The Supreme Court has just handed down judgment(1) in the eagerly anticipated case of Lloyd v Google Inc. In the case, a former director of a consumer affairs magazine, was trying to sue Google on behalf of 4.4 million people in England and Wales for around £3 billion. The Supreme Court overruled the Court of Appeal and refused permission for the case to proceed.
Mr Lloyd’s claim sought damages (£750 for each and every iPhone owner at the time in question) against Google for the way it had installed tracking cookies on Apple iPhones in 2011 and 2012. Mr Lloyd claimed that, contrary to public statements made by Google at the time, it had installed tracking cookies without the users’ knowledge or consent.
He claimed Google had then used these cookies to obtain vast amounts of personal data for its own commercial profit. Mr Lloyd claimed this was a serious breach of the Data Protection Act 1998 (as in force at the time) and that each and every phone owner was entitled to compensation. The unusual aspect to the case however was that not only claimed damages for himself, but he sought to use Google as a ‘representative’ of every other alleged victim, whether they had even been aware of the actions of Google for not.
Whilst these class-action lawsuits may be relatively frequent in the US, they are very rare in the UK. Recent changes in England & Wales (but which did not apply in Northern Ireland) have made it easier for larger groups to seek justice in Court. However, even after these changes it remains the position that any group claims require alleged victims to actively opt-in to proceedings.
Mr Lloyd’s action did not require any active participation from any other alleged victim. Any person owning an iPhone at the time would automatically have been included and could have claimed their share of the damages if the claim had been successful.
The decision focusses on two main aspects:
1. The ability of individuals to take this type of ‘representative action’; and
2. Whether in fact, the alleged victims had valid claims against Google in the first place.
The Supreme Court held that whilst ‘representative actions’ could be allowed by the Courts in certain circumstances and that Courts should be flexible in considering them, they did not believe that this claim should be allowed to proceed.
The Judges found that in order for the case to go ahead as Mr Lloyd wanted, he would need to show damage had been caused to the alleged victims. It was not enough to show that the Data Protection Act had been breached, some other form of damage or distress must have been caused to each victim. It would clearly not be possible for him to do this.
The case is interesting on a number of fronts, it appears to limit the circumstances in which victims of data breaches will be able to claim compensation and will be of great interest to anyone wanting to take future ‘representative actions’.
It is worth noting however, that the case considered the law as it was in 2011 to 2012 and did not take into account the significant changes made by the General Data Protection Regulation (‘GDPR’).
Editorial prepared by: Mark Thompson, Senior Associate, Litigation @ Mills Selig
Having the right legal advice at the right time is crucial - our expert team offers clear, concise and problem solving legal advice.
For further information on Mills Selig's expert legal services and how we can help your organisation, click: www.MillsSelig.com/Expertise
#YourLegalTeam #Understanding #Expertise #Experience