Supreme Court Rejects Class-Action Data Protection Claim

The Supreme Court delivered a landmark judgment when it unanimously rejected a claim by Mr. Richard Lloyd to bring a class-action for damages upon behalf of 4m Apple iPhone users against Google under Section 13 of the Data Protection Act 1998 (DPA 1998).

The Background to the Claim

Mr Lloyd alleged that Google secretly tracked the internet activity of the iPhone users for commercial purposes between 9th August 2011 and 15th February 2012 and obtained significant amounts of information without the iPhone users’ consent or knowledge and for Google’s own commercial purposes. The purpose was to target the iPhone users with certain advertisements based upon the users’ browsing history.

The claim was for damages which had allegedly been suffered by the iPhone users for the misuse of their personal information and data, in breach of the legislation set out in the DPA 1998.

The Supreme Court considered an appeal by Richard Lloyd over whether a claim could be brought against Google in a representative capacity (upon behalf of others) seeking damages under s.13 of the DPA 1998. Mr. Lloyd’s claim was backed by a litigation funder.

In England and Wales, the DPA 1998 was replaced by the United Kingdom General Data Protection Regulation (EU2016-679) which was also supplemented by the Data Protection Act 2018.

In the legislation that governs England and Wales, there is very little which allows a form of “class action” such as Mr. Lloyd’s where a single person can make a claim upon behalf of a whole class of other people that might have been similarly affected by some sort of breach (in this case accessing and using the individual’s personal information).

To support the use of a class action, Mr. Lloyd chose to rely upon a provision in the Civil Procedure Rules (CPR 19.6) which allows a claimant to bring a claim against one or more persons as a representative of the others because they all have the same interest in the claim. Mr Lloyd sought to argue that the “same interest” rule was satisfied because all of the users of the Apple iPhone had been affected in the same way. He further argued that the class action could be used to recover a uniform sum by way of damages for each and every person whose Data Protection rights had been breached without having to look into each of their individual circumstances.

In this case the sum of £750 per person was suggested as an appropriate level of damages which when multiplied by the number of people whom Mr Lloyd represented produced a figure in the region of £3bn.

On a procedural point, and because Google is a US corporation (resident in Delaware) Mr Lloyd required the Court’s permission to serve the claim on Google outside of the jurisdiction in the US., and applied to the court to do so. Google opposed this application because: –

• Damages cannot be awarded under the DPA 1998 unless there is proof that it has been breached and that the breach has caused an individual financial damage or distress.
• The claim was not in any event appropriate to proceed by way of a representative action.

The matter was first heard in the High Court where Warby J found on both issues in favour of Google and refused Mr Lloyd leave to serve the proceedings on them in the US.

The matter then went to the Court of Appeal where the decision of Warby J at first instance was reversed.

Google appealed to the Supreme Court.

The Judgment

The Supreme Court unanimously found in favour of Google and restored the Order made by the Judge at first instance.

Lord Leggatt scrutinised the representative procedure finding that it was a “flexible tool of convenience in the administration of justice”. As Digital technology is now so far advanced the potential for wide ranging harm is very clear.

Lord Leggatt also considered that the “same interests” requirement should be decided in accordance with the overriding objective of the Civil Procedure Rules of dealing with cases justly and fairly. The Judge went on to state that damages may be claimed in a representative action (class action) if they are capable of being calculated on a basis common to all of the individuals that are represented.Alternatively, liability might be decided in a representative action which can then form the basis for individual claims for compensation.

In this case it was found that a representative claim could have been brought to establish if Google had breached the DPA 1998 as a springboard for the individuals affected pursuing claims for compensation later. However, Mr Lloyd had not approached the action using this 2-stage process, almost certainly because to deal with it in that way would not have been economic if every individual had to show their own loss. Mr Lloyd argued that a uniform sum of damages for each claimant of the class action could be approved without having to show the facts of every case for every individual.

A further limb of Mr Lloyd’s argument was supported by the Information Commissioners Office. He stated that compensation could be awarded under the DPA 1998 in circumstances where there is a loss of control of personal data which has happened because of a non-trivial contravention by a data controller of any of the requirements of the DPA 1998.

In considering these matters Lord Leggatt rejected the arguments put forward by Mr. Lloyd for the following reasons: –

• The claim should have been brought on the basis of incurring material damages (such as a financial loss) or distress or harm (i.e. what actually happened) as opposed to simply unlawful processing of personal data in contravention of the DPA 1998.
• It would be necessary to show what processing of the personal data of the individuals by Google took place in relation to each individual.
• The attempt by Mr Lloyd to recover damages without proving what unlawful processing of the personal data occurred, and what material damage or mental distress had been suffered by each individual was unsustainable.

In the circumstances the Court rejected the appeal and refused permission for Mr. Lloyd to serve the proceedings on Google outside of the jurisdiction.

The full Judgment can be found here.

CommentFor the many businesses that store data or are classed as data controllers the decision will bring some relief. This is because the Court unanimously held that claimants may not bring a claim for simply a breach of their rights under data protection legislation without first having proved financial harm or distress. It is also important to note that in accordance with the Court’s judgment, claimants of class actions cannot bring cases for fixed amounts of compensation as every case will depend upon the circumstances, and in particular the damage or distress caused.

The cautionary note to this judgment however is that the Court approved a 2-stage process, so claimants seeking firstly a declaration of liability that damages should be paid in principle, and then secondly to hold a hearing to assess the level of damages and compensation for each individual, has not been prevented by this decision.

More information

 For more information on this please contact our Commercial Litigation team here.

This article was written by Nick Hatchett, Partner in our Company & Commerical Team. The contents of this article are for the purposes of general awareness only. They do not purport to constitute legal or professional advice. Specific legal advice should be taken on each individual matter. This article is based on the law as of November 2021.