Alerter by Beatrice Graham- Supreme Court halts consumer rights campaigner in 4 million person strong representative action against Google

Click here to download this alerter by Beatrice Graham.

On 10 November 2021, the Supreme Court in a judgment given by Lord Leggatt with which Lord Reed, Sales, and Burrows and Lady Arden agreed, upheld the Defendant’s appeal in the case of Richard Lloyd v Google LLC [2019] EWCA Civ 1599, restoring the original order of the Judge which the Court of Appeal had overturned. The Claimant does not have permission to serve Google outside the jurisdiction.

In the High Court, Mr Lloyd sought permission to serve Google LLC outside the jurisdiction (in the US), enabling him to proceed with his representative action. The class he represents is composed of an estimated 4 million Apple iPhone users.

Oliver Campbell QC was instructed by Milberg London LLP for the Respondent / Claimant.

Background

Richard Lloyd, the Claimant, campaigns for consumer rights. He is a former director of the consumer rights group Which? and in April 2019 became a member of the board at the FCA.

He alleged that Google secretly tracked aspects of the internet activity of some 4 million Apple iPhone users between 9 August 2011 and 15 February 2012.

Many readers will be familiar with the concept of ‘cookies’. These enable tracking of internet activity undertaken by a device. ‘DoubleClick Ad Cookies’ were developed by Google to enable the delivery and display of internet based adverts. Exceptions created to Safari’s default settings (an Apple designed web browser) in place until March 2012, enabled Google to devise and implement the ‘Safari Workaround’: “Stripped of its technicalities, its effect was to enable Google to set the DoubleClick Ad cookie on a device, without the user’s knowledge or consent, immediately, whenever the user visited a website that contained DoubleClick Ad content.” (Warby J at paragraph 10).

Put even more simply, Google were allegedly able to collect information about visits made by the devices to websites which contained adverts from Google’s advertising network. Ultimately, Google were able to identify not just details such as period of time spent on a particular website, but, in some cases, approximate geographical location of the device and even information as to race, religion, ethnicity and sexual orientation.

Mr Lloyd’s claim alleged breach of statutory duty under section 4(4) of the Data Protection Act 1998 and sought, on behalf of the represented class, damages under section 13 of the Data Protection Act 1998 (“the DPA 1988”) for infringement of data protection rights, commission of the wrong and loss of control over data protection rights. The claims was described by the Court of Appeal as “an unusual and innovative use of the representative procedure”.

Decision at First Instance – [2018] EWHC 2599 (QB)

The issue before Warby J was a procedural one – whether permission should be given for service out of the jurisdiction.

The only point the Judge identified as needing consideration was paragraph 3.1(9) of PD 6B – in essence whether the Safari Workaround caused damage or counted as damage for the purposes of that paragraph such that the Claimant could be given permission by the court to serve out.

This led to further questions – whether the claim identified any reasonable basis for seeking compensation under the Data Protection Act and whether there was any real prospect that the court would permit the claim to continue as a representative action under CPR Part 19.6. As to the first, the Judge decided there was no basis. As to the second the Judge found that the “non-bendable” (paragraph 83) threshold point was whether all the claimants had the same interest in the claim and that the breach of duty and the impact was not uniform across the class such that there was no realistic prospect that the court would permit the claim to continue.

The Court of Appeal overturned this decision.

The Supreme Court’s Decision – [2021] UKSC 50

CPR 19.6 imposes no limit on the number of people who can be represented in a representative action. The individual must only share the ‘same interest’ as the representative. Following a detailed review of the history of the rule, the Court confirmed the interpretation of ‘same interest’ should be purposive and in light of the overriding objective (paragraph 71). The Supreme Court concluded that a representative claim could include a claim for damages or other monetary relief.

However, the Court concluded that the Claimant’s claim could not proceed as a representative claim. The Claimant argued that an individual was entitled to compensation for any non-trivial breach of the DPA 1998 without the need to prove that the individual had suffered any financial loss or distress. The Supreme Court rejected that argument and rejected the Claimant’s argument that ‘loss of control’ of data was itself sufficient to entitle an individual to compensation. The Court’s interpretation of section 13 of the DPA 1998 was that a claimant is only entitled to compensation if he or she has suffered material damage or distress as a result of the breach. Therefore it would be necessary in the circumstances for individuals to prove that the contravention by Google had caused material damage or distress to them personally (paragraph 138).

The Court concluded that the Claimant could not prove that all of the members of the proposed class had suffered material damage or distress, and therefore could not prove their entitlement to compensation as a class. Further, Lord Leggatt stated at paragraph 144:

“Even if (contrary to my conclusion) it were unnecessary in order to recover compensation under this provision to show that an individual has suffered material damage or distress as a result of unlawful processing of his or her personal data, it would still be necessary for this purpose to establish the extent of the unlawful processing in his or her individual case. In deciding what amount of damages, if any, should be awarded, relevant factors would include: over what period of time did Google track the individual’s internet browsing history? What quantity of data was unlawfully processed? Was any of the information unlawfully processed of a sensitive or private nature? What use did Google make of the information and what commercial benefit, if any, did Google obtain from such use?”

Key Take Away Points

The decision has important ramifications for data protection law and also for collective proceedings.

It is now clear that compensation for a breach of the DPA 1998 is only available where the claimant has suffered financial loss or distress. Loss of control of data is not of itself sufficient to bring an entitlement to damages.

The Court has not ruled out the possibility of representative actions for damages. It envisages two scenarios where they could be claimed. The first is where the damages to which each member of the class is entitled require no “individualised assessment”. The second is the possibility of a “bifurcated process” whereby issues of liability are tried as common issues through a representative claim, with the amount of damages being resolved at a second ‘opt in’ stage. In relation to that second possibility, the Court concluded that an action for damages would be brought for limitation purposes at the point of issue of the representative claim, and not at the point of individual claimants opting in after liability had been established.

Lord Leggatt (at paragraphs 82 and 84) stated:

“There is no reason why damages or other monetary remedies cannot be claimed in a representative action if the entitlement can be calculated on a basis that is common to all the members of the class. Counsel for the claimant, Hugh Tomlinson QC, gave the example of a claim alleging that every member of the class was wrongly charged a fixed fee; another example might be a claim alleging that all the class members acquired the same product with the same defect which reduced its value by the same amount. In such cases the defendant’s monetary liability could be determined as a common issue and no individualised assessment would be needed….

In the present case I could see no legitimate objection to a representative claim brought to establish whether Google was in breach of the DPA 1998 and, if so, seeking a declaration that any member of the represented class who has suffered damage by reason of the breach is entitled to be paid compensation.”

The Court recognised the economic difficulties faced by Claimants or consumer champions hoping to take advantage of such a “bifurcated process” (paragraph 85). Therefore although the Court left open the possibility of representative claims for damages in the two scenarios above, they may well prove unattractive to third party litigation funders.

Conclusion

The judgment is the first time the highest court in England and Wales has considered the representative action procedure in nearly a century, and has brought welcome clarity to the scope for such claims. Although the Court has not ruled out the possibility of representative claims for damages, it has placed considerable restrictions on them. In practice the restrictions may make them unviable in most cases.

The Supreme Court recognised that the GLO process is unlikely to be viable for claims only worth a few hundred pounds each. Therefore there remains a lacuna as to how such claims, outside the competition field, can be pursued. There is likely to be pressure placed on the Government to legislate to fill that gap.

This alerter is available to download as a PDF below.

To subscribe to Henderson Chambers news, alerters and updates please click here.