as the persons represented is to ensure that the representative can be relied on to conduct the litigation in
a way which will effectively promote and protect the interests of all the members of the represented class. That plainly is not possible where there is a conflict of interest between class members. However, in the modern context, “the reality is that proceedings brought to seek collective redress are not normally conducted and controlled by the nominated representative, but rather are typically driven and funded by lawyers or commercial litigation funders.” In these circumstances, “there is no reason why a representative party cannot properly represent the interests of all members of the class, provided there is no true conflict of interest between them.”
- Damages issue
Lloyd argued that a uniform sum of damages can be awarded to each member of the represented class without the need to prove any facts particular to that individual. The claimant suggested a sum of £750 per person, which multiplied by the number of people whom he claimed to represent, would produce an award of damages of £3 billion
The court rejected these arguments and concluded that the claim advanced cannot succeed for two reasons. First, the claim is founded solely on section 13 of the DPA 1998, which provides that “an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage”. On the proper interpretation of this section the term “damage” refers to material damage (such as financial loss) or mental distress distinct from, and caused by, unlawful processing of personal data in contravention of the Act, and not to such unlawful processing itself. Second, it is on any view necessary, in order to recover compensation under section 13, to prove what unlawful processing by Google of personal data relating to a given individual occurred.
The Supreme Court was clear that according to the “loss of control”, a claimant was only entitled to damages where material damage or mental distress was suffered as a consequence of a breach of duty. Loss of control of the data alone was not enough to sustain the claim. The court concluded that in these circumstances the claim cannot succeed and permission to serve the proceedings on Google outside the jurisdiction was rightly refused by the judge. There must be damage and it must be individually assessed.
Conclusions
The Supreme Court’s decision in Lloyd created a couple of conclusions.
Firstly, although the claim failed, it is worth noting that the court accepted the commercial value of personal data. It could not be doubted that: “information about a person’s internet browsing history is a commercially valuable asset.” It is just not every data breach or unlawful processing of personal data is capable of giving rise to compensation.
Secondly, Lloyd’s case was viewed with interest by many as a test case for the future of class actions in the UK – long a feature of US, Canadian, and Australian legal systems, and on the verge of being rolled out across the EU. The Court saw that there may be advantages in deciding common issues of fact or law through a representative claim. However, damages could only be claimed if the entitlement can be calculated on the same basis for all members of the claimant class and they have all suffered the same loss (such as where they were all wrongly charged a fixed fee). Otherwise, the representative claim could only be the first stage as the compensatory principle necessitates an individualised assessment of damages that cannot fairly or effectively be carried out without the participation of the individuals concerned. There is
a form of collective redress available, in the form of the ‘opt-in’ group action, whereby large numbers of those affected by a case join an action. But as the court acknowledged, this model is simply not sensible economically, given the administrative costs in identifying plaintiffs could easily outstrip any compensation paid.
Despite the setback in the Lloyd case, the fight for the UK collective redress is still in play. The case law is still uncharted as this was one of the first test cases, and the government might pass the particular legislation in the future. Time will tell.
February 1, 2022
Insights
