![]() |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] [DONATE] | |
United Kingdom Supreme Court |
||
|
You are here: BAILII >> Databases >> United Kingdom Supreme Court >> Lloyd v Google LLC [2021] UKSC 50 (10 November 2021) URL: https://www.bailii.org/uk/cases/UKSC/2021/50.html Cite as: [2021] UKSC 50, [2021] 3 WLR 1268, [2022] EMLR 6, [2022] AC 1217, [2022] 1 All ER (Comm) 1107, [2022] HRLR 1, [2022] 2 All ER 209 |
||
[New search]
[Context
]
[View without highlighting]
[Printable PDF version]
[Buy ICLR report: [2022] AC 1217]
[Buy ICLR report: [2021] 3 WLR 1268]
[Help]
Michaelmas Term
[2021] UKSC 50
On appeal from: [2019] EWCA Civ 1599
JUDGMENT
Lloyd
(Respondent)
v
Google
LLC (Appellant)
before
Lord Reed, President
Lady Arden
Lord Sales
Lord Leggatt
Lord Burrows
JUDGMENT GIVEN ON
10 November 2021
Heard on 28 and 29 April 2021
Appellant
Antony White QC
Edward Craven
(Instructed by Pinsent Masons LLP (London))
Respondent
Hugh Tomlinson QC
Oliver Campbell QC
Victoria
Wakefield QC
(Instructed by Milberg London LLP)
1st Intervener (Information Commissioner)
Gerry Facenna QC
Nikolaus Grubeck
(Instructed by Information Commissioner’s Office)
2nd Intervener (Open Rights Group)
(written submissions only)
Robert Palmer QC
Julianne Kerr Morrison
(Instructed by AWO)
3rd Intervener (Association of the British Pharmaceutical Industry and Association of British HealthTech Industries (ABPI and ABHI))
(written submissions only)
Lord Anderson of Ipswich KBE QC
Robin Hopkins
Rupert Paines
(Instructed by CMS Cameron McKenna Nabarro Olswang LLP (London))
4th Intervener (Liberty, Coram Children’s Legal Centre and Inclusion London)
(written submissions only)
Dan Squires QC
Aidan Wills
Tim James-Matthews
(Instructed by Liberty, Coram Children’s Legal Centre and Deighton Pierce Glynn)
5th Intervener (Internet Association)
(written submissions only)
Christopher Knight
(Instructed by Linklaters LLP (London))
6th Intervener (TECHUK Ltd (trading as techUK))
(written submissions only)
Catrin Evans QC
Ian Helme
(Instructed by RPC LLP (London))
LORD LEGGATT: (with whom Lord Reed, Lady Arden, Lord Sales and Lord Burrows agree)
A. Introduction
Lloyd
- with financial backing from Therium Litigation Funding IC, a commercial litigation funder - has issued a claim against
Google
LLC, alleging breach of its duties as a data controller under section 4(4) of the Data Protection Act 1998 (“the DPA 1998”). The claim alleges that, for several months in late 2011 and early 2012,
Google
secretly tracked the internet activity of millions of Apple iPhone users and used the data collected in this way for commercial purposes without the users’ knowledge or consent.
Google
agreed to pay a civil penalty of US$22.5m to settle charges brought by the United States Federal Trade Commission based upon the allegation. In November 2013,
Google
agreed to pay US$17m to settle consumer-based actions brought against it in the United States. In England and Wales, three individuals sued
Google
in June 2013 making the same allegation and claiming compensation under the DPA 1998 and at common law for misuse of private information: see
Vidal-Hall
v
Google
Inc (Information Comr intervening) [2015] EWCA Civ 311; [2016] QB 1003. Following a dispute over jurisdiction, their claims were settled before
Google
had served a defence. What is new about the present action is that Mr
Lloyd
is not just claiming damages in his own right, as the three claimants did in
Vidal-Hall.
He claims to represent everyone resident in England and Wales who owned an Apple iPhone at the relevant time and whose data were obtained by
Google
without their consent, and to be entitled to recover damages on behalf of all these people. It is estimated that they number more than 4m.
“Firstly, there are potential structural differences between the sectors which will require different consideration. … Secondly, it will be necessary to undertake a full assessment of the likely economic and other impacts before implementing any reform.”
See the Government’s Response to the Civil Justice Council’s Report: “Improving Access to Justice through Collective Actions” (2008), paras 12-13.
Lloyd
has sought to overcome this difficulty by what the Court of Appeal in this case described as “an unusual and innovative use of the representative procedure” in rule 19.6 of the Civil Procedure Rules: see [2019] EWCA Civ 1599; [2020] QB 747, para 7. This is a procedure of
very
long standing in England and Wales whereby a claim can be brought by (or against) one or more persons as representatives of others who have “the same interest” in the claim. Mr
Lloyd
accepts that he could not use this procedure to claim compensation on behalf of other iPhone users if the compensation recoverable by each user would have to be individually assessed. But he contends that such individual assessment is unnecessary. He argues that, as a matter of law, compensation can be awarded under the DPA 1998 for “loss of control” of personal data without the need to prove that the claimant suffered any financial loss or mental distress as a result of the breach. Mr
Lloyd
further argues that a “uniform sum” of damages can properly be awarded in relation to each person whose data protection rights have been infringed without the need to investigate any circumstances particular to their individual case. The amount of damages recoverable per person would be a matter for argument, but a figure of £750 was advanced in a letter of claim. Multiplied by the number of people whom Mr
Lloyd
claims to represent, this would produce an award of damages of the order of £3 billion.
Google
is a Delaware corporation, the claimant needs the court’s permission to serve the claim form on
Google
outside the jurisdiction. The application for permission has been contested by
Google
on the grounds that the claim has no real prospect of success as: (1) damages cannot be awarded under the DPA 1998 for “loss of control” of data without proof that it caused financial damage or distress; and (2) the claim in any event is not suitable to proceed as a representative action. In the High Court Warby J decided both issues in
Google’s
favour and therefore refused permission to serve the proceedings on
Google:
see [2018] EWHC 2599 (QB); [2019] 1 WLR 1265. The Court of Appeal reversed that decision, for reasons given in a judgment of the Chancellor, Sir Geoffrey
Vos,
with which Davis LJ and Dame
Victoria
Sharp agreed: [2019] EWCA Civ 1599; [2020] QB 747.
Google,
the court has received written and oral submissions from the Information Commissioner and written submissions from five further interested parties.
view
withstand scrutiny. In order to recover compensation under the DPA 1998 for any given individual, it would be necessary to show both that
Google
made some unlawful use of personal data relating to that individual and that the individual suffered some damage as a result. The claimant’s attempt to recover compensation under the Act without proving either matter in any individual case is therefore doomed to fail.
B. Factual background
Google
of what has been called the “Safari workaround” to bypass privacy settings on Apple iPhones.
versions
of Safari were set by default to block third party cookies. A “cookie” is a small block of data that is placed on a device when the user
visits
a website. A “third party cookie” is a cookie placed on the device not by the website
visited
by the user but by a third party whose content is included on that website. Third party cookies are often used to gather information about internet use, and in particular web pages
visited
over time, to enable the delivery to the user of advertisements tailored to interests inferred from the user’s browsing history.
Google
had a cookie known as the “DoubleClick Ad cookie” which could operate as a third party cookie. It would be placed on a device if the user
visited
a website that included DoubleClick Ad content. The DoubleClick Ad cookie enabled
Google
to identify
visits
by the device to any website displaying an advertisement from its
vast
advertising network and to collect considerable amounts of information. It could tell the date and time of any
visit
to a given website, how long the user spent there, which pages were
visited
for how long, and what advertisements were
viewed
for how long. In some cases, by means of the IP address of the browser, the user’s approximate geographical location could be identified.
Google
to devise and implement the Safari workaround. Its effect was to place the DoubleClick Ad cookie on an Apple device, without the user’s knowledge or consent, immediately, whenever the user
visited
a website that contained DoubleClick Ad content.
Google
was able to collect or infer information relating not only to users’ internet surfing habits and location, but also about such diverse factors as their interests and pastimes, race or ethnicity, social class, political or religious beliefs or affiliations, health, sexual interests, age, gender and financial situation.
Google
aggregated browser generated information from users displaying similar patterns, creating groups with labels such as “football lovers”, or “current affairs enthusiasts”.
Google’s
DoubleClick service then offered these group labels to subscribing advertisers to choose from when selecting the type of people at whom they wanted to target their advertisements.
C. The Legal FRAMEWORK
(1) The scheme of the DPA 1998
very
broadly to mean “obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data …”. Section 2 of the Act establishes a category of “sensitive personal data” consisting of information about certain specified matters, which include the racial or ethnic origin, political opinions, religious beliefs, physical or mental health or sexual life of the data subject.
“Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless -
(a) at least one of the conditions in Schedule 2 is met, and
(b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.”
