Lloyd v Google LLC

Compensation under section 13 of the Data Protection Act 1998 requires both a contravention and damage caused by that contravention. The infringement itself, the commission of the wrong, or a bare loss of control over personal data does not necessarily constitute compensatable damage. Whether damage exists depends on the facts and the effect of the processing on the individual.

Representative proceedings require all represented persons to have the same interest. That requirement is not satisfied where damage, defences, or the value of the alleged loss differ materially between individuals, or where class membership cannot reliably be verified. The court may refuse continuation of a representative action of its own initiative where the procedural requirements or the overriding objective are not met.

Richard Lloyd sought permission to serve proceedings outside the jurisdiction on Google LLC. He proposed to act representatively for millions of residents of England and Wales allegedly affected by Google’s Safari Workaround during 2011 and 2012.

The claim alleged breach of section 4(4) of the Data Protection Act 1998. It sought uniform compensation for infringement of data protection rights, commission of the wrong, loss of control over personal data, or alternatively a hypothetical release fee reflecting the value of Google’s use of the data. No financial loss, distress, anxiety, or other individualised harm was pleaded.

The issues were whether the pleaded facts disclosed compensatable damage under section 13 and, if so, whether the claim could proceed under CPR 19.6 as a representative action.

1. Permission refused. The claim did not have a real prospect of success and did not satisfy the tort gateway in PD6B paragraph 3.1(9).
2. Section 13(1) of the Data Protection Act 1998 requires a contravention, damage caused by that contravention, and compensation for that damage. The contravention and damage are separate matters. The statute does not treat every breach as itself constituting damage.
3. The pleaded categories of loss were insufficient. Infringement of rights and commission of the wrong merely described the breach. Loss of control was not automatically damage. It could amount to damage where the facts showed a significant or material diminution in the value of the individual’s ability to control personal information, but that was fact-sensitive. The generic, non-individualised pleading disclosed no such harm.
4. Gulati v MGN Ltd was not authority for substantial damages whenever private information had been misused. It concerned significant and exceptional misuse of private information, with compensation reflecting the impact on the claimants’ ability to control valuable personal information. The claim under section 4(4) was a distinct tort.
5. The alternative user-damages claim also failed. Murray v Express Newspapers rejected a market-value approach under the DPA, and the hypothetical negotiation proposed here was artificial and incapable of producing a uniform assessment for all class members.
6. In any event, the class did not satisfy the same-interest requirement in CPR 19.6(1). Individuals would differ in the nature and extent of processing, available defences, damage, attitudes towards the use of their data, and the value of any loss. The class also could not reliably be verified, including because some users had already received, or never received, the relevant cookie.
7. The court could act of its own initiative under CPR 19.6(2). Applying the overriding objective, it would refuse continuation because the action would consume substantial resources for modest and variable individual claims brought on behalf of persons who had not authorised or shown interest in the litigation.

First-instance decision. No prior judgment in the present litigation is stated.