English Court Of Appeal Upholds Data Protection Rights And Expands Scope For Representative Actions

Case Summary

Richard Lloyd, a “champion of consumer protection” and former director of the consumer rights group Which?, is seeking to bring a representative damages claim1 against Google, on behalf of more than four million iPhone users. The English Court of Appeal has recently granted Mr Lloyd permission to pursue his claim in the English Courts as a representative action. Google intends to seek permission to appeal to the Supreme Court.

This decision2 is of interest because:

It has potentially significant implications for the U.K. class action landscape. The wide reading the Court of Appeal has given to the meaning of “same interest” for the purpose of establishing the representative class may encourage more privacy/data protection representative actions in the future. It confirms that damages may be claimed for “loss of control” of an individual's personal data even if the individual does not suffer pecuniary loss or distress. Background

Mr Lloyd alleges that Google tracked the internet activity of iPhone users in the U.K., between August 2011 and February 2012, by developing a workaround to the settings in Apple's Safari browser that blocked third party cookies. This so-called “Safari Workaround” allowed Google to track and collect individuals' “browser generated information” (BGI), without their knowledge or consent. He claims that Google was thereby able to obtain or deduce individuals' personal data, including sensitive personal data such as their ethnicity, age, health, gender, sexuality and financial position, and that this enabled Google to sell targeted advertisements to those iPhone users.

The United States Federal Trade Commission fined Google $22.5 million in August 2012 (a record at the time) in connection with the Safari Workaround.

Mr Lloyd issued his representative action in May 2017 against Google on behalf of the four million U.K. iPhone users affected at the time (the “affected iPhone users”). The claim is for breach of statutory duty by Google for infringement of the affected iPhone users' data protection rights and loss of control over personal data.

Mr Lloyd seeks damages on a per capita basis under section 13 of the Data Protection Act 1998 (DPA) but does not allege the affected iPhone users suffered any pecuniary loss or distress. Section 13 of the DPA implemented Article 23 of the Data Protection Directive (95/46/EC) (the “Directive”)3.

The key issues for determination were whether:

the claimant class had suffered damage; and...