The other seven data protection principles, in summary, require personal data: (2) to be obtained and processed only for specified and lawful purposes; (3) to be “adequate, relevant, and not excessive” in relation to those purposes; (4) to be accurate and, where necessary, kept up to date; (5) not to be kept for longer than is necessary for those purposes; (6) to be processed in accordance with the rights of data subjects under the Act; (7) to be protected by appropriate technical and organisational security measures against unauthorised or unlawful processing and against accidental loss or destruction or damage; and (8) not to be transferred outside the European Economic Area unless the destination country or territory provides an adequate level of protection for data subjects in relation to the processing of personal data.
(2) The allegations of breach of duty
Lloyd,
contends that
Google
processed personal data of each member of the represented class in breach of the first, second and seventh data protection principles. The represented class consists in essence of everyone in England and Wales who at the relevant time had an Apple iPhone on which
Google’s
DoubleClick Ad cookie was placed through the Safari workaround. (The precise definition of the class is set out at para 19 of Warby J’s judgment.) Two principal allegations made are that, in breach of the first data protection principle, (i) the data obtained by placing the DoubleClick Ad cookie on each class member’s device were not processed fairly and (ii) none of the conditions in Schedule 2 (or 3) was met.
Google
failed to comply in this case.
vital
interests of the data subject; or for the exercise of any functions of a public nature exercised in the public interest by any person. The claimant asserts that the members of the represented class whose personal data
Google
processed had not given their consent to the processing, nor was any of the other conditions capable of justifying the processing met. Hence for this reason too
Google
was in breach of the first data protection principle.
Google
on this basis in his own right which has a real prospect of success. The issue is whether he can also do so on behalf of all other iPhone users who fall within the represented class. This depends on the scope of the representative procedure available under the Civil Procedure Rules (“CPR”). Before I come to that procedure, I will mention in order to compare them the two other methods of claiming collective redress currently available in English procedural law.
D. Collective redress in English law
(1) Group Actions
value,
group actions can be an effective way of enabling what are typically several hundred or thousands of claims to be litigated and managed together, avoiding duplication of the court’s resources and allowing the claimants to benefit from sharing costs and litigation risk and by obtaining a single judgment which is binding in relation to all their claims. However, the group action procedure suffers from the drawback that it is an “opt-in” regime: in other words, claimants must take active steps to join the group. This has an administrative cost, as a solicitor conducting the litigation has to obtain sufficient information from a potential claimant to determine whether he or she is eligible to be added to the group register, give appropriate advice and enter into a retainer with the client. For claims which individually are only worth a few hundred pounds, this process is not economic as the initial costs alone may easily exceed the potential
value
of the claim.
value
of each individual claim relatively small. For example, a group action was recently brought against the Morrisons supermarket chain for compensation for breach of the DPA 1998 arising from the disclosure on the internet by a Morrisons’ employee of personal data relating to other employees. Of around 100,000 affected employees, fewer than 10,000 opted to join the group action: see
Various
Claimants
v
Wm Morrisons Supermarkets plc [2017] EWHC 3113 (QB); [2019] QB 772 (reversed on the issue of
vicarious
liability by the Supreme Court: [2020] UKSC 12; [2020] AC 989). During the period of more than 12 years in which collective proceedings under the Competition Act 1998 (discussed below) could be brought only on an opt-in basis just one action was commenced, based on a finding of price fixing in the sale of replica football shirts. Although around 1.2 - 1.5m people were affected, despite widespread publicity only 130 people opted into the proceedings: see The Consumers' Association
v
JJB Sports Plc [2009] CAT 2, para 5; Civil Justice Council Report “Improving Access to Justice through Collective Actions” (2008), Part 6, para 22; and Grave D, McIntosh M and Rowan G (eds), Class Actions in England and Wales, 1st ed (2018), para 1-068.
“Whichever approach is adopted, many class members are likely to fail to take any positive action for a range of reasons that have nothing at all to do with an assessment of whether or not it is in their interests to participate in the proceedings. Some class members will not receive the relevant notice. Others will not understand the notice, or will have difficulty understanding what action they are required to take and completing any relevant form, or will be unsure or hesitant about what to do and will do nothing. Even where a class member considers that it is in their interests to participate in the proceedings, the significance of inertia in human affairs should not be underestimated.”
Ross
v
Southern Response Earthquake Services Ltd [2019] NZCA 431, para 98; approved by the New Zealand Supreme Court at [2020] NZSC 126, para 40.
very
large sum of money, is the need to prove the quantum of loss in each individual case. Not only are eligible individuals less likely to opt into the proceedings where the potential gain to them is small, but the costs of obtaining evidence from each individual to support their claim is again likely to make group litigation uneconomic in such cases.
(2) Collective Proceedings
value
of each individual claim is small. Section 47B of the Competition Act 1998 (added by the Enterprise Act 2002 and as amended by the Consumer Rights Act 2015) makes provision for bringing “collective proceedings” in the Competition Appeal Tribunal (“CAT”) combining two or more claims to which section 47A applies (essentially, claims in respect of an infringement or alleged infringement of competition law). Such proceedings must be commenced by a person who proposes to be the representative of a specified class of persons, and the proceedings may only be continued if they are certified by the CAT as satisfying criteria set out in section 47B and in the CAT Rules. Two features of this regime may be noted.
viewed
as a whole. This is the effect of section 47C(2) of the Competition Act, which provides:
“The tribunal may make an award of damages in collective proceedings without undertaking an assessment of the amount of damages recoverable in respect of the claim of each represented person.”
Such an award of damages is referred to in the CAT Rules as “an aggregate award of damages”: see rule 73(2).
v
Mastercard [2020] UKSC 51; [2021] Bus LR 25, at para 76, section 47C(2) of the Competition Act “radically alters the established common law compensatory principle by removing the requirement to assess individual loss”. This is so for the purposes both of making and of paying out an aggregate award of damages. How an aggregate award of damages is distributed among the members of the class is subject to the control of the CAT and, as this court held in Merricks
v
Mastercard, the only requirement is that the distribution should be just: see paras 76-77, 149. No doubt in many cases a just method of distribution will be one which divides up an aggregate award of damages in a way which takes account of individual loss. But particularly where the size of the class is large and the amount of damages awarded small considered on a per capita basis, it may be impractical or disproportionate to adopt such a method. In such cases some other method of distribution, such as an equal division among all the members of the class, may be justified.
(3) Representative Actions
version
of the representative rule is CPR rule 19.6, which states:
“(1) Where more than one person has the same interest in a claim -
(a) the claim may be begun; or
(b) the court may order that the claim be continued,
by or against one or more of the persons who have the same interest as representatives of any other persons who have that interest.
(2) The court may direct that a person may not act as a representative.
(3) Any party may apply to the court for an order under paragraph (2).
(4) Unless the court otherwise directs any judgment or order given in a claim in which a party is acting as a representative under this rule -
(a) is binding on all persons represented in the claim; but
(b) may only be enforced by or against a person who is not a party to the claim with the permission of the court.”
(a) Origins of the rule
v
New River Co (1805) 11
Ves
Jr 429; 32 ER 1153; Cockburn
v
Thompson (1809) 16
Ves
Jr 321; 33 ER 1005. However, to join all interested persons as parties was not always practically convenient - particularly if they were
very
numerous. The solution devised was not to abandon the aim of settling the rights of all interested persons in a single proceeding; rather, it was to relax the “complete joinder rule” by allowing one or more claimants or defendants to represent all others who had the same interest as them: see Sorabji J, “The hidden class action in English civil procedure” (2009) 28 CJQ 498. All persons represented in this way, as well as the parties actually before the court, were bound by the court’s decision.
very
early cases in the 16th and 17th centuries in which this procedure was adopted, the persons represented were invariably a cohesive communal group, such as parishioners or manorial tenants, whose members had agreed to be represented; and the representatives were often required to show proof of their authority to represent the group. But as the nature of society changed and new, more impersonal institutions such as friendly societies and joint stock companies with multiple investors emerged, this requirement was dropped. The court allowed persons to be represented whether or not they had consented to such representation or even knew of the action, relying on community of interest among the members of the group to ensure that the interests of all were adequately protected: see Yeazell, “From Group Litigation to Class Action, Part I: The Industrialization of Group Litigation” (1980) 27 UCLA Law Review 514.
v
May (1722) Precedents in Chancery 592; 24 ER 265, the treasurer and manager of a brass-works brought an action on behalf of themselves and all other proprietors of the undertaking, of whom there were 800 in total, except for the defendants, who were its former managers, to call the defendants to account for alleged mismanagement and embezzlement. The defendants objected that the claim should not be allowed to proceed as the rest of the proprietors had not been made parties. The court dismissed that objection on the grounds that, first, the action had been brought on behalf of all the other proprietors, so that “all the rest were in effect parties”, and secondly:
“Because it would be impracticable to make them all parties by name, and there would be continual abatements by death and otherwise, and no coming at justice, if all were to be made parties.”
v
Maltby (1818) 2 Swanston 277; 36 ER 621. In this case the treasurer and directors of the company were sued as representative defendants on a contract made on behalf of all the members of the company to grant a lease. In rejecting an argument that the claim was defective because not all the proprietors were before the court, Plumer MR explained, at pp 281-282:
“The general rule, which requires the plaintiff to bring before the court all the parties interested in the subject in question, admits of exceptions. The liberality of this court has long held that there is of necessity an exception to the general rule, when a failure of justice would ensue from its enforcement.”
