Courts can award damages for loss of control over data even if no financial loss or distress caused

The Court of Appeal has confirmed that a court can award an individual damages for loss of control of their personal data. They do not need to show financial loss or distress (Lloyd v Google LLC). 

What is the background to this case? 

Mr Lloyd brought a class action against Google on behalf of more than 4 million Apple i-Phone users. He claimed Google had unlawfully and secretly tracked their internet usage for commercial purposes between April 2011 and February 2012. This was via “Safari Workaround” technology. He claimed this enabled Google to set a cookie on Apple devices without the user’s knowledge or consent when they visited certain adverts. Google could then aggregate this data (such as adverts clicked and the duration of visits), categorise the users into “audience segments” and offer this data to subscribing advertisers to tailor who their adverts were sent to. 

He claimed under the Data Protection Act 1998 (“DPA 1998”), but the ruling is relevant for the GDPR and the new Data Protection Act 2018. He used a rare representative claims procedure and had to show the i-Phone users had the same interests in the claim as him.

As Google LLC is based in the US, Mr Lloyd needed permission to serve proceedings outside the UK.

What was the High Court ruling? 

The High Court refused permission to serve proceedings in the US. It also ruled the claim had no real prospect of success. 

The High Court ruled that DPA 1998 compensation required proof of damage. This damage had to be something separate to, and caused by, the infringement. However, Mr Lloyd had claimed a uniform amount of damages on behalf of each person without seeking to allege or prove any distinctive facts affecting any of them. The only allegation made was they did not consent to Google abstracting their data. 

The High Court also ruled the Mr Lloyd’s chosen class members did not share the “same interest” because the nature and extent of the breach, and the impact on individual class members, varied greatly depending on their personal circumstances. The Court noted that some within the class may not have suffered any damage at all. 

The Judge used his discretion to decide the claim could not proceed. He weighed the significant costs and court time involved in dealing with the claim compared to the modest compensation likely to be payable (as well as no one having come forward to claim for the breach previously). 

Mr Lloyd appealed the decision. 

What was the result of the appeal? 

The Court of Appeal overturned the High Court decision and made three significant rulings:

1. Damages under DPA 1998 could be awarded without an individual having to prove financial loss or distress. The person’s loss of control over their data had a value, particularly since Google had made money from advertisers from each person’s browser generated information.  
2. The members of the class had the same interest in the claim (they had lost control over their browser generated information) and were identifiable. 
3. The original decision took some factors into account wrongly, including the inability to identify the members of the class and the fact the members had not authorised the claim. The Court of Appeal noted that the claim, if upheld, sought to call Google to account for its alleged wholesale and deliberate misuse of personal data without consent with a view to commercial profit. 

Mr Lloyd therefore now has permission to issue proceedings against Google outside the UK. 

What are the long term implications? 

The ruling that there is no need to show financial loss or distress for DPA 1998 claims is important. While individual compensation in such claims may be modest, if many claimants are affected by a breach, total compensation could be significant. While the case was brought under DPA 1998, the judgment referred to the GDPR for guidance and it is likely a similar approach would be taken under the GDPR and the Data Protection Act 2018.

The judgment clarified members of an affected class do not need to authorise the claim. However, the rules on representative claims are strict. If members do not have the same interest (for example, if claiming for financial loss or distress, individuals’ specific circumstances are likely to vary) a group action cannot be used. 

We will need to see if further actions are brought based on this ruling and await developments in Mr Lloyd’s claim with interest.