Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

UK: Supreme Court overturns Court of Appeal judgment in Lloyd v Google

The Supreme Court published, on 10 November 2021, its judgment in Lloyd (Respondent) v Google LLC (Appellant) [2021] UKSC 50, on appeal from [2019] EWCA Civ 1599, in which it found in favour of Google in Google's appeal against the Court of Appeal's decision to permit Mr Richard Lloyd, the appellant in that case, to serve his representative claim against Google out of the jurisdiction, as Google is a Delaware corporation, to receive compensation under Section 13 of the Data Protection Act 1998.

Background to the appeal

Mr Lloyd had requested permission from the Court of Appeal to bring a class action against Google seeking compensation under Section 13 of the Act for damage allegedly suffered by a class of Apple iPhone users as a result of unlawful processing by Google of their personal data in breach of the requirements of the Act. In particular, the claim was based on the allegation that, during a period of several months in 2011-2012, Google had breached its duties as a data controller under the Act to over 4 million Apple iPhone users in England and Wales, when Google was able to collect and use their browser generated information without the users' knowledge or consent, for commercial purposes.

As legislation providing for class actions in which a single person can claim redress on behalf of a class of people similarly affected by alleged wrongdoing has yet to be enacted in England and Wales, except in the field of competition, Mr Lloyd sought to rely on a procedure now embodied in Rule 19.6 of the Civil Procedure Rules which allows a claim to be brought by (or against) one or more persons as representatives of others who have the same interest in the claim.

Specifically, Mr Lloyd argued that:

  • the 'same interest' requirement was satisfied in the present case and this representative procedure can be used to recover a uniform sum of damages for each person whose data protection rights had been infringed, without having to investigate their individual circumstances; and
  • compensation can be awarded under the Act for 'loss of control' of personal data constituted by any non-trivial contravention by a data controller of any of the requirements of the Act.

Google's appeal is based on the following grounds:

  • damages cannot be awarded under the Act without proof that a breach of the requirements of the Act caused an individual to suffer financial damage or distress; and
  • the claim in any event is not suitable to proceed as a representative action.  

Findings of the Supreme Court

The judgment, given by Lord Leggatt, rejects the above-mentioned claims brought by Mr Lloyd and concludes that the claim cannot succeed for two reasons:

  • The claim is founded solely on Section 13 of the Act, which provides that 'an individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage.' In this regard, the judgment highlights that, upon interpretation of Section 13, 'damage' refers to material damage, such as financial loss, or mental distress distinct from, and caused by, unlawful processing of personal data in contravention of the Act, and not to such unlawful processing itself.
  • Even if it were unnecessary, in order to recover compensation under Section 13 of the Act, to show that an individual has suffered material damage or distress as a result of unlawful processing of his or her personal data, it would still be necessary for this purpose to establish the extent of the unlawful processing in his or her individual case. In this regard, the judgment finds that the threshold of seriousness which must be crossed before compensation can be awarded following a breach of the Act has not been met in the present case, as the claimant did not attempt to prove that the allegation that Google secretly tracked the internet activity of millions of Apple iPhone users for several months and used the data obtained for commercial purposes, was true for every individual in the class action.

Outcomes

The judgment allows the appeal and restores the order made by the High Court judge refusing the claimant's application for permission to serve the proceedings on Google outside the jurisdiction of the courts of England and Wales.

You can read the press release here and the judgment here.