After citing numerous authorities, he concluded, at p 284:
“Here is a current of authority, adopting more or less a general principle of exception, by which the rule, that all persons interested must be parties, yields when justice requires it, in the instance either of plaintiffs or defendants. … It is quite clear that the present suit has sufficient parties, and that the defendants may be considered as representing the company.”
v
Ellis [1901] AC 1, 8, Lord Macnaghten summarised the practice of the Court of Chancery in this way:
“The old rule in the Court of Chancery was
very
simple and perfectly well understood. Under the old practice the Court required the presence of all parties interested in the matter in suit, in order that a final end might be made of the controversy. But when the parties were so numerous that you never could ‘come at justice’, to use an expression in one of the older cases, if everybody interested was made a party, the rule was not allowed to stand in the way. It was originally a rule of convenience: for the sake of convenience it was relaxed. Given a common interest and a common grievance, a representative suit was in order if the relief sought was in its nature beneficial to all whom the plaintiff proposed to represent.”
(b) Effect of the Judicature Act
vested
in the new High Court of Justice. Rules of procedure for the High Court were scheduled to the Act, which included as rule 10:
“Where there are numerous parties having the same interest in one action, one or more of such parties may sue or be sued, or may be authorised by the court to defend in such action, on behalf or for the benefit of all parties so interested.”
This rule became Order 16, rule 9 of the Rules of the Supreme Court and has remained in force in the same or similar form ever since. Save that the requirement for “numerous parties” has been reduced to “more than one”, there is no significant difference in the current
version
of the rule, quoted at para 33 above.
v
Russell [1893] 1 QB 435, 438, Lindley LJ, who gave the judgment of the Court of Appeal, expressed the
view
that the rule only applied to “persons who have or claim some beneficial proprietary right” which they are asserting or defending in an action that would have come within the jurisdiction of the old Court of Chancery; hence the rule did not apply to a claim for damages in tort. That
view,
however, was repudiated by the House of Lords in Duke of Bedford
v
Ellis [1901] AC 1. Six individuals sued the Duke of Bedford, who owned Covent Garden Market, on behalf of themselves and all other growers of fruit, flowers,
vegetables,
roots and herbs, to enforce certain preferential rights claimed under the Covent Garden Market Act 1828 to stands in the market. They sought declarations of the rights of the growers and an injunction to restrain the Duke from acting inconsistently with those rights. They also claimed - though only for themselves and not on behalf of other growers - an account and repayment of sums charged to them for selling at the market in excess of what they would have paid if afforded their alleged preferential rights. The Duke applied to have the action stayed either on the ground that the claimants had no beneficial proprietary right, or on the ground that the joinder in one action of parties claiming separate and different rights under the Act, both personally and as representing a class, would embarrass or delay the trial. The House of Lords rejected both grounds (the first unanimously and the second by a majority of 3 to 2) and held that the action could be maintained.
view
of the representative rule expressed in Temperton
v
Russell and confirmed that its purpose was simply to apply the practice of the Court of Chancery to all divisions of the High Court. The only change was therefore that the rule was now applicable in actions which, before the Judicature Act, could only have been brought in a court of common law. He said, at pp 10-11, that:
“… in all other respects I think the rule as to representative suits remains
very
much as it was a hundred years ago. From the time it was first established it has been recognised as a simple rule resting merely upon convenience. It is impossible, I think, to read such judgments as those delivered by Lord Eldon in Adair
v
New River Co, in 1805, and in Cockburn
v
Thompson, in 1809, without seeing that Lord Eldon took as broad and liberal a
view
on this subject as anybody could desire. ‘The strict rule’, he said, ‘was that all persons materially interested in the subject of the suit, however numerous, ought to be parties … but that being a general rule established for the convenient administration of justice must not be adhered to in cases to which consistently with practical convenience it is incapable of application’. ‘It was better’, he added, ‘to go as far as possible towards justice than to deny it altogether’. He laid out of consideration the case of persons suing on behalf of themselves and all others, ‘for in a sense’, he said, ‘they are before the Court’. As regards defendants, if you cannot make everybody interested a party, you must bring so many that it can be said they will fairly and honestly try the right. I do not think, my Lords, that we have advanced much beyond that in the last hundred years …”
As Megarry J commented in John
v
Rees [1970] Ch 345, 370, this explanation made it plain that the representative rule is to be treated as being “not a rigid matter of principle but a flexible tool of convenience in the administration of justice”.
Vale
Railway Co
v
Amalgamated Society of Railway Servants [1901] AC 426, 443, Lord Lindley (as he had become) went out of his way to endorse this
view
and to retract his earlier observations in Temperton
v
Russell, stating:
“The principle on which the rule is based forbids its restriction to cases for which an exact precedent can be found in the reports. The principle is as applicable to new cases as to old, and ought to be applied to the exigencies of modern life as occasion requires. The rule itself has been embodied and made applicable to the
various
Divisions of the High Court by the Judicature Act, 1873, sections 16 and 23-25, and Order XVI, rule 9; and the unfortunate observations made on that rule in Temperton
v
Russell have been happily corrected in this House in the Duke of Bedford
v
Ellis and in the course of the argument in the present case.”
(c) Markt and declarations of rights
v
Knight Steamship Co Ltd [1910] 2 KB 1021 has sometimes been seen as undermining the broad and flexible
view
of the representative rule adumbrated by the House of Lords in these two cases by imposing significant constraints on its use: see eg Esanda Finance Corpn Ltd
v
Carnie (1992) 29 NSWLR 382, 395; Mulheron R, The Class Action in Common Law Legal Systems (2004) pp 78-82; Sorabji J, “The hidden class action in English civil procedure” (2009) 28 CJQ 498. I do not think, however, that the decision should be understood in this way. Markt was heard together with another action also brought against the owners of a cargo
vessel
which was intercepted by a Russian cruiser on a
voyage
to Japan during the Russo-Japanese war, on suspicion of carrying contraband of war, and sunk. Just before the limitation period expired, two cargo-owners issued writs “on behalf of themselves and others owners of cargo lately laden on board” the
vessel,
claiming “damages for breach of contract and duty in and about the carriage of goods by sea”. No further particulars of the claims were given.
Vaughan
Williams LJ, at p 1032, rejected it on the grounds that the proposed amendment had not been brought before the court in a way which gave a proper opportunity for argument and doubted anyway whether the amendment could be so framed as to disclose a common purpose of the shippers or any class of the shippers. Fletcher Moulton LJ, at p 1042, considered that making a declaration of the type suggested would be contrary to the practice of the courts and that subsequent claims by individual cargo-owners relying on such a declaration to recover damages would constitute new claims which would be time-barred, as the limitation period had now expired.
v
Hannay & Co [1915] 2 KB 536, which held that a declaration can be granted at the instance of a claimant even if the claimant has no cause of action against the defendant. Two cases decided together by the Court of Appeal in 1921 showed that there is no reason in principle why a claim for a declaration of the kind suggested by Buckley LJ in Markt cannot be brought as a representative action. In David Jones
v
Cory Bros & Co Ltd (1921) 56 LJ 302; 152 LT Jo 70, five individuals sued on their own behalf and on behalf of all other underground and surface workmen employed at the defendant’s colliery on three specified days in September 1919. They alleged that on those three days the safety lamps in use at the colliery were not in accordance with statutory requirements, were insufficient in number and were not properly examined; and that in consequence the workmen justifiably refused to go to work and lost the wages they would otherwise have earned and were entitled to damages. In Thomas
v
Great Mountain Collieries Co, which was heard at the same time, two claimants sued the owner of another colliery for loss of wages, alleging breach of statutory duty in not having a weighing machine to weigh coal as near the pit mouth as was reasonably practicable. The workmen were divided into two classes - one comprising all workmen whose wages depended on the amount of coal gotten and the other comprising all other underground and surface workmen. The claimants sued on their own behalf and on behalf of the class they respectively represented.
v
Newman Industries Ltd [1981] Ch 229 the claimant brought a derivative action as a minority shareholder of the first defendant company claiming damages on behalf of the company against two of its directors for breach of duty and conspiracy. At the start of the hearing the claimant applied to amend its statement of claim to add a personal claim against the directors and the company, brought in a representative capacity on behalf of all the shareholders. The relief sought was a declaration that those shareholders who had suffered loss as a result of the alleged conspiracy were entitled to damages. The judge (
Vinelott
J) allowed the amendment. He distinguished Markt and followed David Jones
v
Cory Bros in holding that a representative claim for a declaration could be pursued notwithstanding that each member of the class of persons represented had a separate cause of action. Although the personal claim was later held by the Court of Appeal in Prudential Assurance Co Ltd
v
Newman Industries Ltd (No 2) [1981] Ch 204 at 222 to be misconceived as a matter of substantive law, the Court of Appeal cast no doubt on the use of the representative procedure.
(d) Claims for damages
view,
at pp 1035 and 1040-1041, that damages are “a personal relief” and that:
“no representative action can lie where the sole relief sought is damages, because they have to be proved separately in the case of each plaintiff, and therefore the possibility of representation ceases.”
