Leggatt: Claim doomed to fail
The Supreme Court has blocked a £3bn representative action for misuse of private data by Google that did not seek to prove that consumers had actually suffered any damage.
The decision should “stem the tide” of low-value data breach claims that an increasing number of law firms have been pursuing, it has been claimed.
Lord Leggatt, giving the court’s unanimous ruling, said: “In order to recover compensation under the DPA [Data Protection Act] 1998 for any given individual, it would be necessary to show both that Google made some unlawful use of personal data relating to that individual and that the individual suffered some damage as a result.
“The claimant’s attempt to recover compensation under the Act without proving either matter in any individual case is therefore doomed to fail.”
Section 13(1) of the DPA provides: “An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.”
However, the court indicated that, had there been a claim in tort for misuse of private information, there could have been an award of user damages which would not have required proof of damage.
The decision in Lloyd v Google LLC [2021] UKSC 50 [1] also examined the continuing role of representative actions in an age of more recent vehicles like group actions and collective proceedings.
The ‘Google You Owe Us’ action alleged that, over some months in 2011 and 2012, Google acted in breach of duty under the DPA by secretly tracking the internet activity of Apple iPhone users, collating and using that data, and then selling it all on.
No financial loss or distress was alleged. The claim was for a standard award – potentially of around £750 – for each of the estimated 4.4m members of the class, to reflect the infringement of the right, the commission of the wrong, and loss of control over personal data.
The representative claimant was Richard Lloyd, the former executive director of Which?.
In October 2018, Mr Justice Warby ruled against granting permission to serve proceedings on the internet giant in the US because there was not a reasonable prospect of the claim succeeding.
But this was overturned by the Court of Appeal, which boosted the use of representative actions in claims such as these, where the court said there was no other practical way of pursuing them.
Lord Leggatt said there was “no legitimate objection to a representative claim brought to establish whether Google was in breach of the DPA 1998 and, if so, seeking a declaration that any member of the represented class who has suffered damage by reason of the breach is entitled to be paid compensation”.
But, overturning the Court of Appeal, he rejected Mr Lloyd’s attempt to “break new legal ground” by arguing that the principles applicable to the assessment of damages for misuse of private information at common law also apply to the assessment of compensation under section 13(1).
His case, which was supported by the Information Commissioner, was that the word “damage” in section 13(1) not only extended beyond material damage to include distress but also included loss of control over personal data.
Lord Leggatt said it was “plain from the words enacted by Parliament the term ‘damage’ was intended to be limited to material damage and not to extend to ‘distress’”.
Further, recovering damages under section 13(1) by means of a representative claim could not succeed because, even if he was wrong and no material damage was needed, each individual would have to establish the extent of the unlawful processing of their data.
But he said a claim in tort for misuse of private information “would naturally lend itself to an award of user damages” – a type of damages in tort where use has wrongfully been made of someone else’s land or tangible moveable property although there has been no financial loss or physical damage to the property.
“The decision in Gulati shows that damages may be awarded for the misuse of private information itself on the basis that, apart from any material damage or distress that it may cause, it prevents the claimant from exercising his or her right to control the use of the information.
“Nor can it be doubted that information about a person’s internet browsing history is a commercially valuable asset.”
Lord Leggatt added that, “where the defendant’s very purpose in wrongfully obtaining and using private information is to exploit its commercial value, the law should not be prissy about awarding compensation based on the commercial value of the exercise of the right”.
Richard Beaty, a consultant employed barrister and data protection expert at City firm Kennedys, said the decision should help “stem the tide” of low-value data protection claims for relatively minor infringements of data protection law, which he said was in danger of becoming the new whiplash.
“Businesses and insurers across the UK will be breathing a sigh of relief at today’s judgment, which signifies a return to orthodoxy in terms of causation in data protection claims,” he added.
“The ruling also slows the move towards allowing US-style opt-out cases in the UK.”
David Greene, a committee member of the London Solicitors Litigation Association and senior partner of Edwin Coe, said the ruling left open the question of whether a reinterpretation of CPR 19.6, the rule for representative actions, could be used to create a new process for class actions.
The provision has historically been used by groups of claimants who have the same claim, such as tenants seeking to challenge service charges against their landlord, he explained.
The ruling that Mr Lloyd could not use CPR 19.6 without proving individual damage was “not a bar to a representative claim that each represented person has in law a separate cause of action nor that the relief claimed consists of or includes damages”.
Mr Greene said damages could be claimed in a representative action if calculable on a common basis for all the persons represented.
“Alternatively, issues of liability may be decided in a representative action which can then form the basis for individual claims for compensation… The door is shut in this particular case but left ajar for innovative use of this age-old provision.”