English Court of Appeal hands down eagerly awaited judgment clarifying right to damages for breaches of data protection laws

In the eagerly awaited decision of Llloyd v Google LLC, the Court of Appeal has provided helpful clarification on the circumstances when individuals can claim damages for breaches of their rights in data collated by internet web browser providers for commercial purposes.  

The background to the appeal is a claim by Mr Lloyd, a former director of Which? and leader of the campaign group 'Google You Owe Us', for permission to serve proceedings out of jurisdiction on Google concerning its alleged secret collation of browser-generated information ('BGI') from iPhone users (including location, gender and health and financial details) for commercial purposes.  Mr Lloyd had to show a reasonable prospect of success to serve the claim on Google.  He sued on his own behalf and in a representative capacity of a class of more than 4 million Apple iPhone users said to be affected by the Safari Workaround used to collate and sale the BGI.  The damage alleged was said to arise in the following three different ways: 

1. infringement of data protection rights; 
2. commission of the wrong itself; and 
3. loss of control over personal data. 

The High Court held that the claimant failed to show 'damage' under the Data Protection Act 1998 ('DPA'), s.13 (implementing article 23.1 of Directive 95/46/EC (the 'Directive')) to allow service out of jurisdiction.  The High Court was also unwilling to award vindicatory or restitutionary damages.  The judgment distinguished the earlier case of Vidal-Hall v Google Inc [2016] Q.B. 1003, in which the claimant sought compensation to recognise damage in the form of distress.

Mr Justice Warby also held that there was not the same interest in the claim held by the parties Mr Lloyd purported to represent to permit a representative action. The consequences of Google’s alleged breach of the DPA was not uniform across the entire class and there were insuperable practical difficulties in ascertaining whether any given individual was a member of the class. 

The Court of Appeal has reversed the judge’s decision and given Mr Lloyd the right to proceed with his representative proceedings against Google in the Media and Communications Court in London. In summary, the Court held as follows: 

1. Mr Lloyd can recover damages for loss of control of their data under the DPA without proving pecuniary loss or distress;   
2. the members of the class that Mr Lloyd seeks to represent did have the same interest as one another to found a representative action; and 
3. the judge ought to have exercised his discretion to allow the action to proceed as a representative action. 

In making the above findings, the appellant judges dismissed Google’s main argument that the claimant had to establish proof of causation and consequential damage.  The finding was said to be consistent with the Directive and of article 8 of the European Convention on Human Rights and article 8 of the Charter of Fundamental Rights of the European Union 2012/C 326/02.  Only by construing the legislation in that way could individuals be provided with an effective remedy for the infringement of their rights. 

Although the Court of Appeal acknowledged that the claim was an unusual use of the representative procedure, it was permissible on the authorities.  The judges noted that the represented class:

• will all have had their 'BGI – something of value - taken by Google without their consent in the same circumstances during the same period';
• were not attempting to rely on any personal circumstances affecting any individual claimant (whether distress or volume of data abstracted); and
• were all victims of the same alleged wrong; and
• had all sustained the same loss in the form of 'loss of control over their BGI'.  

The judgment illustrates that the courts will adopt a wide approach to the necessary damage to establish a claim for breach of data protection rights under the DPA.  
The decision may also mark the expected dawn of the representative actions for breaches of data protection laws.  Whilst the claim is brought under the predecessor to the General Data Protection Regulations (the 'GDPR'), it provides useful clarification on the scope of the consumer redress provisions found at Articles 77-81 of the GDPR.  It remains to be seen whether Google will seek leave to appeal against the judgment. 

The full Court of Appeal judgment is available here and the full recording of the hearing of appeal is available here

Laura Feldman is a Lecturer in Private Law at the University of Oxford and Visiting Professor at King’s College London.  She practises as a barrister and will be supporting the Global Dispute Resolution practice at Freshfields Bruckhaus Deringer.