0370 270 6000

already registered?

Please sign in with your existing account details.

need to register?

Register to access exclusive content, sign up to receive our updates and personalise your experience on brownejacobson.com.

Privacy statement - Terms and conditions

High Court sets boundaries for class action data protection claims (Lloyd v Google LLC)

23 October 2018

Information Law analysis: A class action for compensation brought by Mr Richard Lloyd on behalf of approximately 4.4 million iPhone users, whose internet activity was secretly tracked, accumulated and sold by Google in breach of the Data Protection Act 1998 (DPA 1998) was blocked by the High Court. The court held that the claim for compensation would not succeed on the basis of two separate issues-the damage claimed, and the nature of the representative action. With regard to damage, on the facts presented, neither Mr Lloyd nor any other members of the class suffered sufficient 'damage' (within the meaning of the DPA 1998) as a result of Google's breach in order to warrant an award of compensation under the DPA 1998. Regarding the representative action, the court held that regardless of whether the relevant damage was shown, the class action would not be allowed by the court due to the fact that members of the class did not have the 'same interest' in the claim, and that it was practically impossible to identify all members of the class. Warby J refused permission for the action to continue, labelling it as 'officious'. Written by Ella Greenwood and Richard Nicholas, partner, at Browne Jacobson LLP

Lloyd v Google LLC [2018] EWHC 2599 (OB)

What are the practical implications of this case?

This case makes it harder to bring a class action for breach of data protection legislation. It means that the class of claimants will need to be carefully defined and selected. The judgment was clear that:

  • claims for compensation in data protection cases should not be brought unless actual material (pecuniary) and/or non-material, emotional damage can be shown to have been caused by the breach
  • compensation will not be available in the absence of such damage across the class, ie:
  • where the breach of data protection legislation has merely infringed an individual's right, or
  • where the individual members of the class are not able to demonstrate the same interest in the claim.

Although this case was concerned with a breach of the DPA 1998, the judgment is likely to apply by the same token to potential claims for compensation made under Article 82 of the General Data Protection Regulation, Regulation (EU) 2016/679 (GDPR) and section 168 of the Data Protection Act 2018 (DPA 2018). Similar to the DPA 1998, both provisions require individuals to have suffered 'actual material' or 'non-material damage' in order to bring a claim for compensation.

In terms of representative actions for compensation, these should be brought with extreme caution where the class is comprised of a large number of individuals, as it is doubtful that all members will have the 'same interest' in the claim since it is highly unlikely they will have all have suffered the same damage.

Alternatively, even where a class can be conceptually defined, if there is practical difficulty in reliably ascertaining and verifying whether a particular individual is a member of the class, the class action is likely to be refused by the court.

Furthermore, the court is likely to exercise its discretion to refuse the continued pursuit of an 'officious' class action brought on behalf of individuals who haven't authorised the action, aren't particularly interested in pursuing it, and have nothing significant to gain; especially where the case is likely to be time consuming and costly.

What was the background?

The action was brought by Mr Lloyd in relation to Google's alleged breach of DPA 1998, s 4(4) where, between June 2011 and February 2012, they used a method known as the 'Safari Workaround' to secretly track the internet activity of iPhone users using the Safari internet browser. This was done by dropping their 'DoubleClick Ad' cookie onto the users' devices, without their knowledge or consent, whenever they visited a website containing DoubleClick Ad content. Once the cookie was dropped, it is alleged that Google then tracked the users' internet activity, and aggregated the information they generated by doing so to enable advertisers to target their adverts to the desired group of users.

The class as defined by Lloyd, includes approximately 4.4. million iPhone users. To fall into the class the users must have used the Safari internet browser to access a website that was participating in Google's DoubleClick advertising service during the relevant period of time.

The action brought by Lloyd was for compensation pursuant to DPA 1998, s 13(1) which provides that an individual who suffers damage as a result of a breach by a data controller of any of the requirements of the DPA 1998 will be entitled to compensation from the data controller for that damage. However, no allegation was made by Lloyd that any members of the class he was representing had suffered any material or non-material damage as a result of Google's alleged breach.

Had the action been successful, the potential liability for Google was estimated at between £1-3bn. The 'Safari Workaround' has already been the subject of high-profile litigation in the UK in the significant case of Vidal-Hall v Google Inc [2015] EWCA Civ 311 [2016] OB 1003, where it was decided that claims for compensation under the DPA 1998 could be made where the claimant suffers only distress as a result of the breach and no material (pecuniary) damages.

What did the court decide?

Damage

Warby J, in his judgment, accepted that there may have been an actionable breach of the DPA 1998, but held that it was necessary for there to be proof of damage (whether material or non-material) caused by this breach in order for a claim for compensation to be successful. He held that, no compensation could be awarded merely by virtue of the commission of the wrong or the infringement of rights themselves without evidence of damage suffered; and since Lloyd did not attempt to show that there was any damage suffered by him or members of the class, no compensation was due under DPA 1998, s 13(1).

Vidal-Hall v Google Inc [2015] EWCA Civ 311 [2016] OB 1003, was distinguished by Warby J, as in this case the claimants showed that they suffered actual damage in the form of distress which resulted from the breach of the DPA 1998 by Google.

Representative actions

It was held by Warby J that the requirements that must be satisfied in order to bring a representative action in the English courts were not met by Lloyd, in that Lloyd and all the members of the class did not all have the 'same interest' in the claim, as required by CPR 19.6. Where damage is necessary to bring a claim, which it is under DPA 1998, s 13(1), the damage suffered must be the same for all members of the class in order to bring a class action. There is no doubt that members of the class represented by Lloyd suffered different levels of damage as a result of Google's alleged breach, and some may have suffered no damage at all, meaning they did not all have the 'same interest' in the claim needed to bring it.

Warby J, also expressed concern that though the class was defined with conceptual certainty by Lloyd, there would be insurmountable issues with determining practically and reliably whether an individual fell into the class or not. It may, for example, come down to whether the individual changed their default browser settings within the relevant period of time six years ago, which is seemingly impossible to reliably verify.

Alternatively, Warby J held that regardless of the above considerations, the court would exercise its discretion to refuse the continued pursuit of the action as a representative action due to its 'officious' nature. He observed that the large number of individuals included in the class had not authorised the pursuit of, nor had they expressed any interest in the claim; since the 'Safari Workaround' was publicised around five years ago, none of them had come forward to bring a claim or made any complaints against Google (apart from those in Vidal-Hall v Google Inc [2015] EWCA Civ 311 [2016] QB 1003). Warby J did not think that the claim, which would require a substantial amount of money, resources and time, was worth pursuing by Lloyd on behalf of such uninterested individuals, especially since they were unlikely to gain much from it should it be successful.

Case details:

  • Court: High Court, Queen's Bench Division, Media and Communications List
  • Judge: Mr Justice Warby
  • Date of judgment: 8 October 2018


This article was first published by Lexis®PSL on 10 October 2018.

news

21 February 2020

Browne Jacobson advises LivingLens on $26million buy-out: acquisition demonstrates continued strength of North West tech sector

Browne Jacobson’s Manchester based corporate team has advised Liverpool-based video feedback platform LivingLens on its $26million sale to NYSE-listed buyer, Medallia.

Read more

11 November 2019

Browne Jacobson advises C7 Health on £1.5m acquisition of TAC Healthcare Group

Browne Jacobson’s Mike Jackson and Kirsty Underhill advised Warwickshire based C7 Health Ltd on its acquisition of Aberdeen based TAC Healthcare Group Ltd.

Read more