The Supreme Court has ruled on the use of representative claims in data protection matters. The effect of this is that large group claims are likely to be considerably more difficult.

Background

Mr Lloyd, the former director of Which?, had issued a claim against Google for using technical means to bypass privacy settings on Apple iPhones enabling them to track internet users’ online web browsing activity without their knowledge. He was claiming as a representative on behalf of all iPhone users that had been affected. This case has been progressing for a few years now and many have been excitedly awaiting the decision from the Supreme Court. Mr Lloyd needed the court’s permission to serve the claim form on Google outside of UK jurisdiction. The High Court had originally refused permission to serve the claim form, a decision that was later reversed by the Court of Appeal. You can read more about the background to the claim in this blog. JMW represented Morrison employees in a similar claim, that was cited in the present case. Google had appealed to the Supreme Court and were effectively seeking to restore the position of the High Court.

The Key Issues

There is now a process which allows some claims to proceed as group actions, similar to American-style class actions in the UK. These allow an individual to take a claim on behalf of a, hazily specified, group of individuals and for an award of damages to be made in respect of all of them with the court making a best guess as to the loss of each individual. This is a new departure for the UK as previously any form of group claim would mean that every member of the group would need to be identified individually. However, group claims of this sort are only allowed for competition related matters, which this was not. To get round this problem Mr Lloyd had taken a representative action. This meant that he was asking the Court to decide his personal claim and also the claims of the large number of other people he said were similarly affected. Crucially, those people were not identified and the court was asked to make a notional award for the damage that each person was said to have suffered but without considering their individual losses.

The Supreme Court Decision

On 10 November, those following the case finally got the answer they were waiting for. The Supreme Court unanimously allowed the appeal, restored the High Court decision and blocked Mr Lloyd’s claim. The court considered three main issues:

1. Can you claim compensation, under s13 of the Data Protection Act (‘DPA’), for “loss of control” of data, without needing to prove material damage or distress?
2. Does the proposed group of individuals meet the “same interest” test required to bring a representative action in the UK?
3. Should the court exercise its discretion and refuse the claim?

The Supreme Court went as far as saying the claim was “doomed to fail” and rejected it for the following reasons.

a. DPA 1998 Claim

The claim relied on s.13 DPA 1998 which allows individuals to claim for damage suffered as a result of a breach of their data protection rights. The claimant argued that damages should be awarded for “loss of control” of individuals’ data. The court recognised that damages were available for loss of control of private information (Gulati v MGN) but the DPA required proof that there had been material damage or distress. There was also nothing in EU law that required an alternative reading. While this case pre-dates the introduction of the GDPR it was referred to by both sides. The court made clear that it was not interested in the GDPR as it had no application to this case, but it is unlikely that the decision would be any different post GDPR. The court held that it was not possible to recover damage without showing “both that Google made some unlawful use of personal data relating to that individual and that the individual suffered some damage as a result”. The representative action relied on this to make claims for people who were not specified and who had not set out any damage. Without this no such claim could be made.

b. Representative Actions

The Claimant brought this action using the representative procedure contained in the civil procedure rules. This allows for a representative to act on behalf of a group of people who have “the same interest” in a claim. The assessment of damages above was very relevant to the decision to not allow the representative action to proceed. Mr Lloyd argued that a uniform sum (£750 was suggested in correspondence) could be recovered for each claimed party involved. The Supreme Court disagreed and said it was necessary to prove what unlawful processing had occurred in each individual’s circumstance. You needed to consider factors such as: how long Google was tracking the individual, what quantity of data was unlawfully processed, was the information sensitive and whether Google commercial benefitted from the activity. In short, the claim could not be allowed to go ahead with a notional damages sum being awarded for each alleged potential claimant. Those individuals would each need to have their damages assessed individually.

Comment

The court recognised that an individual claim brought by Mr Lloyd would have had a reasonable prospect of success. Alternatively, he could bring a representative claim in a two-stage process. This would have first established whether Google was liable to him as a representative of a group of other potential claimants. Then all of those additional individuals could then have had their damages assessed individually in reliance on the principles established in Mr Lloyd’s claim. However, this two step process is likely to make smaller value claims like that advanced by Mr Lloyd far less attractive as there will need to be an initial contested hearing to establish the liability before a longer-winded assessment of damages for named persons. This will mean the process is much longer winded before a litigation funder earns any money from the case and also the costs involved will be far higher as it will be necessary to advertise for and assess a large number of individual claimants to establish a representative action in the first place rather than simply making a guess as to an appropriate number of persons and assigned them all the same damages figure.

While the court did not completely rule out the possibility of a uniform sum being awarded for representative actions, the decision would make it difficult to succeed without anything other than an individualised assessment of damages. This makes it more difficult to bring ‘opt-out’ class actions. The judge commented that this was “officious litigation, embarked upon on behalf of individuals who have not authorised it”. The decision is likely to have a substantial cooling effect on the class action market which was starting to show signs of substantial growth.

This blog has been co-authored by David Smith and Caroline Chalk.