Lloyd v Google LLC

Under the Data Protection Act 1998, a non-trivial loss of control over personal data can constitute compensable damage without proof of pecuniary loss or distress. Trivial or de minimis infringements do not attract compensation. The same-interest requirement for a representative action is satisfied where all members rely on the same wrong and the same loss, without individual circumstances or differing defences. A class is identifiable where it is possible to determine whether any particular person qualifies at every stage. Practical verification difficulties do not themselves defeat identification. If the lower court exercised its discretion on an erroneous basis, the appellate court may exercise it afresh.

Richard Lloyd sought to represent more than four million Apple iPhone users in a claim against Google concerning the alleged secret collection and commercial use of browser-generated information through the Safari Workaround. The claim sought uniform damages under section 13 of the Data Protection Act 1998, without alleging individual pecuniary loss, distress or other distinctive facts.

Warby J dismissed the application for permission to serve Google outside the jurisdiction. He held that the class members had not suffered compensable damage, lacked the same interest and were not identifiable, and that the representative procedure should be refused in any event. The central issues on appeal were the meaning of damage, the requirements of a representative action, and the exercise of discretion.

The appeal was allowed. The court granted permission to serve the proceedings on Google outside the jurisdiction.

1. The provisions of section 13 of the Data Protection Act 1998 implemented article 23 of the Data Protection Directive and had to be construed as a matter of EU law, in the light of the privacy rights protected by article 8 of the Convention and the Charter. The use of autonomous EU meanings was consistent with Vidal-Hall v Google Inc [2015] EWCA Civ 311.
2. A non-trivial loss of control over valuable personal data constitutes damage capable of compensation under section 13 and article 23, even without pecuniary loss or distress. Personal browser-generated information had economic value, and the loss of control over it was therefore a compensable loss. The threshold of seriousness excluded trivial breaches.
3. Gulati v MGN Limited [2015] EWCA Civ 1291 was applicable by analogy. Damages for loss or diminution of control over private information were compensatory, not merely vindicatory. The court did not decide whether damages should ultimately be assessed on user-damages principles; that issue was left open for determination after the facts had been established.
4. The represented class satisfied the same-interest requirement in CPR Part 19.6(1). The claimants relied on the same alleged wrong and the same loss, disavowed individual circumstances, and faced no defence that could apply differently between class members. The claim could therefore proceed on a uniform lowest-common-denominator basis.
5. The class was identifiable. The relevant test was whether it was possible at every stage to determine whether a particular person qualified for membership, not whether verification was practically risk-free. Possible faulty memories or abuse did not defeat formal identification.
6. The judge had taken irrelevancies into account when exercising the discretion under CPR Part 19.6(2), including the supposed lack of identifiability and the absence of authorisation by represented persons. This court could exercise the discretion afresh. The representative action was the only realistic civil route to a remedy and was not disproportionate.

1. Court of Appeal (Civil Division): allowed the appeal and granted permission to serve the proceedings on Google outside the jurisdiction.
2. High Court of Justice, Queen’s Bench Division, Media and Communications List: Warby J dismissed the application for permission to serve Google outside the jurisdiction by order dated 8 October 2018.