Mr Lloyd, a consumer protection advocate, brought a claim against Google for damages on behalf of 4m Apple iPhone users. It was alleged that Google secretly tracked some of their internet activity for commercial purposes between 9 August 2011 and 15 February 2012.
The information collected by Google’s was information that was automatically submitted to websites and servers by a browser upon connecting to the internet. Google’s “DoubleClick Ad Cookie” (“Cookie”) enabled the delivery of internet-based adverts. The Cookie would be placed on a device if the user visited a website including Google’s content.
The Safari browser operated by Apple had in place settings that allowed the Cookie to be set on a device without the user’s consent or knowledge whenever a user visited a website containing Google’s DoubleClick Ad content. The Cookie would then collect information such as the date and times of visits to Google sites, how long sites were visited and location of the user. This information could be collected over time to identify trends and habits. Google used the information harvested by the Cookie to group users and perform targeted advertising. This functionality became known as the “Safari Workaround”.
The claimant Mr Lloyd alleged Google had breached its statutory duty under s4(4) DPA. Therefore damages were claimed, on behalf of a representative class per CPR 19.6 and s13 DPA, for infringement of data protection rights, loss of control of data and the wrong itself. To initiate a claim Mr Lloyd applied to serve proceedings on Google outside of jurisdiction in the USA.
Warby J. denied permission to serve proceedings on Google outside of jurisdiction, in the USA, at first instance. Upon appeal three issues where highlighted:
(a) whether the judge was right to hold that a claimant cannot recover uniform per capita damages for infringement of their data protection rights under section 13 of the DPA, without proving pecuniary loss or distress.
Here the court found that damages were capable of being awarded for loss of control of data despite their being no pecuniary loss or distress. The data harvested by Google was commercialised and sold on for marketing purposes. “Accordingly, in my judgment, a person’s control over data or over their BGI does have a value, so that the loss of that control must also have a value.”- p[47]
The foundation for the finding was the seminal case of Gulati in which an awarded of £10,000 was justified for every year of serious phone hacking the claimants were subject to. The loss of control of their data perpetuated by phone hacking was seen to attract compensatory damages due to a breach of persons privacy. The same underlying principle was applicable in this instance and was entrenched in the importance of privacy rights.
(Image credit: https//:launchpresso.com)
(b) whether the judge was right to hold that the members of the class did not have the same interest under CPR Part 19.6(1) and were not identifiable.
It was considered that the initial finding of Warby J was a too stringent application of the same interest test that litigants must hold. It was considered that each member of the class could sufficiently identify whether they were part of the class. The data held by Google could identify who was and was not part of the class. Class identification was therefore clear.
Further the damage caused to each claimant was discernible. The number of individuals in the class, in this case 4 million, could not in and of itself have an impact on the representative procedure.
(c) whether the judge’s exercise of discretion can be vitiated.
It was considered that the court had grounds to consider the matters at issue afresh. In doing so the Court of Appeal reversed the findings of the High Court finding that the class action was permissible. The finding was unanimous.
Comment
In finding for the appellant the go-ahead has been given to pursue an action against Google in the potential sum of £4b, with each of the 3m claimants receiving £750 damages for loss of control of their personal data.
The judgment itself highlights the importance of the safeguarding of data and the privacy rights which underpin its protection. The weighty consideration given to the application of Article 8 rights is significant and gave credence to the recoverability of damages for loss of control. Such actions underpinned by privacy rights are likely to be even more permissible under the new data protection regime, the Data Protection Act 2018.
The importance of a legitimate basis for processing data has been reinforced by this appeal. Though Google is highly likely to appeal the case. US-style class actions are a long way off with the stringent tests of class viability and actionability in the UK but this is a step in the right direction for consumers. As a matter of principle, this style of “op-out” class actions could have very significant consequences indeed for the data-driven agenda.
The Privacy Perspective 