In Lloyd v Google LLC [2021] UKSC 50, the respondent Mr Lloyd (L) issued a claim alleging that the appellant (Google) had breached its duties as a data controller under the Data Protection Act 1998 to over four million Apple iPhone users in 2011-2012, when Google was able to collect and use their browser generated information. The respondent sued on his own behalf and on behalf of a class of other residents in England and Wales whose data was collected in this way. He applied for permission to serve the claim out of the jurisdiction. Google opposed the application on the grounds that (a) the pleaded facts did not disclose any basis for claiming compensation under the DPA 1998 and (b) the court should not in any event permit the claim to continue as a representative action.
In the High Court, Warby J decided both issues in Google’s favour and therefore refused permission to serve the proceedings on Google. The Court of Appeal reversed that decision. Google appealed to the Supreme Court.
Background
The key question raised by the appeal to the Supreme Court was whether L could bring a claim against Google LLC in a representative capacity seeking compensation under section 13 of the DPA 1998 for damage allegedly suffered by a class of Apple iPhone users as a result of unlawful processing by Google of their personal data in breach of the DPA 1998. The claim was based on the activities of Google when it secretly tracked the internet activity of four million of Apple iPhone users in England and Wales and used the data collected without the users’ knowledge or consent for commercial purposes (by enabling advertisers to target advertisements at users based on their browsing history). The DPA 1998 has since been replaced by the UK General Data Protection Regulation and the Data Protection Act 2018. However, it applied to this claim as it was in force at the time.
At the moment, the only area where class actions are permitted is in the field of competition law, in which a single person can claim redress on behalf of a class of people similarly affected by alleged wrongdoing. However, L sought to rely on rule 19.6 of the Civil Procedure Rules which allows a claim to be brought by (or against) one or more persons as representatives of others who have the “same interest” in the claim. L argued that the “same interest” requirement was satisfied in this case and that the representative procedure could be used to recover a uniform sum of damages for each person whose data protection rights have been infringed, without having to investigate their individual circumstances. A sum of £750 per person was suggested which, multiplied by the number of people whom L claimed to represent, would have produced an award of damages of around £3 billion.
The Supreme Court decision
Lord Leggatt gave the leading judgment. He analysed the history and scope of the representative procedure and endorsed the view in the old case law that it is a “flexible tool of convenience in the administration of justice”. This broad and adaptable approach has been adopted by the highest courts of Australia, Canada and New Zealand. It is even more appropriate now in modern conditions including the development of digital technologies which have greatly increased the potential for mass harm for which legal redress may be sought.
Lord Leggatt considered that the “same interest” requirement must be interpreted purposively and pragmatically considering its rationale and the overriding objective of the CPR of dealing with cases justly. It is not a bar to a representative claim that each represented person has in law a separate cause of action nor that the relief claimed consists of or includes damages. Damages may be claimed in a representative action if they can be calculated on a basis common to all persons represented. Alternatively, issues of liability may be decided in a representative action which can then form the basis for individual claims for compensation.
In this case a representative claim could have been brought to establish whether Google was in breach of the DPA 1998 as a basis for pursuing individual claims for compensation. However, L did not propose such a two–stage procedure and the judge said this was doubtless because the proceedings would not be economic if it is necessary to prove loss on an individual basis. Instead, L argued that a uniform sum of damages could be awarded to each member of the represented class without the need to prove any facts particular to that individual. In particular, he argued, supported by the Information Commissioner, that compensation could be awarded under the DPA 1998 for “loss of control” of personal data constituted by any non–trivial contravention by a data controller of any of the requirements of the Act.
Lord Leggatt rejected these arguments and concluded that the claim could not succeed for two reasons:
- the claim was founded solely on section 13 of the DPA 1998, which provides that “an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage”. On the proper interpretation of this section the term “damage” referred to material damage (such as financial loss) or mental distress distinct from, and caused by, unlawful processing of personal data in contravention of the Act, and not to such unlawful processing itself.
- if a party wishes to recover compensation under section 13, they must prove what unlawful processing by Google of personal data relating to a given individual occurred.
The attempt to recover damages without proving either what, if any, unlawful processing of personal data occurred in the case of any individual or that the individual suffered material damage or mental distress as a result of such unlawful processing was therefore unsustainable. In these circumstances the claim could not succeed and permission to serve the proceedings on Google outside the jurisdiction was rightly refused by the trial judge.
