The UK Supreme Court’s decision in Lloyd v Google LLC [2021] UKSC 50 imposes boundaries on what might have appeared to be an endless expansion of the scope of personal data protection law. A link to the judgment is here.
The facts of the claim relate to events around a decade ago when it is alleged that Google secretly tracked the internet activity of millions of Apple iPhone users and used it for commercial purposes. Google has in the past settled regulatory and civil claims with payment of damages and penalties.
Mr Lloyd had sought to bring the claim on behalf of all of the approximately four million England and Wales residents who owned an iPhone at the time. It was suggested that they might each be entitled to £750 in compensation, which would have produced a total sum of around £3 billion. Unsurprisingly, Google contested Mr Lloyd’s claim.
The UKSC judgment relates to two narrow points of law about the requirements for representative claims (as close as English law comes to a class action concept) and the concept of ‘damage’ in data protection claims.
Mr Lloyd had been successful in the Court of Appeal in arguing that compensation should be available to a data subject whenever there was a failure to comply with the then-law of the Data Protection Act 1998 (‘DPA’) without proof of material damage or distress, provided that it was not trivial or de minimis. This had become known as ‘loss of control’ of personal data for which compensation should be payable.
The UKSC has rejected this proposition. Instead, it held that a data subject must show that a failure to comply with the DPA has caused him/her material damage or distress.
The court’s determination on the basis for damage was essentially fatal to Mr Lloyd’s case, as it required the court to receive evidence of the type and magnitude of damage for each individual claimant. This is because for a representative claim to succeed the claimants must all share the same interest. That becomes unworkable if there is a need to have regard to all of the four million individual circumstances of damage and distress. The UKSC noted that there would be nothing to prevent an action by means of a representative claim by a class of data subjects seeking a declaration of liability that their rights had been infringed (but without the second ‘bespoke’ stage of proving an entitlement to compensation). The court has left open the possibility that seeking the lowest level of damages for the whole class might be viable, provided that there were safeguards that could allow a claimant to opt-out of that ‘capped’ award.
Commentators have widely responded that this is a serious setback – indeed maybe a fatal blow – to the nascent class action movement in England and Wales for low value data compensation claims. This is because it is not possible to use the representative claim mechanism to obtain damages for large groups because of the need to individualise the evidence on damage. The death knell might go too far, but it will require some recalibration of how to approach quantum if there are to be any future group claims and the UKSC judgment will likely diminish the appetite of commercial litigation funders.
The court preserved the concept of loss of autonomy damages as a remedy for misuse of private information cases, but that has a requirement to show a reasonable expectation of privacy in the private information concerned (Mr Lloyd’s case was not put on that basis).
The UKSC judgment, and its references to the views of the first Judge and the Court of Appeal, perhaps best highlight the very different attitudes towards litigation of this kind. Mr Justice Warby characterised the claim as ‘officious litigation’ that was not authorised by the wider class of claimants and where the main beneficiaries stood to be the lawyers and commercial litigation funders. By contrast, the Court of Appeal felt that the representative claim mechanism was the only way of obtaining a civil compensatory remedy for ‘wholesale and deliberate misuse of personal data without consent undertaken with a view to commercial profit’. The UKSC avoided expressing any view as to the desirability of such cases, instead sticking adroitly to legal reasoning that led it to conclude the claim would not succeed.
While Lloyd v Google was about the ‘old’ pre-GDPR law, given the similarities between the compensation provisions, it is likely that the view of the Supreme Court on GDPR would not be markedly different.
Jo Sanders is a litigation Partner and UK Head of Media and Reputation