Lloyd’s
syndicates, which are not separate legal entities, it is standard practice for a single member of the syndicate (usually the leading underwriter) to be named as a representative claimant or defendant suing, or being sued, for themselves and all the other members. There is no difficulty in awarding damages for or against the representative in such proceedings, as the calculation of any damages which the members of the syndicate are collectively entitled to recover or liable to pay does not depend on how the risk is divided among the members of the syndicate.
v
Pine Top Insurance Co Ltd [1989] 1
Lloyd’s
Rep 568 the claimant companies sued on behalf of themselves and members of a syndicate which had reinsured on a quota share basis a proportion of the risks they had underwritten, claiming under contracts which provided excess of loss reinsurance cover for the claimants and their quota share reinsurers. The Court of Appeal rejected an argument that the claimants were not entitled to sue in a representative capacity. It made no difference that there was a dispute between one of the claimants and some members of the syndicate about the
validity
of the quota share reinsurance, since as
Lloyd
LJ said, at p 571: “the question is whether the parties have the same interest as against the defendants; not whether they have the same interest as between themselves”.
v
Commercial Union Assurance Co plc (The “Irish Rowan”) [1991] 2 QB 206 numerous insurers had subscribed in
various
proportions to a policy of marine insurance. The Court of Appeal accepted that, as a matter of law, each subscription constituted a separate contract of insurance (of which there were said to be 77 in all). Claims for losses allegedly covered by the policy were made by suing two of the insurers as representative defendants. The Court of Appeal rejected an argument that claims for debt or damages could not be included in a representative action, merely because they are made by numerous claimants individually or resisted by numerous defendants individually, and held that the action could continue as a representative action. While the policy terms contained a broadly worded leading underwriter clause, the presence of this clause was not essential to the decision: see Bank of America National Trust and Savings Association
v
Taylor (The Kyriaki) [1992] 1
Lloyd’s
Rep 484, 493-494; National Bank of Greece SA
v
Outhwaite [2001] CLC 591, para 31.
v
Riley [1981] 1 WLR 923, and in Independiente Ltd
v
Music Trading On-Line (HK) Ltd [2003] EWHC 470 (Ch), the claimants sued in a representative capacity on behalf of all members of the British Phonographic Industry Ltd (“BPI”), a trade association for the recorded music industry (and also in the latter case on behalf of Phonographic Performance Ltd), claiming damages for breach of copyright in selling pirated sound recordings. In each case the claims were allowed to proceed as representative actions. Because it was accepted or could safely be assumed that the owner of the copyright in any pirated recording was a member of the represented class, this procedure enabled breach of copyright to be proved and damages to be awarded without the need to prove which particular pirated recordings had been sold in what quantities. Again, what mattered was that the members of the class had a community of interest in suing the defendant.
V-C
found that there was no binding agreement that any money recovered should go to the BPI: see [2003] EWHC 470 (Ch), paras 16 and 28. He nevertheless held, at paras 28 and 39, that the claim was properly brought as a representative action, observing that what the claimants did with any damages recovered was a matter for them or between them, the BPI and the class members, and not between them and the defendants.
v
Queen’s College Oxford (No 4) (1871) LR 6 Ch App 716, 726, where Lord Hatherley LC gave an example of:
“classes of shareholders in a railway company who have different rights inter se, but they may all have a common enemy in the shape of a fraudulent director, and they may all join, of course, in one common suit against that director, although after the common right is established they may have a considerable litigation among themselves as to who are the persons entitled to the gains obtained through that suit.”
While the right enforced in such a common suit would in modern company law be seen as a right belonging to the company itself, rather than its shareholders, it is clear from the context that Lord Hatherley had in mind a representative action brought on behalf of shareholders, as he gave this analogy to explain how in that case a representative claim could be brought on behalf of all the freehold tenants of a manor to establish common rights against the lord of the manor even though different tenants or classes of tenant had different rights as between themselves.
(e) Emerald Supplies
v
British Airways plc [2010] EWCA Civ 1284; [2011] Ch 345 as providing the latest authoritative interpretation of the representative rule. The decision in that case turned, however, on the particular way in which the class of represented persons had been defined. The claimants alleged that the defendant airline was a party to agreements or concerted practices with other airlines to fix prices for air freight charged for importing cut flowers into the UK. They claimed on behalf of all “direct or indirect purchasers of air freight services, the prices for which were inflated by the agreements or concerted practices”, a declaration that damages were recoverable in principle from the defendant by those purchasers. The Court of Appeal upheld a decision to strike out the representative claim on the basis that, in the way the class had been defined, the issue of liability would have to be decided before it could be known whether or not a person was a member of the represented class and therefore bound by the judgment: see paras 62-63 and 65. Such an approach would not be just, not least because, if the claim failed, no purchasers of air freight services apart from the named claimants would be bound by the result.
v
Barr Ltd [2014] EWHC 3968 (TCC); [2015] 1 WLR 3663 - a case relied on by
Google
on this appeal - was therefore wrong to conclude from Emerald Supplies, at para 90, that “if damage is an ingredient of the cause of action a representative claim could not be maintained”. The Court of Appeal in Emerald Supplies did not doubt the correctness of the Prudential decision, where a representative claim was allowed to proceed although damage was an ingredient of the cause of action. As Professor Rachael Mulheron, a leading expert in this field, has persuasively argued, it should likewise have been possible in Emerald Supplies to adopt a bifurcated process in which the questions whether prices had been inflated by agreements or concerted practices and whether passing on was in principle available as a defence were decided in a representative action. If successful, this action could then have formed the basis for further proceedings to prove the fact and amount of damage in individual cases: see Mulheron R, “Emerald Supplies Ltd
v
British Airways plc; A Century Later, The Ghost of Markt Lives On” [2009] Comp Law 159, 171.
(f) Commonwealth cases
(i) Australia
v
Esanda Finance Corpn Ltd (1995) 127 ALR 76 the High Court of Australia held that the fact that the claims arose under separate contracts did not prevent the named claimants and the persons represented from having “the same interest” in proceedings. It was enough to satisfy this requirement that there was a community of interest in the determination of a substantial question of law or fact that arose in the proceedings. Commenting on an argument that the representative rule was an inadequate basis for a “class action”, which required a comprehensive legislative regime, Toohey and Gaudron JJ (with whom Mason CJ, Deane and Dawson JJ generally agreed) said, at p 91:
“... it is true that rule 13 lacks the detail of some other rules of court. But there is no reason to think that the Supreme Court of New South Wales lacks the authority to give directions as to such matters as service, notice and the conduct of proceedings which would enable it to monitor and finally to determine the action with justice to all concerned. The simplicity of the rule is also one of its strengths, allowing it to be treated as a flexible rule of convenience in the administration of justice and applied ‘to the exigencies of modern life as occasion requires’. The court retains the power to reshape proceedings at a later stage if they become impossibly complex or the defendant is prejudiced.”
(ii) Canada
v
Dutton [2001] 2 SCR 534, paras 38-48, the Supreme Court of Canada held that representative actions should be allowed to proceed where the following conditions are met: (1) the class is capable of clear definition; (2) there are issues of fact or law common to all class members; (3) success for one class member means success for all (although not necessarily to the same extent); and (4) the proposed representative adequately represents the interests of the class. If these conditions are met the court must also be satisfied, in the exercise of its discretion, that there are no countervailing considerations that outweigh the benefits of allowing the representative action to proceed. The Supreme Court held that the conditions were met by the claimants in Dutton, who sued as representatives of a group of investors complaining that the defendant had breached fiduciary duties to the investors by mismanaging their funds.
v
Naken [1983] 1 SCR 72, where a representative action had been disallowed. In Naken the action was brought on behalf of purchasers of new Firenza motor
vehicles
against the manufacturer, complaining that the quality of the
vehicles
had been misrepresented or was not as warranted in advertisements, other published materials and contracts which were partly oral and partly written. Damages were claimed limited to $1,000 per person. The claims were held to be unsuitable for resolution through a representative action, principally because determining both liability and damages would have required particularised evidence and fact-finding in relation to each individual purchaser.
void”.
(iii) New Zealand
v
Ross [2020] NZSC 126. This was a representative action brought on behalf of some 3,000 policyholders who had settled insurance claims for damage to their homes caused by earthquakes in the Canterbury region of New Zealand. The claimants alleged that the policyholders had been misled by the insurers about the cost of remedying the damage, with the result that they had settled their claims on a less favourable basis than otherwise would have been the case. The insurers did not oppose the action being brought on a representative basis, but argued that the class represented should be limited to policyholders who completed a form electing to opt into the proceedings. It was agreed that the proceedings would need to be heard in two stages. The first stage would deal with issues common to all members of the represented class. If the claimants succeeded at that stage in whole or in part, there would need to be a second stage, in which questions of relief were addressed. It was also agreed that, at the second stage, it would be necessary for all of the policyholders represented to take active steps - that is, to opt in - if they wished to establish their individual claims.
various
matters relating to supervision of opt out representative proceedings.
