Back
2021 MarsdenLR 554
SUPREME COURT UNITED KINGDOM
LLOYD – Appellant
Versus
GOOGLE LLC – Respondent
[-]
A representative claim for damages under the Data Protection Act 1998 requires proof of individual damage or distress; uniform claims without individualized assessments cannot succeed.
Headnote:(A) Data Protection Act 1998 – Section 4(4) – Breach of data protection duties by Google – Claim for damages representing individuals who owned Apple iPhones, alleging unlawful tracking and data processing without consent – Court must assess if individual assessment of damages is necessary for each user and whether a representative claim can succeed. (Paras 1-3, 17, 158)
(B) Dynamic of Class Actions in the UK – Examination of collective redress procedures as compared to group actions and representative actions under CPR r 19.6 – Court notes that representative claims may allow claims for damages but complications arise in proving individual damage. (Paras 24-33)
Facts of the case: The claimant, Mr. Lloyd, represents all iPhone users who had data tracked by Google without consent during late 2011 to early 2012, asserting infringement of the DPA 1998 due to unlawful processing of personal data with over 4 million individuals potentially affected.
Findings of Court: The court finds that damages cannot be awarded under the DPA 1998 without proof of individual damage or losses resulting from the breach; thus, a representative claim without individual assessment cannot succeed.
Issues: The primary issue involves the ability to pursue claims collectively under the DPA without individual assessments of damages, and the justiciability of such claims for personal data breaches under existing law.
Ratio Decidendi: The court concludes that the term 'damage' in the DPA requires individual proof of material damage or distress and that a representative claim in this instance cannot succeed based on a uniform damages approach due to lack of individualized evidence.
Result: The appeal is allowed, restoring the initial refusal of permission to serve proceedings against Google.
JUDGMENT
A. Introduction
[1] Mr Richard Lloyd - with financial backing from Therium Litigation Funding IC, a commercial litigation funder - has issued a claim against Google LLC, alleging breach of its duties as a data controller under s 4(4) of the Data Protection Act 1998 ("the DPA 1998"). The claim alleges that, for several months in late 2011 and early 2012, Google secretly tracked the internet activity of millions of Apple iPhone users and used the data collected in this way for commercial purposes without the users' knowledge or consent.
[2] The factual allegation is not new. In August 2012, Google agreed to pay a civil penalty of US$22.5m to settle charges brought by the United States Federal Trade Commission based upon the allegation. In November 2013, Google agreed to pay US$17m to settle consumer-based actions brought against it in the United States. In England and Wales, three individuals sued Google in June 2013 making the same allegation and claiming compensation under the DPA 1998 and at common law for misuse of private information: see Vidal- Hall v. Google Inc (Information Comr intervening) [2015] EWCA Civ 311; [2016] QB 1003. Following a dispute over jurisdiction, their claims were settled before Google had served a defence. What is new about the present action is that Mr Lloyd is not just claiming damages in his own right, as the three claimants did in Vidal-Hall. He claims to represent everyone resident in England and Wales who owned an Apple iPhone at the relevant time and whose data were obtained by Google without their consent, and to be entitled to recover damages on behalf of all these people. It is estimated that they number more than 4m.
[3] Class actions, in which a single person is permitted to bring a claim and obtain redress on behalf of a class of people who have been affected in a similar way by alleged wrongdoing, have long been possible in the United States and, more recently, in Canada and Australia. Whether legislation to establish a class action regime should be enacted in the UK has been much discussed. In 2009, the Government rejected a recommendation from the Civil Justice Council to introduce a generic class action regime applicable to all types of claim, preferring a "sector based approach". This was for two reasons:
"Firstly, there are potential structural differences between the sectors which will require different consideration. ..... Secondly, it will be necessary to undertake a full assessment of the likely economic and other impacts before implementing any reform."
See the Government's Response to the Civil Justice Council's Report: "Improving Access to Justice through Collective Actions" (2008), paras 12-13.
[4] Since then, the only sector for which such a regime has so far been enacted is that of competition law. Parliament has not legislated to establish a class action regime in the field of data protection.
[5] Mr Lloyd has sought to overcome this difficulty by what the Court of Appeal in this case described as "an unusual and innovative use of the representative procedure" in r 19.6 of the Civil Procedure Rules: see [2019] EWCA Civ 1599; [2020] QB 747, para 7. This is a procedure of very long standing in England and Wales whereby a claim can be brought by (or against) one or more persons as representatives of others who have "the same interest" in the claim. Mr Lloyd accepts that he could not use this procedure to claim compensation on behalf of other iPhone users if the compensation recoverable by each user would have to be individually assessed. But he contends that such individual assessment is unnecessary. He argues that, as a matter of law, compensation can be awarded under the DPA 1998 for "loss of control" of personal data without the need to prove that the claimant suffered any financial loss or mental distress as a result of the breach. Mr Lloyd further argues that a "uniform sum" of damage
