Mr Richard Lloyd tried to sue Google on behalf of an estimated class of more than four million iPhone users, alleging that Google had secretly tracked their browsing in 2011 and 2012 and that each person should receive the same sum for loss of control of personal data. The Supreme Court held that the Data Protection Act 1998 does not award compensation for a breach unless the individual suffered material damage or distress, and that the uniform claim could not succeed without proof of what happened in each person’s case. Google’s appeal was allowed and permission to serve the claim outside the jurisdiction was refused.
Law Teacher writing support
Writing a law essay?
We choose a writer who is an expert in your area of law and qualified to at least the academic level you select. Most of our writers hold a master’s degree or PhD, have teaching experience, or both.
Send us your question and, if you wish, any marking criteria. We’ll write an essay to your instructions.
The claim Mr Lloyd wanted to bring
Between 9 August 2011 and 15 February 2012, Google is alleged to have used the Safari workaround. Safari, the browser on Apple iPhones, blocked third-party cookies by default. Google’s DoubleClick Ad cookie could nevertheless be placed on a device, without the user’s knowledge or consent, when the user visited a website containing DoubleClick advertising. The cookie could collect information about visits, timing and pages and, in some cases, approximate location, which might then be used to group users for advertisers.
Mr Lloyd relied on section 4(4) of the Data Protection Act 1998 and proposed a class of more than four million iPhone users. A letter of claim put the value at £750 a person, about £3 billion in total. He sought the same sum for every member without investigating any one user’s loss.
Parliament had not created an opt-out class-action regime for data protection; one existed only for competition claims. Mr Lloyd therefore used the representative procedure in rule 19.6 of the Civil Procedure Rules, under which one person may sue for others who have the same interest. He accepted that this could not work if each person’s compensation had to be assessed separately. His case depended on compensation being available for loss of control of personal data without proof of financial loss or distress, and on a uniform sum being awardable without investigating individual circumstances.
Because Google is a Delaware corporation, he needed permission to serve the claim outside England and Wales. Google said the claim had no real prospect of success. Warby J agreed and refused permission. The Court of Appeal, in a judgment of Sir Geoffrey Vos with which Davis LJ and Dame Victoria Sharp agreed, reversed that decision.
What a representative claim can do
Lord Leggatt, with whom Lord Reed, Lady Arden, Lord Sales and Lord Burrows agreed, treated the representative rule as flexible. The same-interest requirement ensures that the representative can protect the whole class. A conflict of interest bars representation; different issues which do not prejudice other members do not. Damages may be claimed if the sum can be calculated on a common basis.
Where the amount depends on personal circumstances, common issues may still be decided representatively, with individual questions left until later. Lord Leggatt saw no legitimate objection to a claim asking whether Google had breached the Act and for a declaration that any member who had suffered damage was entitled to compensation. Mr Lloyd had not proposed that. A declaration would not fund the litigation, and separate opt-in damages claims would not be economic where each was worth only a few hundred pounds and each person would have to prove their own loss.
Loss of control is not enough
The only claim advanced was under section 13 of the 1998 Act, which compensates an individual who suffers damage because of a contravention. On its wording, damage does not include distress. In Vidal-Hall the Court of Appeal disapplied that limit so distress could be compensated, because European Union law required it. Mr Lloyd, supported by the Information Commissioner, argued that damage also includes loss of control, so any non-trivial breach itself gives a right to compensation.
Lord Leggatt rejected that reading. Section 13 separates the contravention from damage suffered by reason of it. Treating the breach as the damage would collapse that distinction. Section 14, which restricts certain orders about accurate data to cases where a breach has caused damage, confirms the same point. The Data Protection Directive draws the same line, and nothing in European Union law required compensation where there was neither material damage nor distress. The events were governed by the 1998 Act; later data protection legislation could not change its meaning.
The privacy cases did not fill the gap. In Gulati, damages for phone hacking could reflect loss of control over private information, not only distress. That could not be carried across. The privacy tort protects information in which there is a reasonable expectation of privacy and can impose liability for deliberate misuse. The 1998 Act applies to personal data more generally, and compensation is excluded if the controller proves that it took the care reasonably required. A claim for user damages, meaning a hypothetical fee for releasing Google from its duties, was also unavailable: section 13 compensates for material damage or distress caused by a breach, not for the breach itself.
Why one sum for every user could not work
Even if loss of control had been compensable, the effect was not uniform. Warby J found, and it was not challenged, that some affected users were heavy internet users and others were not, that different information would have been taken, and that it was not credible that every pleaded category, including sensitive data, was obtained from each person.
The proposed common facts could be satisfied by a single visit to a relevant website. Mr Lloyd did not propose to prove that each person was tracked again, what browsing information was collected, or whether they received targeted advertising.
Those common facts could not show more than trivial harm, even if they showed damage at all. The claim appeared substantial because it alleged months of secret tracking of millions of users for commercial use. As framed, it did not seek to prove that in any individual case. On a user-damages approach, the only wrongful act to be proved would be placement of the cookie, without proof that Google then collected or used that person’s browsing data. A hypothetical fee for permission to place the cookie, but not to collect or use browsing information, would be nil.
Verdict: The Supreme Court unanimously allowed Google’s appeal and restored the refusal of permission to serve the claim abroad. Under the 1998 Act, the uniform damages claim had no real prospect of success without individual proof of wrongful use and resulting material damage or distress. No damages were awarded.