(g) Principles governing use of the representative procedure
vastly
bigger in scale. The mass production of goods and mass provision of services have had the result that, when legally culpable conduct occurs, a
very
large group of people, sometimes numbering in the millions, may be affected. As the present case illustrates, the development of digital technologies has added to the potential for mass harm for which legal redress may be sought. In such cases it is necessary to reconcile, on the one hand, the inconvenience or complete impracticality of litigating multiple individual claims with, on the other hand, the inconvenience or complete impracticality of making every prospective claimant (or defendant) a party to a single claim. The only practical way to “come at justice” is to combine the claims in a single proceeding and allow one or more persons to represent all others who share the same interest in the outcome. When trying all the individual claims is not feasible, the adages of Lord Eldon quoted by Lord Macnaghten in Ellis remain as pertinent as ever: that it is better to go as far as possible towards justice than to deny it altogether and that, if you cannot realistically make everybody interested a party, you should ensure that those who are parties will “fairly and honestly try the right”.
view
expressed in Carnie that the
very
simplicity of the representative rule is in some respects a strength, allowing it to be treated as “a flexible tool of convenience in the administration of justice” and “applied to the exigencies of modern life as occasion requires”.
(i) The “same interest” requirement
v
Cardiff Corpn [1954] 1 QB 210. Such an approach seems to me misguided. It is clear from the context that Lord Macnaghten was not attempting to define “the same interest”, but to convey how limiting the rule to persons having a beneficial proprietary interest in the claim would be contrary to the old practice in the Court of Chancery. More profoundly, such a reading of Lord Macnaghten’s speech shows precisely the rigidity of approach to the application of the representative rule which he disparaged.
valuable
book on civil procedure, however, a distinction needs to be drawn between cases where there are conflicting interests between class members and cases where there are merely divergent interests, in that an issue arises or may well arise in relation to the claims of (or against) some class members but not others. So long as advancing the case of class members affected by the issue would not prejudice the position of others, there is no reason in principle why all should not be represented by the same person: see Zuckerman on Civil Procedure: Principles of Practice, 4th ed (2021), para 13.49. As Professor Zuckerman also points out, concerns which may once have existed about whether the representative party could be relied on to pursue
vigorously
lines of argument not directly applicable to their individual case are misplaced in the modern context, where the reality is that proceedings brought to seek collective redress are not normally conducted and controlled by the nominated representative, but rather are typically driven and funded by lawyers or commercial litigation funders with the representative party merely acting as a figurehead. In these circumstances, there is no reason why a representative party cannot properly represent the interests of all members of the class, provided there is no true conflict of interest between them.
(ii) The court’s discretion
(iii) No requirement of consent
(iv) The class definition
v
Ellis, for example, it did not matter that the number and identities of growers of fruit etc would have been difficult if not impossible to ascertain or that the class was a fluctuating one: given that the aim was to establish whether anyone who was a grower had preferential rights, all that mattered was that there would be no real difficulty in determining whether a particular person who claimed a preferential right to a
vacant
stand at Covent Garden was a grower or not: see [1901] AC 1 at 11. In some cases, however, for example where the
viability
of a claim for damages depends on demonstrating the size of the class or who its members are, such practical difficulties might well be significant.
(
v)
Liability for costs
v
Money [2020] EWCA Civ 246; [2020] 1 WLR 1751. That principle is no less applicable where the proceedings financed are a representative action.
(
vi)
The scope for claiming damages
vehicle
for such an exercise.
Vinelott
J expressed the
view
(obiter) that time would continue to run for the purpose of limitation until individual claims for damages were brought by the persons represented; see also the dicta of Fletcher Moulton LJ in Markt [1910] 2 KB 1021, 1042, referred to at para 44 above. The court in Prudential did not have cited to it, however, the decision of the Court of Appeal in Moon
v
Atherton [1972] 2 QB 435. In that case a represented person applied to be substituted for the named claimant after the limitation period had expired when the claimant (and all the other represented persons) no longer wished to continue the action. The Court of Appeal, in allowing the substitution, held that the defendant was not thereby deprived of a limitation defence, as for the purpose of limitation the represented person was already a party to the action, albeit not a “full” party. It might be clearer to say that, although the represented person did not become a “party” until substituted as the claimant, an action was brought within the meaning of the statute of limitation by that person when the representative claim was initiated. Such an analysis has been adopted in Australia, including by the New South Wales Court of Appeal in Fostif Pty Ltd
v
Campbells Cash & Carry Pty Ltd [2005] NSWCA 83; (2005) 63 NSWLR 203, and by the New Zealand Supreme Court in Credit Suisse Private Equity
v
Houghton [2014] NZSC 37.
value
by the same amount. In such cases the defendant’s monetary liability could be determined as a common issue and no individualised assessment would be needed. The same is true where loss suffered by the class as a whole can be calculated without reference to the losses suffered by individual class members - as in the cases mentioned at para 53 above. Such an assessment of loss on a global basis is sometimes described as a “top down” approach, in contrast to a “bottom up” approach of assessing a sum which each member of the class is individually entitled to recover.
V-C
was untroubled by such problems, questions of considerable difficulty would arise if in the present case the claimant was awarded damages in a representative capacity with regard to how such damages should be distributed, including whether there would be any legal basis for paying part of the damages to the litigation funders without the consent of each individual entitled to them: see Mulheron R, “Creating and Distributing Common Funds under the English Representative Rule” (2021) King’s Law Journal 1-33.
Google
has not relied on such difficulties as a reason for disallowing a representative action, however, and as these matters were only touched on in argument, I will say no more about them.
E. The representative claim in this case
Google
was in breach of the DPA 1998 and, if so, seeking a declaration that any member of the represented class who has suffered damage by reason of the breach is entitled to be paid compensation. The individual claims that could theoretically have been brought by each iPhone user who was affected by the Safari workaround clearly raise common issues; and it is not suggested that there is any conflict of interest among the members of the represented class. For the purpose of CPR rule 19.6(1), all would therefore have the same interest in such a claim as the representative claimant. There is no suggestion that Mr
Lloyd
is an unsuitable person to act in that capacity. Although
Google
has argued that there would be practical difficulties in identifying whether an individual falls within the class definition, even on
Google’s
evidence it is evident that the number of people affected by the Safari workaround was extremely large and it is unclear at this stage of the litigation how serious the difficulties of proof would actually be. Moreover, even if only a few individuals were ultimately able to obtain compensation on the basis of a declaratory judgment, I cannot see why that should provide a reason for refusing to allow a representative claim to proceed for the purpose of establishing liability.
(1) The formulation of the claim for damages
“… some affected individuals were ‘super users’ - heavy internet users. They will have been ‘
victims’
of multiple breaches, with considerable amounts of [browser generated information] taken and used throughout the Relevant Period. Others will have engaged in
very
little internet activity. Different individuals will have had different kinds of information taken and used. No fewer than 17 categories of personal data are identified in the claim documents. The specified categories of data
vary
in their sensitivity, some of them being ‘sensitive personal data’ within the meaning of the section 2 of the DPA (such as sexuality, or ethnicity). … But it is not credible that all the specified categories of data were obtained by
Google
from each represented claimant. … The results of the acquisition and use will also have
varied
according to the individual, and their attitudes towards the acquisition, disclosure and use of the information in question.”
If liability is established, the ordinary application of the compensatory principle would therefore result in different awards of compensation to different individuals. Furthermore, the amount of any compensation recoverable by any member of the class would depend on a
variety
of circumstances particular to that individual. Individualised assessment of damages would therefore be required.
“(a) The lack of consent or knowledge of the Representative Claimant and each member of the Claimant Class to the defendant’s collection and use of their personal data.
(b) The fact that such collection and use was contrary to the defendant’s public statements.
(c) The fact that such collection and use was greatly to the commercial benefit of the defendant.
(d) The fact that the defendant knew or ought to have known of the operation of the Safari Workaround from a
very
early stage during the Relevant Period. …”
I interpose that factor (c), although no doubt true in relation to the class as a whole, plainly could not in fact be established in relation to any individual class member without evidence of what use, if any, was actually made of personal data of that individual by
Google.
If there is to be no individualised assessment, this factor must therefore be left out of account.
Google
from the duties which it breached. Again, it is contended that such damages should be assessed on a uniform per capita basis, “reflecting the generalised standard terms (rather than individuated basis) on which [
Google]
does business”.
(2) Section 13 of the DPA 1998
“(1) An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.
(2) An individual who suffers distress by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that distress if -
(a) the individual also suffers damage by reason of the contravention, or
(b) the contravention relates to the processing of personal data for the special purposes.
(3) In proceedings brought against a person by
virtue
of this section it is a defence to prove that he had taken such care as in all the circumstances was reasonably required to comply with the requirement concerned.”
“1. Member states shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered.
2. The controller may be exempted from this liability, in whole or in part, if he proves that he is not responsible for the event giving rise to the damage.”
v
Secretary of State for the Home Department [2006] UKHL 17; [2006] 2 AC 395, para 7. Adopting this terminology, on a straightforward interpretation the term “damage” in section 13 refers only to material damage and compensation can only be recovered for distress if either of the two conditions set out in subsection (2) is met.
