The Supreme Court has handed down its long-awaited judgment in Lloyd v Google, overturning the Court of Appeal’s decision and unanimously finding in favour of Google.
This judgment will have significant ramifications for collective redress for data protection breaches in this jurisdiction. It will also become the leading authority on damages for breaches of data protection laws of any size and scope, and more generally, on the use of the representative actions vehicle in England and Wales. Emily Cox reviews the judgment and its consequences.
Background
In May 2017, Richard Lloyd, a former executive director of Which?, issued a representative claim against Google under Civil Procedure Rule (CPR) 19.6 for breach of its duties under the Data Protection Act 1998 (DPA) for employing the so-called “Safari Workaround” in 2011-2012. The workaround enabled Google to bypass Safari’s default privacy settings, set the DoubleClick Ad cookie on iPhones and track browser-generated information (BGI) – without the users’ knowledge or consent to sell this for advertising purposes and so in direct contravention of the DPA. Mr Lloyd sued on his own behalf and on behalf of the entire class of 4.4 million iPhone users in England and Wales whose data was collected in this way.
High Court
At first instance, Mr Justice Warby dismissed Mr Lloyd’s application for permission to serve Google LLC outside the jurisdiction ([2018] EWHC 2599 (QB)). He held that the claim did not disclose a basis for seeking compensation because the members of the class had not suffered “damage” within the meaning of section 13 of the DPA. Nor did they satisfy the “same interest” requirement of CPR 19.6, given they were likely to have suffered different types of damage (or no damage). Mr Justice Warby also declined to exercise his discretion to allow the claim to proceed.
Court of Appeal
The Court of Appeal (composed of Dame Victoria Sharp, Sir Geoffrey Vos and Lord Justice Davis) ([2019] EWCA Civ 1599) unanimously allowed Mr Lloyd’s appeal, granting him permission to serve out of the jurisdiction. The court concluded that damages are, in principle, capable of being awarded for “loss of control” of data under section 13 of the DPA 1998, even if there is no pecuniary loss or distress. In so concluding, it had regard to Article 8 of the Convention and Charter, GDPR and Gulati v MGN [2015] EWCA Civ 1291. The “same interest” test was satisfied because, having disavowed any reliance on facts specific to individuals, it could be said that all claimants had sustained the same loss, namely the loss of control of their BGI. The court exercised its discretion afresh and permitted the claim to proceed as a representative action.
A differently composed Court of Appeal bench endorsed this approach last month in Jalla v Shell ([2021] EWCA Civ 1389). In doing so, it referred to Lloyd v Google as the “paradigm example of a representative action” in which the class has the same interest, namely the same damage and defences.
Supreme Court
A Supreme Court composed of Lady Arden and Lords Reed, Sales, Leggatt and Burrows unanimously upheld Google’s appeal and reinstated Mr Justice Warby’s reasoning. Lord Leggatt gave the sole judgment on the following three issues for determination.
“Loss of control” damages
The court held that the claim did not disclose a basis for awarding damages given that:
- The claim was solely founded on section 13 DPA 1998, and compensation under the Act can only be made based where “damage” or “distress” is suffered as a direct consequence of a breach of its duty by a data controller, and not for the infringement itself; and
- Even if damages had been available without proof of damage or distress, it would still have been necessary to conduct an individualised assessment of the extent of Google’s unlawful processing in relation to each claimant, which is incompatible with a representative action.
In restating Mr Justice Warby’s approach, the Supreme Court agreed that loss of control damages may be recoverable for misuse of private information but noted that this was not how the present claim had been formulated. Lord Leggatt inferred that this might be because claims for misuse of private information would require individualised assessments as to whether there was a reasonable expectation of privacy.
“Same interest” test
The court considered that the “same interest” requirement should be considered “purposively and pragmatically” in light of the overriding objective and the rationale for representative actions. Lord Leggatt clarified that the premise for a representative action is that claims are capable of being brought that raise a common issue. The purpose of requiring “the same interest” is to ensure that the representative can be relied upon to conduct the litigation in a way that will protect the interests of all the members of the represented class. This is not possible where there is a conflict of interest between class members.
Discretion
The court only briefly touched on this point. It stated that it was unnecessary to decide whether the Court of Appeal was entitled to interfere with the judge’s discretionary ruling on whether it was desirable for a commercially funded class action to be available based on the facts in the case because “regardless of what view of it is taken, the claim has no real prospect of success”.
