The Court of Appeal (CA) judgment in Richard Lloyd v Google is a game-changer for group litigation. It discusses the circumstances in which a claim can be brought by way of representative action, particularly where there has been a data privacy breach.
Richard Lloyd alleged that Google used a technique called the “Safari Workaround” to collect considerable amounts of information about the internet activity of approximately 4 million Apple iPhone users.
In order to bring a claim Mr Lloyd launched a representative action on behalf of a class of millions of end-users in the UK whose mobile browser data was collected by Google in breach of the Data Protection Act 1998. A representative action is where a representative claimant brings a claim on behalf of a group/class of people who have the “same interest” in the claim. It contrasts with group litigation which requires affected individuals to be identified and persuaded to join the litigation- a process that is both costly and time consuming.
At first instance, as we reported upon previously here, the High Court dismissed the claim, and taking into account the fact that “none of the millions of affected people in England and Wales had come forward to complain”, held that the essential conditions for a representative action had not been met. In particular it was held that: (1) the members of the class of claimants did not have the “same interest” because of the differing levels of data tracked by Google, and (2) there were alleged insurmountable practical difficulties with ascertaining if a phone user was a member of the relevant class.
However the Court of Appeal overturned this decision on the basis of three key findings:
1. The Claimants should be compensated as they had lost control of their data
The Court of Appeal found that a person’s control over their data has value, therefore the loss of control over that data must also have value. This meant that damages could be awarded to compensate for the loss of the right to control formally private information, even if there was no pecuniary loss or distress.
2. The Claimants have the “same interest”
For a representative action to succeed, persons represented to have the “same interest” in the claim.
In making its decision, the CA placed weight on the fact that:
(i) Any defence raised by Google would apply equally to all of the represented claimants; and
(ii) If individual circumstances were disavowed, each member of the represented class could be entitled to claim a uniform sum.
Given that the wrong was the same, and the loss claimed the same, the parties were found to have the same interest.
3. The case should be allowed to continue
While compensation was cited a key factor, arguably so was penance as the judge concluded that Google should be held accountable for “its allegedly wholesale and deliberate misuse of personal data without consent, undertaken with the view to make profit.”
Given that the representative action was the only realistic way of bringing the claim, the Court of Appeal made the decision to exercise its discretion and overturn the High Court’s decision.
While the UK does not have a system for American-style “Class Actions”, where all individuals who may fall within a claim are included unless they opt out, the decision appears to be a step in that direction.
It remains to be seen whether there will now be a host of representative actions brought against companies who have committed data breaches, but the Court of Appeal has shown willing to hold such companies accountable in circumstances where the breach is of sufficient seriousness. What the decision does clearly highlight, however, is the importance of good data governance and cyber resilience.
This remains a developing area which should be watched. Google has already stated its intention to appeal to the Supreme Court and we will continue to provide updates.