Lloyd v Google LLC

Compensation under section 13 of the Data Protection Act 1998 requires proof that unlawful processing caused material damage or distress. A contravention, including a non-trivial loss of control over personal data, is not itself damage. User damages are therefore unavailable.

The “same interest” requirement for a representative action under CPR rule 19.6 is interpreted purposively. Common issues and the absence of a true conflict of interest suffice; merely divergent interests do not prevent representation. Damages may be claimed representatively where they can be calculated on a common basis. A uniform award cannot be obtained where class membership alone fails to establish unlawful processing, non-trivial harm or the actual use made of each individual’s data.

Google allegedly used the “Safari workaround” to place advertising cookies on Apple iPhones and obtain users’ browsing data without their knowledge or consent. Mr Lloyd claimed under section 13 of the Data Protection Act 1998 on behalf of more than four million users through the representative procedure in CPR rule 19.6. He sought a uniform sum for each class member without proving individual financial loss, distress or the extent of the processing.

Warby J refused permission to serve Google outside the jurisdiction: [2018] EWHC 2599 (QB); [2019] 1 WLR 1265. The Court of Appeal reversed that decision: [2019] EWCA Civ 1599; [2020] QB 747.

The central questions were whether section 13 permits compensation for loss of control of personal data without material damage or distress, and whether the resulting claim could proceed as a representative action.

1. Appeal allowed unanimously. Lord Leggatt delivered the judgment, with which Lord Reed, Lady Arden, Lord Sales and Lord Burrows agreed. The claim had no real prospect of success. The High Court order refusing permission to serve Google outside the jurisdiction was restored.

2. The “same interest” requirement in CPR rule 19.6 must be interpreted purposively. Its function is to ensure that the representative can protect the interests of the class. A representative claim requires common issues and cannot involve a true conflict in which an argument benefiting some class members prejudices others. Merely divergent interests do not preclude representation. The procedure is a flexible tool, and the court retains a discretion governed by the overriding objective.

3. Damages are not categorically excluded from representative proceedings. They may be recovered where entitlement can be calculated on a basis common to all class members. Ordinary compensatory damages usually require an individual assessment, however, because their purpose is to place each claimant in the position that individual would have occupied without the wrong. Common issues may instead be decided representatively, leaving individual liability or quantum to a later stage.

4. Section 13 of the Data Protection Act 1998 distinguishes a statutory contravention from the damage caused by it. Compensation requires material damage or distress resulting from the contravention. The provision cannot be interpreted as awarding compensation for a non-trivial infringement, or “loss of control” of data, without consequential damage or distress. Article 23 of the Data Protection Directive does not require a wider interpretation.

   The damages principles governing misuse of private information in Gulati v MGN Ltd [2015] EWCA Civ 1291 could not be transferred to the statutory scheme. The privacy tort protects information in which there is a reasonable expectation of privacy and involves deliberate strict-liability conduct. Data-protection duties extend to all personal data and may depend on failure to exercise reasonable care.

5. User damages were also unavailable under section 13 because that provision compensates consequential damage or distress, not the infringement itself. In any event, following OneStep (Support) Ltd v Morris-Garner [2018] UKSC 20, such damages value the wrongful use that actually occurred. Without evidence of the data collected or used for an individual, a hypothetical licence to place a cookie without authority to collect or use browsing information would have no value.

6. Membership of the proposed class proved no more than the placement of a cookie following one qualifying website visit. It did not establish that Google subsequently collected or used the individual’s personal data, that any processing crossed the claimant’s own seriousness threshold, or that the individual suffered damage or distress. A uniform per capita award therefore could not be made without individual evidence.

1. United Kingdom Supreme Court: In Lloyd v Google LLC [2021] UKSC 50, the court unanimously allowed Google’s appeal and restored the High Court order refusing permission for service outside the jurisdiction.
2. Court of Appeal: In [2019] EWCA Civ 1599; [2020] QB 747, the court reversed the High Court. It held that loss of control could constitute damage under section 13 of the Data Protection Act 1998 and allowed the representative claim to proceed.
3. High Court: In [2018] EWHC 2599 (QB); [2019] 1 WLR 1265, Warby J held that the claim had no real prospect of success and was unsuitable for representative proceedings. He refused permission to serve Google outside the jurisdiction.