Richard Lloyd – Court Ruling (United Kingdom, 2021)

Google secretly tracked Apple iPhone users between late 2011 and early 2012 and using their data collected in that way for commercial purposes. Google bypassed privacy settings on Apple iPhones and the default blocking of third party cookies on Safari with its “DoubleClick Ad” cookie by relying on an exception devised by Apple. Google placed this cookie without the user’s knowledge or consent. This cookie was enabled if users visited a website that included DoubleClick Ad content (advertising content). The cookie identified visits by a specific device on websites using this advertising content, including data and time of visit; time spent by the user on the website; what advertisement was viewed for how long; and using IP address, the user’s geographical location. As a result, Google could infer the user’s internet surfing habits, location, as well as interests, race or ethnicity, social class, political or religious beliefs, health, sexual interests, age, gender and financial situation. Google then used this aggregated information to give them labels (eg “football lovers”) and eventually offering these group labels to advertising organisations looking to target specific groups when using Google’s DoubleClick service. This allegation was brought in the US and Google settled a charge of $22.5 million with the US Federal Trade Commission and $17 million to settle consumer based actions in the US. Three individuals in the UK sued Google in 2013 for the same allegation and their claim was settled by Google (Vidal-Hall v Google Inc). Lloyd has filed a claim before the UK courts on behalf of everyone that resides in England and Wales and owned an Apple iPhone at the time of the secret tracking. Lloyd filed this class action with the intention of recovering damages for more than 4 million people affected. He claimed that compensation (£750 suggested) should be awarded under the Data Protection Act 1998 for loss of control of personal data without having to demonstrate that the claimant suffered financial or mental distress as a result of the infringement. = Section 4(4) of the Data Protection Act 1998 (DPA 1998) imposes a duty on data controllers to comply with data protection principles. These are laid out in Schedule 1 of the DPA 1998. Section 13 of the DPA 1998 gives individuals a right to compensation from the controller if they suffer damage as a result of a contravention of the Act by that controller. Individuals can bring claims which give rise to a common issue of fact or law can apply for a Group Litigation Order to be made under Rule 19.11 of the Civil Procedure Rules. This is an “opt-in” regime where claimants must take steps to join the group. They can also do so under a representative action, reflected in Rule 19.6 of the Civil Procedure Rules (CPR). However, as a detailed legislative framework is missing, the representative action rules within common law have been considered by the Supreme Court. The following principles are relevant: * “same interest” requirement where the representative must have the same interest or common issues as the persons they represent (within Rule 19.6 CPR); * “court’s discretion” as to whether to allow the claim to proceed as a representative action. This is an objective assessment as to whether the case can be dealt with justly and at a proportionate cost (within Rules 1.1 and 1.2 CPR); * “no requirement of consent” or awareness required from the people represented; * “class definition” requirement where the class of people represented must be clearly defined; * “liability for costs” requirement where the persons represented will not have to pay costs of being represented incurred by the representative; * “scope for claiming damages” where claiming damages is limited by the nature of the remedy of damages at common law, or by the fact that damages may require an individual assessment. = The UK Supreme court did not object to a representative claim brought to establish whether Google was in breach of DPA 1998. The Supreme Court also determined that the individuals had similar interests or common issues caused by tracking of their behaviour without consent. According to the Court, there was no uniform effect caused by Google’s actions across the represented class. Instead, the effect and the amount recoverable by each individual would depend on the circumstances particular to the individuals (eg how often they used Safari or website with DoubleClick Ad content). Contrary to Lloyd’s claim, the Court held that DPA 1998 cannot be read to mean that individuals are entitled to compensation for any contravention of the DPA 1998 without needing to prove financial loss or distress. According to the leading judgement, under Section 13 DPA 1998, it is not enough to prove an infringement by a data controller as “damage” (interpreted as only meaning material damages) or “distress” must be suffered as a result. Following an analysis of Vidal-Hall v Google Inc (discussing Section 13 DPA 1998) and Gulati v MGN Ltd (discussing tort for misuse of private information) the court outlined that it would be possible for Lloyd to claim (1) damages under Section 13(1) DPA 1998 for distress suffered due to Google’s infringement of the Act; (2) and /or damages for the misuse of private information without the need to show material damage or distress. However, the court outlined that the case was not made for either (claim for misuse of information tort having not be made). Again, the Court reiterated that to recover damages for distress under Section 13(1) DPA 1998, it would be necessary to provide evidence of this distress for each individual represented – making this incompatible with the nature of representative action. The UK Supreme Court rejected the argument that an infringement of the DPA 1998 should be dealt with in the same way as the tort of misuse of private information and that therefore compensation can be recovered for interference by an organisation without the need to demonstrate material damage or distress. The UK Supreme Court relied on the fact that Section 13(1) DPA 1998 cannot be interpreted using that analogy, as highlighted above. The wording of the DPA 1998 and its interpretation in caselaw cannot be detached from the fact that material damage or distress must be demonstrated: "…the wording of section 13(1) draws a distinction between “damage” suffered by an individual and a “contravention” of a requirement of the Act by a data controller, and provides a right to compensation “for that damage” only if the “damage” occurs “by reason of” the contravention." Section 14 DPA 1998 also supports the interpretation that a damage, and not purely an infringement of the legislation, must be demonstrated. The Court also relied on the interpretation by the Court of Appeal in Vidall-Hall v Google Inc, which distinguished material damage or distress suffered and contravention of a requirement in the DPA 1998. The Court also did not consider that it was possible to rely on an analogy between the tort of misuse of information and Section 13 DPA 1998 simply because they are both founded in the common route of “right to privacy” embodied in Article 8 European Convention on Human Rights. Additionally, the Court held that it would be, in any case, necessary to identify damage or distress suffered by each individual for the purpose of awarding compensation (even if it was not necessary to show individual material damage or distress as a result of the infringement). Factors like extent of Google’s tracking; quantity of data processed; nature of the data processed (sensitive nature?); use of that information and benefit from it by Google would all need to be assessed for individual cases. Without such individualised assessment, Lloyd’s argument that the “lowest common denominator” on which the claim is based (proof that the individual is part of the class by having an iPhone at the time) would not be sufficient to be something more than trivial (as required under Section 13 DPA 1998). Therefore, compensation could not be quantified beyond 0. The UK Supreme Court concluded and decided unanimously that: “In order to recover compensation under the DPA 1998 for any given individual, it would be necessary to show both that Google made some unlawful use of personal data relating to that individual and that the individual suffered some damage as a result.”