Google LLC v Lloyd

Background

Lloyd, with backing from a commercial litigation funder, issued a claim against Google LLC as a representative claim under CPR 19.6 on behalf of 4.4 million people in England and Wales who owned an iPhone between 2011 and early 2012.  The breach related to Google’s use of the ‘Safari Workaround’ in which they tracked the internet activity of iPhone users.

As the claim was brought in the England against a company situated outside England, Lloyd had to seek permission to serve the claim form outside the jurisdiction. The High Court refused the application based on the fact that damages could not be awarded without proof of material damage or distress and the claim was not appropriate to bring as a representative action. The Court of Appeal reversed that decision.

The Supreme Court’s treatment of Section 13 DPA 1998

The crux of Lloyd’s claim argued that under section 13 of the DPA 1998 compensation is available for individuals without the need to prove damage and or distress from a breach as the claim amounted to “loss of control” of their data.

The Supreme Court held that an individual’s loss of control of their personal data was not sufficient to waive the need for evidence of material damage or distress under section 13. The rejection of Lloyd’s claim was two-fold:

1. The need for proof of damage

The court held that the proper interpretation of ‘damage’ in section 13 of the DPA means ‘material damage’ or ‘distress’ from and caused by unlawful processing. It was made clear in the judgment that damages cannot be sought just for the contravention itself.  

2. Extent of Damages

The court held that beyond the need to prove (and even in cases where it isn’t necessary to prove) that material damage or distress had been caused a result of unlawful processing of an individual’s personal data; it is a requirement to establish the extent of the unlawful processing in his or her individual case.

The judge decided that the effect of the Safari Workaround was not uniform across the represented class on whose behalf Lloyd had sought to bring the claim and the difference in internet use and quality meant that some iPhone users were, for example, “super users” falling victim of multiple breaches whereas other users had limited internet activity.

What does this mean?

Although the court curtailed Lloyd’s claim, ultimately finding in favour of Google, the judgment did not dismiss the possibility of future claims for “loss of control” of personal data, if done in the right way.  Claims may still succeed where liability can be established and material damages or distress can be individually assessed.

While this judgment may deter other claimants from bringing representative actions against companies on behalf of groups of claimants, it should be highlighted to business owners that certain claims brought may still succeed depending on each individual case. Further, even if the decision is seen as a setback for those seeking to bring claims for breaches of loss of control of personal data, businesses still need to  be aware of the risk of the ICO who can still impose sanctions against companies (including substantial fines in more serious cases) for breach of data protection legislation.

The DPA 1998 has been replaced by the Data Protection Act 2018 and the General Data Protection Regulations 2018. Different to the old regime, the new regime allows for compensation on the basis of material and non-material damage which specifically refer to loss of control of data. It remains to be seen whether similar claims brought under the new regime will be impacted by this judgment.