Lloyd v Google: The Supreme Court’s verdict

The questions

Can compensation be awarded for “loss of control” of personal data under s13 Data Protection Act 1998 (DPA 1998) without evidence of any material damage or distress?  And can a representative action be brought on behalf of thousands of individuals for such a claim?

The key takeaways

The court will only award compensation under the DPA 1998 where the claimant can prove they have suffered material damage or distress. It is not enough to prove only that there was a “loss of control” of personal data. In cases where an individual assessment of damages is required, such as this case, a representative action is not suitable.

The background

Google developed a workaround after it was prevented from implementing advertising tracking cookies on Apple’s Safari internet browser (the Workaround). However, the result was that Safari users’ internet usage was tracked without their knowledge or consent. 

The claim was brought as a representative action by Richard Lloyd, a consumer rights activist and former Director of Which?. It was alleged that this was a breach of the DPA 1998 which was the relevant legislation in place at the time of the Workaround in 2011 and 2012. The representative action included anyone in England and Wales whose data had been tracked following the implementation of the Workaround on their iPhone, unless they “opted out”. 

Mr Lloyd issued a claim on his own behalf and on behalf of a class of other people resident in England and Wales whose data was collected by virtue of the Workaround and applied for permission to serve the claim out of the jurisdiction. The key questions addressed by the Supreme Court were:

• are damages recoverable under the DPA 1998 for “loss of control” of data, without needing to identify any specific distress or pecuniary loss?
• does the proposed group of individuals satisfy the “same interest” test as required for a representative action in England and Wales to proceed?
• should the Court exercise its discretion and disallow the representative action proceeding in any event?

Given that the class of individuals consisted of more than 4m people, it was agreed that it was not possible for the court to assess the damage caused to each individual. Instead, Mr Lloyd asked the court to awarded damages to everyone affected on a “lowest denominator basis”. It was suggested that the sum of £750 was appropriate for all class members in respect of the “loss of control” of their personal data. In the alternative, Mr Lloyd suggested that the court could decide a hypothetical sum that the individuals could reasonably have charged Google to use their personal data in the way they did.

The Supreme Court decision

The Supreme Court decided unanimously that a claim for “loss of control” damages under the DPA 1998 required evidence of material damage (such as financial loss) or significant mental distress caused directly as a result of the unlawful processing of persona data in contravention of the DPA. Mr Lloyd was unable to prove this for each individual in the class, therefore his claim was “doomed to fail”.

Furthermore, the Supreme Court disagreed that a uniform sum could be recovered and held that it is necessary to prove that unlawful processing of personal data relating to a given individual occurred. 

However, it should be noted that the court did emphasise a representative action can be an appropriate vehicle in cases where claimants all suffered the same type loss. For example, if a group of individuals have all been overcharged by the same amount.

Why is this important?

The rejection of Mr Lloyd’s claim offers reassurance to all data controllers. If the claim had been successful, the floodgates for compensation would have been opened to huge classes of individuals, who would automatically be included in such claims unless they “opted out”. Instead, similar data claims will require an individual assessment of damages and for individuals to a class to actively “opt in”, as well as prove material damage or distress. Inevitably, this will help limit the number of individuals who form part of any future class actions and who may be entitled to compensation.

Any practical tips?

Don’t relax and think that class actions cannot be brought for data breaches! The Supreme Court has left the door open for representative actions for claims for breaches of data protection legislation where individuals can prove that they have suffered damage. There are many data breaches out there resulting in, for example, financial harm which will still tick this (expensive) box for data controllers.