(3)
Vidal-Hall
v
Google
Inc
Vidal-Hall
v
Google
Inc [2016] QB 1003 on facts which, in terms of the generic allegations made, were identical to those on which the present claim is based. The three claimants sought damages arising out of the Safari workaround on two alternative bases: (1) at common law for misuse of private information; and (2) under section 13 of the DPA 1998. As in the present case, permission to serve the proceedings outside the jurisdiction was opposed by
Google.
The main issues raised were: (1) whether misuse of private information is a tort for the purpose of the rules providing for service out of the jurisdiction; and (2) whether compensation can be recovered for distress under section 13 of the DPA 1998 in the absence of financial loss. The judge decided both issues in the claimants’ favour and the Court of Appeal affirmed that decision, for reasons given in a judgment written by Lord Dyson MR and Sharp LJ, with which Macfarlane LJ agreed.
Google
submitted that, as discussed above, the term “damage” in section 13 must mean material damage, which for practical purposes limits its scope to financial loss. Hence section 13(2) has the effect that an individual may only recover compensation for distress suffered by reason of a contravention by a data controller of a requirement of the Act if either (a) the contravention also causes the individual to suffer financial loss or (b) the contravention relates to the processing of personal data for “special purposes” - which are defined as journalistic, artistic or literary purposes (see section 3). It was not alleged that either of those conditions was satisfied in the
Vidal-Hall
case.
veryone
has the right to respect for his or her private and family life, home and communications”. Article 8(1) provides that “[e]
veryone
has the right to the protection of personal data concerning him or her”. In addition, article 47 requires that “[e]
veryone
whose rights and freedoms guaranteed by the law of the Union are
violated
has the right to an effective remedy before a tribunal …”. The Court of Appeal decided that, in order to provide an effective remedy for the rights guaranteed by articles 7 and 8 of the EU Charter, it was necessary that national law should give effect to the obligation under article 23 of the Data Protection Directive to provide a right to receive compensation from the data controller for any damage, including distress, suffered as a result of an unlawful processing operation. That result could and should be achieved by disapplying section 13(2) of the DPA 1998, thus enabling section 13(1) to be interpreted compatibly with article 23: see [2016] QB 1003, para 105.
(4) Misuse of private information
Vidal-Hall
also held that the claims for damages for misuse of private information made by the claimants in that case were properly classified as claims in tort for the purpose of service out of the jurisdiction and had a real prospect of success. As described at paras 18-25 of the judgment, the tort of misuse of private information evolved out of the equitable action for breach of confidence, influenced by the protection of the right to respect for private life guaranteed by article 8 of the Convention. The critical step in its emergence as a distinct basis for a claim was the identification of privacy of information as worthy of protection in its own right, irrespective of whether the information was imparted in circumstances which give rise to a duty of confidence: see Campbell
v
MGN Ltd [2004] UKHL 22; [2004] 2 AC 457. As Lord Hoffmann put it in Campbell, at para 50:
“What human rights law has done is to identify private information as something worth protecting as an aspect of human autonomy and dignity.”
v
News Group Newspapers Ltd [2016] UKSC 26; [2016] AC 1081, paras 58-60. It is misuse of information, however, which is primarily relevant in this case, and I shall generally - as counsel did in argument - use the label for the tort of “misuse of private information”.
v
Express Newspapers plc [2008] EWCA Civ 446; [2009] Ch 481, para 36:
“… the question whether there is a reasonable expectation of privacy is a broad one, which takes account of all the circumstances of the case. They include the attributes of the claimant, the nature of the activity in which the claimant was engaged, the place at which it was happening, the nature and purpose of the intrusion, the absence of consent and whether it was known or could be inferred, the effect on the claimant and the circumstances in which and the purposes for which the information came into the hands of the publisher.”
If this test is met, in cases where freedom of expression is involved the court must then undertake a “balancing exercise” to decide whether in all the circumstances the interests of the owner of the private information must yield to the right to freedom of expression conferred on the publisher by article 10 of the Convention: see eg McKennitt
v
Ash [2006] EWCA Civ 1714; [2008] QB 73, para 9.
(5) Gulati
v
MGN Ltd
v
MGN Ltd [2015] EWHC 1482 (Ch); [2016] FSR 12 and [2015] EWCA Civ 1291; [2017] QB 149 by Mann J and by the Court of Appeal. The eight test claimants in that case were individuals in the public eye whose mobile phones were hacked by newspapers, leading in some instances to the publication of articles containing information obtained by this means. The newspapers admitted liability for breach of privacy but disputed the amount of damages. Their main argument of principle was that (in the absence of material damage) all that could be compensated for was distress caused by their unlawful activities: see [2016] FSR 12, para 108. The judge rejected that argument. He said, at para 111, that he did not see why “distress (or some similar emotion), which would admittedly be a likely consequence of an invasion of privacy, should be the only touchstone for damages”. In his
view:
“While the law is used to awarding damages for injured feelings, there is no reason in principle … why it should not also make an award to reflect infringements of the right itself, if the situation warrants it.”
very
young children (only ten months or one year old) for misuse of private information by publishing photographs of them even though, because of their age, they could not have suffered any distress: see AAA
v
Associated Newspapers Ltd [2012] EWHC 2103 (QB); [2013] EMLR 2; and Weller
v
Associated Newspapers Ltd [2014] EWHC 1163 (QB); [2014] EMLR 24. He concluded, at para 144:
“I shall therefore approach the consideration of quantum in this case on the footing that compensation can be given for things other than distress, and in particular can be given for the commission of the wrong itself so far as that commission impacts on the
values
protected by the right.”
Later in the judgment, at para 168, the judge referred back to his finding that:
“the damages should compensate not merely for distress …, but should also compensate (if appropriate) for the loss of privacy or autonomy as such arising out [of] the infringement by hacking (or other mechanism) as such.”
“the judge was correct to conclude that the power of the court to grant general damages was not limited to distress and could be exercised to compensate the claimants also for the misuse of their private information. The essential principle is that, by misusing their private information, MGN deprived the claimants of their right to control the use of private information.”
Arden LJ justified this conclusion, at para 46, on the basis that:
“Privacy is a fundamental right. The reasons for having the right are no doubt manifold. Lord Nicholls of Birkenhead put it
very
succinctly in Campbell
v
MGN Ltd [2004] 2 AC 457, para 12: ‘[Privacy] lies at the heart of liberty in a modern state. A proper degree of privacy is essential for the well-being and development of an individual.’”
v
Secretary of State for the Home Department [2011] UKSC 12; [2012] 1 AC 245, paras 97-100, that
vindicatory
damages are not available as a remedy for
violation
of a private right. As Arden LJ pointed out at para 48, no question arose of awarding
vindicatory
damages of the kind referred to in WL (Congo), which have been awarded in some constitutional cases appealed to the Privy Council “to reflect the sense of public outrage, emphasise the importance of the constitutional right and the gravity of the breach, and deter further breaches”: see WL (Congo), para 98; Attorney General of Trinidad and Tobago
v
Ramanoop [2005] UKPC 15; [2006] 1 AC 328, para 19. Rather, the purpose of the relevant part of the awards made in Gulati was “to compensate for the loss or diminution of a right to control formerly private information”.
Varuhas
J and Moreham N (eds), Remedies for Breach of Privacy (2018) ch 5.
(6) How the present claim is framed
Vidal-Hall
and Gulati, neither of which is challenged by either party on this appeal, it would be open to Mr
Lloyd
to claim, at least in his own right: (1) damages under section 13(1) of the DPA 1998 for any distress suffered by reason of any contravention by
Google
of any of the requirements of the Act; and/or (2) damages for the misuse of private information without the need to show that it caused any material damage or distress.
view
may have been taken that, to establish a reasonable expectation of privacy, it would be necessary to adduce evidence of facts particular to each individual claimant. In
Vidal-Hall,
the claimants produced confidential schedules about their internet use, showing that the information tracked and collected by
Google
in their cases was, in the Court of Appeal’s words at [2016] QB 1003, para 137, “often of an extremely private nature”. As discussed earlier, the need to obtain evidence in relation to individual members of the represented class would be incompatible with the representative claim which Mr
Lloyd
is seeking to bring.
Vidal-Hall,
but also includes “loss of control” over personal data.
(7) “Loss of control” over personal data
(8) The common source argument
“Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognized both in article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principles of [EU] law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the [EU];”
The aim of protecting the right to privacy with regard to the processing of personal data is also articulated in recitals (2), (7), (8) and (11) of the Data Protection Directive, and is spelt out in article 1 which states:
“Object of the Directive
In accordance with this Directive, member states shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.”
Reliance is also placed on the recognition in article 8 of the EU Charter, quoted at para 96 above, of the right to the protection of personal data as a fundamental right in EU law.
(a) The wording of the DPA 1998
Google
that the interpretation of section 13 of the DPA 1998 should be approached on the basis of a general rule that breaches of statutory duty are not actionable without proof of material damage. The question in Cullen
v
Chief Constable of the Royal Ulster Constabulary [2003] UKHL 39; [2003] 1 WLR 1763, relied on to support this submission, was whether a statute which did not expressly confer a right to compensation on a person affected by a breach of statutory duty nevertheless conferred such a right impliedly. That is not the question raised in this case, where there is an express entitlement to compensation provided by section 13 of the DPA 1998. The only question in this case is what the words of the relevant statutory provision mean.
