Lloyd (Respondent) v. Google LLC (Appellant)
[2021] UKSC 50
In the Supreme Court of the United Kingdom
UKSC 2019/0213
Before Lord Reed, President, Lady Arden, Lord Sales, Lord Leggatt, and Lord Burrows
Decided on November 10, 2021

Relevancy of the Case: Seeking compensation from Google for violation of Section 13 of the Data Protection Act 1998 via a representative action

Statutes and Provisions Involved

• The Data Protection Act 1998 (Section 4(4), 13)
• The Civil Procedure Rules 1998 (Rule 19.6)
• The Data Protection Directive of 1995 (Directive 95/46/EC)

Relevant Facts of the Case

• Safari, the default browser on Apple phones, blocks most third-party cookies. Google had a DoubleClick Ad cookie, which operated as a third-party cookie. This cookie enabled Google to identify platforms by displaying ads and collecting information. Google devised a workaround and placed this cookie on the user’s device without consent.
• Mr Richard Lloyd has issued a claim against Google LLC, alleging violation of Section 4(4) of the Data Protection Act 1998 (“the DPA 1998”). The claim states that Google secretly tracked the internet activity of millions of Apple iPhone users. Moreover, the company used the collected data for commercial purposes without the users’ knowledge or consent.
• Previously, Google settled with the US Federal Trade Commission (FTC) by paying a civil penalty of US $22.5 million in August 2012. In November 2013, Google paid US $17 million to settle consumer-based actions brought against the company in the US. Even in England and Wales, three claimants sued Google for claiming compensation under the DPA 1998 and common law for misusing private information. However, there was a settlement between the parties after a dispute over the jurisdiction (Vidal-Hall v. Google Inc., [2016] QB 1003).
• The difference in the present case is Lloyd’s claim to represent everyone resident in England and Wales who had an iPhone at the relevant time. A rough estimate of the number of users is more than 4 million.
• Before the High Court, Google submitted that the court could not award damages for loss of control of data without proof. The company also contended that the claim was unsuitable to proceed as a representative action. The High Court decided in Google’s favour, while the Court of Appeal reversed this decision.

Prominent Arguments by the Counsels

The respondent’s counsel:

• He relied on an innovative use of Rule 19.6 of the Civil Procedure Rules 1998. He argues that individual assessment of damage is not necessary. A court can order compensation under the DPA 1998 for loss of control of personal data without proving that the claimant suffered any financial loss or mental distress due to the breach. He furthered an average of £750 compensation per person; the total compensation would be £3 billion.
• He contended that Google’s processing of personal data violates first, second, and seventh data protection principles.
• The tort of misuse of private information and the data protection legislation are rooted in the same fundamental right to privacy.
• It is possible to identify an irreducible minimum harm suffered by every member of the class.

The appellant’s counsel:

• There would be practical difficulties in identifying whether an individual falls within the class definition.
• The court should approach the interpretation of Section 13 of the DPA 1998 based on a general rule that statutory duty breaches are not actionable without proof of material damage.
• The appellant is a self-appointed representative of the class. He has no authority from any individual class member to waive or abandon their rights.

Opinion of the Bench

• Launching class action suits in the United States and, more recently, Canada and Australia is possible. However, the British Parliament has not legislated to establish a class action regime in data protection.
• The claimant-respondent can advance a claim against Google in his own right, which has a real prospect of success. However, the scope of representative procedure under the Civil Procedure Rules would determine whether he can do so on behalf of all iPhone users.
• The court discussed, in detail, the development of representative suits across the globe.
• Under Rule 19.6, there is no maximum limit on the number of individuals who can be represented. There is only one condition: the individuals being represented should have the same interests.
• The bench did not see any legitimate objection to a representative claim. All the affected users would have the same interest in Rule 19.6.
• To establish liability for misuse of private information, it is necessary to show that there was a reasonable expectation of privacy. The claimant’s attempt under Section 13 of the DPA 1998 can only succeed if an individual can establish the extent of the unlawful processing in their individual case.

Final Decision

• The court used the discretion under Rule 19.6(2) by refusing to allow the claim to be continued as a representative action.
• The court allowed the appeal and restored the order, refusing the claimant’s application for permission to serve the proceedings on Google outside the jurisdiction of English courts.