Comment
This decision will leave ‘Big Tech’ breathing a sigh of relief that the feared tsunami of opt-out data privacy class actions is no longer an immediate prospect. However, it also leaves consumers without a viable route to compensation for breaches of their privacy rights by large corporations and limits access to justice.
This is despite the fact the Supreme Court acknowledged that the advancement of digital technologies has left the consumer open to mass harms and that representative actions are an “appropriate” mechanism for redress, as have been used in Australia, Canada and New Zealand. Group Litigation Orders (GLOs) are not viable in most data breach cases (the cases of BA and EasyJet notwithstanding), given the mass nature of the harms but typically low level of damages payable. Sir Geoffrey Vos creative approach to “loss of control” damages in the Court of Appeal was specifically to ensure an effective remedy was available.
Counsel for Google argued that a decision with such significant implications for class actions in England and Wales should only be taken by parliament. But, in February this year, the government refused to implement Article 80(2) of the General Data Protection Regulation and a specifically crafted class actions route. The government said that in reaching its decision, it was “mindful” of developments in Lloyd v Google, which “shows a form of collective action can proceed under the current framework where the parties to the claim share the same interest”. Now that the Supreme Court has removed this option for collective redress, parliament will need to consider consumers’ options for redress.
There are three chinks of light in the judgment for consumer and privacy activists:
- Lord Leggatt endorsed the use of a “bifurcated approach” in cases where damages would require individual assessment. This approach would entail common issues of law or fact being decided through a representative claim, leaving any issues that require individual determination (whether they relate to liability or the amount of damages) to be dealt with at a later stage of the proceedings. He said Mr Lloyd might have had better success had he proposed such a “bifurcated” process. While there may be some cases where this is an approach worth mulling, many of the CPR 19.6 cases that had been stayed pending this judgment already have regulatory findings of liability, and so this will be of little value (for example, Marriott and Facebook/Cambridge Analytica).
- Another potential chink of light is the fact that the court expressly only considered the availability of “loss of control” damages in the context of section 13 DPA. It did not indicate whether its conclusions would be directly translatable to the GDPR and the Data Protection Act 2018, albeit these are similar. Nor did it rule out a claim for misuse of private information, although Lord Leggatt alluded to a reasonable expectation of privacy being established on an individual basis.
- Finally, Lord Leggatt appeared to relax the “same interest” test, clarifying that it was not intended as a straightjacket but rather to avoid conflicts of interest within the class. This may make CPR 19.6 claims more of a realistic possibility, for example, in the consumer law sphere.
Conclusion
This is a worrying decision for the positioning of England and Wales as a legal centre post-Brexit. Scotland and the Netherlands have embraced collective redress in the way that the US, Canada and Australia have done for some time. This trend is set to continue with the EU Representative Actions Directive relating to the protection of the collective interests of consumers, which EU member states must fully implement by June 2023.
With this decision, the Supreme Court has ensured that we are now distinctly out of kilter with that direction of travel. It also places pressure on the Information Commissioner’s Office, which does not have the resources to act in every data breach case and often does not have the inclination to do so.
The Supreme Court has stated that existing rules can provide a pathway for consumer redress, but its ruling will make it more difficult for individual consumers to make effective use of those existing rules. It did leave open the possibility for representative actions in data protection cases to be brought under the GDPR. However, it may be a while before another Richard Lloyd (and a funder with appetite) steps forward to test this. In the meantime, it remains to be seen what steps parliament may take to align this jurisdiction with other parts of the world and ensure consumers have adequate redress for breaches of their core statutory data privacy rights.
Media coverage
The significance of this decision means it has received coverage in international and specialist media. A summary of Emily’s coverage in the press can be found here:
Supreme Court blocks mass iPhone claim against Google – BBC news, 11 November 2021
U.K. Supreme Court decision on Google deals blow to class actions – Compliance Week, 11 November 2021
Top UK court blocks legal action against Google over internet tracking – The Guardian, 10 November 2021
Google Wins Supreme Court Appeal – TechRadar, 10 November 2021
Senior Paralegal Palomi Kotecha contributed to this article
You can find further information regarding our expertise, experience and team on our Media Disputes page.
If you require assistance from our team, please contact us
Subscribe – In order to receive our news straight to your inbox, subscribe here. Our newsletters are sent no more than once a month.