“If a court is satisfied on the application of a data subject -
(a) that he has suffered damage by reason of any contravention by a data controller of any of the requirements of this Act in respect of any personal data, in circumstances entitling him to compensation under section 13, and
(b) that there is a substantial risk of further contravention in respect of those data in such circumstances,
the court may order the rectification, blocking, erasure or destruction of any of those data.”
Google’s
case on what is meant by “damage” is correct, a data subject who does not suffer material damage or distress as a result of a breach of duty by a data controller cannot claim rectification, blocking, erasure or destruction of data, unless those data are inaccurate, however egregious the breach. This is true, but I can see nothing unreasonable in such a result. Indeed, section 14 seems to me positively to confirm that “damage” means something distinct from a contravention of the Act itself. If a contravention by a data controller of the Act could by itself constitute “damage”, section 14(4)(a) would be otiose and there would be no material distinction in the remedies available in cases where the data are inaccurate and in cases where the data are accurate. The manifest intention behind section 14 is to limit the remedies of rectification, blocking, erasure or destruction of accurate data to cases where the contravention of the Act has caused the data subject some harm distinct from the contravention itself, whereas no such limitation is imposed where the contravention involves holding inaccurate personal data.
Vidal-Hall,
it is plain from the words enacted by Parliament the term “damage” was intended to be limited to material damage and not to extend to “distress”. The only basis on which the Court of Appeal in
Vidal-Hall
was able to interpret the term “damage” as encompassing distress was by disapplying section 13(2) as being incompatible with EU law. By the same token, if the term “damage” in section 13 is to be interpreted as having an even wider meaning and as encompassing an infringement of a data subject’s rights under the Act which causes no material damage nor even distress, that could only be because this result is required by EU law. On a purely domestic interpretation of the DPA 1998, such a reading is untenable.
(b) The effect of EU law
Vidal-Hall
that words of the statute must be disapplied because they conflict with EU law is therefore available (or is advanced by the claimant). The question is whether the term “damage” in section 13(1) can and should be interpreted as having the meaning for which the claimant contends because such an interpretation is required in order to make the domestic legislation compatible with EU law. There are two aspects of this question: (i) what does the term “damage” mean in article 23 of the Data Protection Directive, which section 13 of the DPA 1998 was intended to implement; and (ii) if “damage” in article 23 includes contraventions of the national provisions adopted pursuant to the Directive which cause no material damage or distress, is it possible to interpret the term “damage” in section 13(1) of the DPA 1998 as having the same meaning?
Vidal-Hall
the Court of Appeal held, rightly in my opinion, that section 13 of the DPA 1998 could not be construed as providing a general right to compensation for distress suffered by reason of a contravention of the Act “without contradicting the clearly expressed intention of Parliament on an issue that was central to the scheme” of the legislation (see para 95 above). The same is equally, if not all the more, true of the contention that section 13 of the DPA 1998 can be interpreted as providing a right to compensation for contraventions of the Act which have not caused any distress, let alone material damage. The distinction between “damage” suffered by an individual and a “contravention” of a requirement of the Act by a data controller which causes such damage is a fundamental feature of the remedial scheme provided by the Act which, as indicated above, permeates section 14 as well as section 13. If it were found that this feature makes the DPA 1998 incompatible with the Data Protection Directive, such incompatibility could, in my
view,
only be removed by amending the legislation. That could only be done by Parliament.
Vidal-Hall.
(c) Flaws in the common source argument
value
that they must do so in the same way or to the same extent or by affording identical remedies. There are significant differences between the nature and scope of the common law privacy tort and the data protection legislation, to which I will draw attention in a moment. But the first point to note is that the decision in Gulati that damages can be awarded for misuse of private information itself was not compelled by article 8 of the Convention; nor did article 8 require the adoption of the particular legal framework governing the protection of personal data contained in the Data Protection Directive and the DPA 1998.
violate
the Convention rights and include certain positive obligations on the state to ensure effective protection of those rights. That is so as regards the right to respect for private life guaranteed by article 8. The European Court of Human Rights has held that in certain circumstances the state’s positive obligations under article 8 are not adequately fulfilled unless the state secures respect for private life in the relations between individuals by setting up a legislative framework taking into consideration the
various
interests to be protected in a particular context. However, the court has emphasised that there are different ways of ensuring respect for private life and that “the choice of the means calculated to secure compliance with article 8 of the Convention in the sphere of the relations of individuals between themselves is in principle a matter that falls within the contracting states’ margin of appreciation”: see the judgment of the Grand Chamber in Bărbulescu
v
Romania [2017] ECHR 754; [2017] IRLR 1032, para 113.
v
United Kingdom (1997) 24 EHRR 523, relied on by counsel for the claimant. In Halford a senior police officer whose telephone calls had been intercepted by her employer in
violation
of article 8 was awarded £10,000 as just satisfaction. As Lord Sales pointed out in argument, on one reading of the judgment, which is far from clear, although it could not be shown that the interception of the applicant’s phone calls, as opposed to other conflicts with her employer, had caused stress for which she had required medical treatment, it was reasonably assumed that this invasion of privacy had caused her mental harm. Even if the award of just satisfaction is understood to have been for the invasion of the right to privacy itself rather than for any distress felt by the applicant, however, it does not follow that, in an action between private parties under national law for a similar invasion of privacy, the Convention requires the court to be able to award damages simply for the loss of privacy itself.
(d) Material differences between the regimes
violation
of privacy, while avoiding the need to show a
violation
of privacy in the case of any individual member of the class. This is a flawed endeavour.
“Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.”
A complaint that a data controller has failed to take such “appropriate technical and organisational measures” is similar to an allegation of negligence in that it is predicated on failure to meet an objective standard of care rather than on any intentional conduct. Even where a contravention of the legislation does not itself require fault, pursuant to section 13(3), quoted at para 90 above, there is no entitlement to compensation if the data controller proves that it took “such care as in all the circumstances was reasonably required to comply with the requirement concerned”.
(e) Equivalence and effectiveness
v
Revenue and Customs Comrs [2018] UKSC 44; [2018] 1 WLR 4053, para 7, the principle is “essentially comparative”. Thus:
“The identification of one or more similar procedures for the enforcement of claims arising in domestic law is an essential prerequisite for its operation. If there is no true comparator, then the principle of equivalence can have no operation at all. The identification of one or more true comparators is therefore the essential first step in any examination of an assertion that the principle of equivalence has been infringed.” [citation omitted]
For the reasons given, even if the measure of damages is regarded as a procedural rule, a claim for damages for misuse of private information at common law is not a true comparator of a claim under section 13 of the DPA 1998. The principle of equivalence can therefore have no operation.
virtually
impossible or excessively difficult: see again Totel Ltd at para 7. However, the absence of a right to compensation for a breach of data protection rights which causes no material damage or distress, even if regarded as a procedural limitation, does not render the enforcement of such rights
virtually
impossible or excessively difficult. The right to an effective remedy does not require awards of compensation for every (non-trivial) breach of statutory requirements even if no material damage or distress has been suffered.
(f) Conclusion on the effect of section 13
(9) The claim for user damages
v
Morris-Garner [2018] UKSC 20; [2019] AC 649, it is now clear that user damages are compensatory in nature, their purpose being to compensate the claimant for interference with a right to control the use of property where the right is a commercially
valuable
asset. As Lord Reed explained in Morris-Garner, at para 95(1):
“The rationale of such awards is that the person who makes wrongful use of property, where its use is commercially
valuable,
prevents the owner from exercising a
valuable
right to control its use, and should therefore compensate him for the loss of the
value
of the exercise of that right. He takes something for nothing, for which the owner was entitled to require payment.”
value
of the use provides an appropriate measure. This
value
can be assessed by postulating a hypothetical negotiation and estimating what fee would reasonably have been agreed for releasing the defendant from the duty which it breached. It is this method of assessment on which the claimant relies in the alternative formulation of the present claim.
Vidal-Hall,
would naturally lend itself to an award of user damages. The decision in Gulati shows that damages may be awarded for the misuse of private information itself on the basis that, apart from any material damage or distress that it may cause, it prevents the claimant from exercising his or her right to control the use of the information. Nor can it be doubted that information about a person’s internet browsing history is a commercially
valuable
asset. What was described by the Chancellor in the Court of Appeal [2020] QB 747, para 46, as “the underlying reality of this case” is that
Google
was allegedly able to make a lot of money by tracking the browsing history of iPhone users without their consent and selling the information collected to advertisers.
view
has sometimes been expressed that asserting privacy in information is inconsistent, or at least in tension, with treating such information as a commercial asset: see eg Douglas
v
Hello! Ltd (No 3) [2005] EWCA Civ 595; [2006] QB 125, para 246; and on appeal sub nom OBG Ltd
v
Allan [2007] UKHL 21; [2008] AC 1, para 275 (Lord Walker of Gestinghorpe). But once the basis of the right to privacy is understood to be the protection of a person’s freedom to choose and right to control whether and when others have access to his or her private affairs, I think that any tension largely disappears. It is common experience that some people are happy to exploit for commercial gain facets of their private lives which others would feel mortified at having exposed to public
view.
