Lloyd v Google Supreme Court verdict brings end to privacy class actions against big tech in UK

Claims need evidence of damage

The court found that it would have been open to Lloyd to claim damages for distress caused by Google’s actions or for damages for the misuse of private information under the Data Protection Act 1988.

That would have required Lloyd to provide evidence of the information collected by Google from individual claimants, for example by producing a confidential schedule of their internet use, as has happened in other cases, and to produce evidence of the distress it caused.

Instead, Lloyd sought to break new ground by arguing that claimants should be able to recover damages without having to prove that any interference in their privacy rights resulted in material damage or distress.

Lloyd also argued that users should be compensated on the basis that they were subject to “loss of control” of their personal data as a result of the alleged actions by Google.

But the judge found that section 13 of the Data Protection Act 1988 “cannot be reasonably interpreted as giving an individual a right to compensation without proof of material damage or distress”.

European Convention on Human Rights

A decision by the European Court of Human Rights to award compensation of £10,000 to a senior police officer after her employer intercepted her phone calls in violation of Article 8 of the European Convention on Human Rights was not relevant in this case, the Supreme Court found.

Even if the court had awarded compensation because the police officer’s right to privacy had been invaded rather than because of any distress caused by the breach, that did not mean that under UK law, the European Convention on Human Rights required the court to award damages simply for the loss of privacy.

“Stripped to its essentials, what the claimant is seeking to do is claim for each member of the represented class a form of damages – the rationale for which depends on there being a violation of privacy – while avoiding the need to show a violation of privacy in case of any individual member of the class,” the judgment said. “This is a flawed endeavour.”

The court found that it would be anomalous if failure to take care to protect personal data gave claimants the right to compensation without proof that the claimant suffered damage, when failure to prevent personal injury or damage to property does require proof of harm.

The Supreme Court accepted that Google was allegedly able to make a lot of money by tracking the browsing history of iPhone users without their consent and selling the information collected to advertisers.

“Where the defendant’s very purpose in wrongfully obtaining and using private information is to exploit its commercial value, the law should not be prissy about awarding compensation,” the judgment found.

But the judge found this point did not arise in practice. Compensation can only be awarded under the Data Protection Act 1988 for material damage or distress, not for the infringement itself.

Even if this was not the case, the court found that it would still be necessary to consider how Google had made use of an individual’s private data to determine what damages the individual was entitled to.

Lloyd argued that it was possible to identify an “irreducible minimum harm” suffered by every member represented by the class action and to award a “uniform sum” to each person.

But the judge found that “the fundamental problem” was that without taking individual circumstances into account, the alleged facts were insufficient to establish that any member represented by the class action was entitled to damages.

“Without some proof of unlawful processing of an individual’s personal data…a claim on behalf of that individual has no prospect of meeting the threshold for an award of damages,” the judge found.

Even if “user damages” could be recovered, the inability to prove what wrongful use was made by Google of the personal data of any individual means that the damages awarded would be nil, he said.

Google agreed to pay a $22.5m settlement in August 2012 to the US Federal Trade Commission to settle charges that it had made misrepresentations to iPhone users.

The company was alleged to have made representations that it would not place tracking cookies on users of Safari or serve them with targeted advertising.

It agreed to pay $17m to settle actions brought by US state attorneys general from 37 US states and the District of Columbia on behalf of consumers affected by the alleged privacy breach.

In June 2013, Google reached a settlement with three people who sought compensation from it for breaches of the Data Protection Act in the UK.

The Information Commissioner’s Office found in a 2019 report that adtech companies were breaching the General Data Protection Regulation (GDPR) rights of UK citizens, but has yet to take enforcement action.

Dark day for privacy

Speaking after the ruling, Lloyd said the judgment meant there is little incentive for companies like Google to protect consumers.

“The government must now step in to make the system clearer and stronger by bringing in the right for groups of consumers to take action together under the Data Protection Act,” he said. “The responsibility to protect our privacy, data rights and collective action is squarely back with the government.”

Lloyd’s solicitor, James Oldnall, managing partner at Milberg London, said the decision meant that big tech companies could misuse people’s data with impunity.

“The ruling gives Google and the rest of Big Tech the green light to continue misusing our data without consent, knowing they will go unpunished,” he said. “It is a dark day when corporate greed is valued over our right to privacy.”

Jim Killock, executive director of the Open Rights group, which intervened in the case, said that without the ability to bring class actions, individuals would not be able to afford to take enforcement action against big tech companies.

“There must be a way for people to seek redress against massive data breaches without having to risk their homes and without relying on the information commissioner alone,” he said.

Killock called for the government to reconsider allowing class actions under the GDPR, after rejecting it in February on the grounds that Lloyd’s case against Google showed that existing rules could provide a path to redress.

Tech companies faced detrimental impact

Matthew Fell, chief policy director at employers’ organisation the CBI, said allowing the class action to go ahead would have had damaging consequences for technology companies.

“Introducing a US-style class action could have put a chill on investment and would have had a detrimental impact on firms across the economy without improving access to justice for the majority of consumers,” he said.

Law firm RPC represented TechUK, an intervening party in the Supreme Court hearing. David Cran, partner and head of IP and technology at the firm, said that until this ruling, tech companies had been left exposed to significant potential liabilities.

“The Supreme Court’s judgment has firmly rejected the basis of this class action and many others that were waiting in the wings,” he said. “It is likely to have a very significant impact on UK industry.”

Door to class actions closed in UK

Rupert Cowper-Coles, data disputes partner at RPC, said that although the Supreme Court has in principle left the door open for class actions – known as representative actions – to be brought for data protection breaches, in most cases it would not be financially viable to do so.

“The rejection of the concept of ‘loss of control’ damages and the requirement that individuals must prove they have suffered damage means that a representative action is unlikely to be a financially viable option for legal advisers and funders in most cases,” he said.