Press Summary

Justices

Lord Reed (President), Lady Arden, Lord Sales, Lord Leggatt, Lord Burrows

Background to the Appeal

The question raised by this appeal is whether the claimant, Mr Richard Lloyd (who is backed by a commercial litigation funder), can bring a claim against Google LLC in a representative capacity seeking compensation under section 13 of the Data Protection Act 1998 ("the DPA 1998") for damage allegedly suffered by a class of Apple iPhone users as a result of unlawful processing by Google of their personal data in breach of the requirements of the Act. The claim is based on the factual allegation that, for several months in late 2011 and early 2012, Google secretly tracked the internet activity of some 4 million of Apple iPhone users in England and Wales and used the data collected without the users' knowledge or consent for commercial purposes (by enabling advertisers to target advertisements at users based on their browsing history). The DPA 1998 has since been replaced by the UK General Data Protection Regulation supplemented by the Data Protection Act 2018, but it was in force at the time of the alleged breaches and applies to this claim.

Except in the field of competition law, Parliament has not enacted legislation providing for class actions, in which a single person can claim redress on behalf of a class of people similarly affected by alleged wrongdoing. Mr Lloyd seeks to rely, however, on a procedure of very long standing in England and Wales, and now embodied in rule 19.6 of the Civil Procedure Rules ("CPR"), which allows a claim to be brought by (or against) one or more persons as representatives of others who have the "same interest" in the claim. Mr Lloyd argues that the "same interest" requirement is satisfied in the present case and that this representative procedure can be used to recover a uniform sum of damages for each person whose data protection rights have been infringed, without having to investigate their individual circumstances. A sum of £750 per person has been suggested which, multiplied by the number of people whom Mr Lloyd claims to represent, would produce an award of damages of the order of £3 billion.

Because Google is a Delaware corporation, the claimant needs the court's permission to serve the claim form on Google outside the jurisdiction. Google has opposed the application on the grounds that: (1) damages cannot be awarded under the DPA 1998 without proof that a breach of the requirements of the Act caused an individual to suffer financial damage or distress; and (2) the claim in any event is not suitable to proceed as a representative action. In the High Court Warby J decided both issues in Google’s favour and therefore refused permission to serve the proceedings on Google. The Court of Appeal reversed that decision. Google now appeals to the Supreme Court.

Judgment

The Supreme Court unanimously allows the appeal and restores the order made by the judge. Lord Leggatt gives the judgment, with which the other Justices agree.

Reasons for the Judgment

Lord Leggatt first analyses the history and scope of the representative procedure and endorses the view, found in the old case law, that it is a "flexible tool of convenience in the administration of justice". This broad and adaptable approach has been adopted by the highest courts of Australia, Canada and New Zealand. It is even more appropriate now in modern conditions including the development of digital technologies which have greatly increased the potential for mass harm for which legal redress may be sought [33]-[68].

Lord Leggatt considers that the "same interest" requirement must be interpreted purposively and pragmatically in light of its rationale and the overriding objective of the CPR of dealing with cases justly [69]-[75]. It is not a bar to a representative claim that each represented person has in law a separate cause of action nor that the relief claimed consists of or includes damages. Damages may be claimed in a representative action if they can be calculated on a basis common to all persons represented. Alternatively, issues of liability may be decided in a representative action which can then form the basis for individual claims for compensation [80]-[83].

In this case a representative claim could have been brought to establish whether Google was in breach of the DPA 1998 as a basis for pursuing individual claims for compensation. However, the claimant has not proposed such a two–stage procedure, doubtless because the proceedings would not be economic if it is necessary to prove loss on an individual basis. Instead, the claimant argues that a uniform sum of damages can be awarded to each member of the represented class without the need to prove any facts particular to that individual [84]-[89]. In particular, he argues, supported by the Information Commissioner, that compensation can be awarded under the DPA 1998 for "loss of control" of personal data constituted by any non–trivial contravention by a data controller of any of the requirements of the Act.

Lord Leggatt rejects these arguments and concludes that the claim advanced cannot succeed for two reasons. First, the claim is founded solely on section 13 of the DPA 1998, which provides that "an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage". On the proper interpretation of this section the term "damage" refers to material damage (such as financial loss) or mental distress distinct from, and caused by, unlawful processing of personal data in contravention of the Act, and not to such unlawful processing itself [90]-[143]. Second, it is on any view necessary, in order to recover compensation under section 13, to prove what unlawful processing by Google of personal data relating to a given individual occurred.

The attempt to recover damages without proving either what, if any, unlawful processing of personal data occurred in the case of any individual or that the individual suffered material damage or mental distress as a result of such unlawful processing is therefore unsustainable [144]-[157]. In these circumstances the claim cannot succeed and permission to serve the proceedings on Google outside the jurisdiction was rightly refused by the judge [158]-[159].

References in square brackets are to paragraphs in the judgment

Note

This summary is provided to assist in understanding the Court’s decision. It does not form part of the reasons for the decision. The full judgment of the Court is the only authoritative document. Judgments are public documents and are available online. Decided cases