Save in the most extreme cases, this should be seen as a matter of personal choice on which it is not for the courts to pass judgments. Moreover, where the defendant’s
very
purpose in wrongfully obtaining and using private information is to exploit its commercial
value,
the law should not be prissy about awarding compensation based on the commercial
value
of the exercise of the right. As was confirmed in Morris-Garner, the fact that the claimant would not have chosen to exercise the right himself is no answer to a claim for user damages. It is enough that, as Lord Reed put it at paras 30 and 95(1) of his majority judgment, the defendant has taken something for nothing, for which the owner of the right was entitled to require payment.
v
Express Newspapers Plc [2007] EWHC 1908 (Ch); [2007] EMLR 22, at para 92, that the principles on which user damages are awarded do not apply to a claim for compensation under the DPA 1998.
F. The need for individualised evidence of misuse
Google
track the individual’s internet browsing history? What quantity of data was unlawfully processed? Was any of the information unlawfully processed of a sensitive or private nature? What use did
Google
make of the information and what commercial benefit, if any, did
Google
obtain from such use?
(1) The claim for the “lowest common denominator”
Google
objects that Mr
Lloyd,
as the self-appointed representative of the class, has no authority from any individual class member to waive or abandon what may be the major part of their damages claim by disavowing reliance on any circumstances affecting that individual. Mr
Lloyd’s
answer, which the Court of Appeal accepted, is a pragmatic one. He points out that the limitation period for bringing any proceedings has now expired. For any represented individual there is therefore no longer any realistic possibility of recovering any compensation at all other than through the present action. Furthermore, to make this action
viable,
it is necessary to confine the amount of damages claimed for each class member to a uniform sum; and a uniform sum of damages, even if considerably smaller than an individualised award would be, is better than nothing.
(2) The facts common to each individual case
Google
generically cannot establish that any given individual is entitled to compensation. To establish any such individual entitlement it must be shown, at least, that there was unlawful processing by
Google
of personal data of which that particular individual was the subject. In considering whether the facts alleged, if proved, are capable of establishing an entitlement to damages, it is therefore necessary to identify what unlawful processing by
Google
of personal data is alleged to have occurred in Mr
Lloyd’s
own case and also in the case of each other member of the represented class. What facts is the claimant proposing to prove to show that
Google
acted unlawfully in each individual case?
Lloyd
and each person whom he represents is entitled to damages simply on proof that they are members of the class and without the need to prove any further facts to show that
Google
wrongfully collected and used their personal data. Any such further facts would inevitably
vary
from one individual member of the class to another and would require individual proof.
version
of the Apple Safari internet browser which, at any date during the relevant period whilst present in England and Wales, he or she used to access a website that was participating in
Google’s
DoubleClick advertising service. There are exclusions from the class definition for anyone who changed the default settings in the Safari browser, opted out of tracking and collation
via
Google’s
“Ads Preference Manager” or obtained a DoubleClick Ad cookie
via
a “first party request” rather than as a “third party cookie”. The aim of the definition is to identify all those people who had a DoubleClick Ad cookie placed on their device unlawfully, through the Safari workaround, but not to include within the class anyone who did not receive a DoubleClick Ad cookie during the relevant period or who received the cookie by lawful means.
Google’s
DoubleClick advertising service on a single occasion. The theory is that on that occasion the DoubleClick Ad cookie will have been placed on the user’s device unlawfully as a third party cookie. To qualify for membership of the class, it is not necessary to show that the individual ever
visited
a website participating in
Google’s
DoubleClick advertising service again during the relevant period. Nor is it alleged that any individual or individuals did
visit
such a website on more than one occasion. The “lowest common denominator” on which the claim is based is therefore someone whose internet usage - apart from one
visit
to a single website - was not illicitly tracked and collated and who received no targeted advertisements as a result of receiving a DoubleClick Ad cookie. This is because the claimant has deliberately chosen, in order to advance a claim in a representative capacity for damages assessed from the bottom up, not to rely on any facts about the internet activity of any individual iPhone user beyond those which bring them within the class of represented persons.
Google
secretly tracked the internet activity of millions of Apple iPhone users for several months and used the data obtained for commercial purposes. But on analysis the claimant is seeking to recover damages without attempting to prove that this allegation is true in the case of any individual for whom damages are claimed. Without proof of some unlawful processing of an individual’s personal data beyond the bare minimum required to bring them within the definition of the represented class, a claim on behalf of that individual has no prospect of meeting the threshold for an award of damages.
(3) User damages on a lowest common denominator basis
Google
from the duties which it breached. I have already indicated why, in my opinion, user damages cannot be recovered for breaches of the DPA 1998. But even if (contrary to that conclusion) user damages could in principle be recovered, the inability or unwillingness to prove what, if any, wrongful use was made by
Google
of the personal data of any individual again means that any damages awarded would be nil.
Google
had offered to pay a fee to each affected Apple iPhone user for the right to place its DoubleClick Ad cookie on their device, the fee would have been a standard one, agreed in advance, rather than a fee which
varied
according to the quantity or commercial
value
to
Google
of the information which was subsequently collected as a result of the user’s acceptance of the cookie. However, imagining the negotiation of a fee in advance in this way is not the correct premise for the
valuation.
valuable
asset protected by the right infringed. The starting point for the
valuation
exercise is thus to identify what the extent of such wrongful use actually was: only then can an estimate be made of what sum of money could reasonably have been charged for that use or, put another way, for releasing the wrongdoer from the duties which it breached in the wrongful use that it made of the asset. Imagining a hypothetical negotiation, as Lord Reed explained at para 91 of Morris-Garner, is merely “a tool” for arriving at this estimated sum. As in any case where compensation is awarded, the aim is to place the claimant as nearly as possible in the same position as if the wrongdoing had not occurred. Accordingly, as Patten LJ put it in Eaton Mansions (Westminster) Ltd
v
Stinger Compania de Inversion SA [2013] EWCA Civ 1308; [2014] 1 P & CR 5, para 21:
“The
valuation
construct is that the parties must be treated as having negotiated for a licence which covered the acts of trespass that actually occurred. The defendant is not required to pay damages for anything else.”
See also Enfield London Borough Council
v
Outdoor Plus Ltd [2012] EWCA Civ 608, para 47; and Marathon Asset Management LLP
v
Seddon [2017] EWHC 300 (Comm); [2017] ICR 791, paras 254-262.
Google
of the claimant’s personal data actually occurred. Only when the wrongful use actually made by
Google
of such data is known is it possible to estimate its commercial
value.
As discussed, in order to avoid individual assessment, the only wrongful act which the claimant proposes to prove in the case of each represented person is that the DoubleClick Ad cookie was unlawfully placed on their device: no evidence is - or could without individual assessment - be adduced to show that, by means of this third party cookie,
Google
collected or used any personal data relating to that individual. The relevant
valuation
construct is therefore to ask what fee would hypothetically have been negotiated for a licence to place the DoubleClick Ad cookie on an individual user’s phone as a third party cookie, but without releasing
Google
from its obligations not to collect or use any information about that person’s internet browsing history. It is plain that such a licence would be
valueless
and that the fee which could reasonably be charged or negotiated for it would accordingly be nil.
G. Conclusion
view
that, even if the legal foundation for the claim made in this action were sound, he should exercise the discretion conferred by CPR rule 19.6(2) by refusing to allow the claim to be continued as a representative action. He characterised the claim as “officious litigation, embarked upon on behalf of individuals who have not authorised it” and in which the main beneficiaries of any award of damages would be the funders and the lawyers. He thought that the representative claimant “should not be permitted to consume substantial resources in the pursuit of litigation on behalf of others who have little to gain from it, and have not authorised the pursuit of the claim, nor indicated any concern about the matters to be litigated”: [2019] 1 WLR 1265, paras 102-104. The Court of Appeal formed a
very
different
view
of the merits of the representative claim. They regarded the fact that the members of the represented class had not authorised the claim as an irrelevant factor, which the judge had wrongly taken into account, and considered that it was open to them to exercise the discretion afresh. They saw this litigation as the only way of obtaining a civil compensatory remedy for what, if proved, was a “wholesale and deliberate misuse of personal data without consent, undertaken with a
view
to commercial profit”: see [2020] QB 747, para 86. In these circumstances the Court of Appeal took the
view
that, as a matter of discretion, the claim should be allowed to proceed.
view
of it is taken, the claim has no real prospect of success. That in turn is because, in the way the claim has been framed in order to try to bring it as a representative action, the claimant seeks damages under section 13 of the DPA 1998 for each individual member of the represented class without attempting to show that any wrongful use was made by
Google
of personal data relating to that individual or that the individual suffered any material damage or distress as a result of a breach of the requirements of the Act by
Google.
For the reasons explained in this judgment, without proof of these matters, a claim for damages cannot succeed.
Google outside the jurisdiction of the courts of England and Wales.