Google defeats iPhone user action in UKSC ruling

Internet giant Google has won its appeal to the UK Supreme Court against an attempt to bring an action alleging unlawful processing of the personal data of millions of Apple iPhone users in 2011 and 2012.

Lord Reed, Lady Arden, Lord Sales, Lord Leggatt and Lord Burrows unanimously allowed the appeal from the Court of Appeal, which had reversed the judge at first instance and allowed the claim to be served on Google outside its own jurisdiction of Delaware, USA.

The claim, brought in a representative capacity by Richard Lloyd with the backing of a commercial litigation funder, is based on the allegation that, for several months in late 2011 and early 2012, Google secretly tracked the internet activity of some 4m Apple iPhone users in England & Wales and used the data collected without the users' knowledge or consent for commercial purposes, by enabling advertisers to target advertisements at users based on their browsing history. It seeks compensation under s 13 of the Data Protection Act 1998, suggested at a sum of £750 per person which, multiplied by the number of people Mr Lloyd claims to represent, would produce an award of damages of the order of £3bn.

Google opposed the application for permission to serve on the grounds that: (1) damages cannot be awarded under the Data Protection Act without proof that a breach of the requirements of the Act caused an individual to suffer financial damage or distress; and (2) the claim in any event is not suitable to proceed as a representative action.

Although the legislation providing for class actions only covers the field of competition law, Mr Lloyd sought to rely on the procedure embodied in rule 19.6 of the England & Wales Civil Procedure Rules ("CPR"), which allows a claim to be brought by (or against) one or more persons as representatives of others who have the "same interest" in the claim. He argued that the "same interest" requirement was satisfied in the present case and the procedure could be used to recover a uniform sum of damages for each person whose data protection rights had been infringed, without having to investigate their individual circumstances. 

Lord Leggatt, with whom the other Justices agreed, supported the view in the case law that the representative procedure was a "flexible tool of convenience in the administration of justice" which was even more appropriate now in modern conditions, including the development of digital technologies which had greatly increased the potential for mass harm for which legal redress might be sought.

He considered that the "same interest" requirement must be interpreted purposively and pragmatically in light of its rationale and the overriding objective of the CPR of dealing with cases justly. It was not a bar to a representative claim that each represented person had in law a separate cause of action, nor that the relief claimed consisted of or included damages. Damages might be claimed in a representative action if they could be calculated on a basis common to all persons represented. Alternatively, issues of liability may be decided in a representative action which could then form the basis for individual claims for compensation.

In this case a representative claim could have been brought to establish whether Google was in breach of the 1998 Act as a basis for pursuing individual claims for compensation. However, the claimant had not proposed such a two stage procedure, doubtless because the proceedings would not be economic if it was necessary to prove loss on an individual basis. Supported by the Information Commissioner, he argued that compensation could be awarded under the Act for "loss of control" of personal data constituted by any non-trivial contravention by a data controller of any of the requirements of the Act.

Lord Leggatt rejected these arguments for two reasons. First, the claim was founded solely on s 13 of the Act, which provided that "an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage". On the proper interpretation, "damage" referred to material damage such as financial loss, or mental distress distinct from, and caused by, unlawful processing of personal data in contravention of the Act, and not to such unlawful processing itself. Secondly, it was on any view necessary, in order to recover compensation under s 13, to prove what unlawful processing by Google of personal data relating to a given individual occurred.

The attempt to recover damages without proving either what, if any, unlawful processing of personal data occurred in the case of any individual or that the individual suffered material damage or mental distress as a result of such unlawful processing was therefore unsustainable. In these circumstances the claim could not succeed and permission to serve the proceedings on Google outside the jurisdiction was rightly refused by the judge.

Click here to access the judgment.