ALI ANSARI v GOOGLE UK LIMITED & Ors

A claim against a company must identify the acts or omissions said to make that company liable. Undifferentiated allegations against several defendants, without primary facts supporting the inferences relied upon, may disclose no reasonable grounds for bringing the claim. On summary judgment, the court may evaluate the evidence, while avoiding a mini-trial, and must consider evidence reasonably expected to be available at trial. Mere corporate control, shared personnel or facilities, facilitation, or the prospect that evidence may emerge is insufficient. Liability as a joint tortfeasor requires substantial assistance pursuant to a common design. The GDPR does not make a local subsidiary liable merely because its parent’s processing is carried out in the context of the subsidiary’s activities.

The claimant alleged that Google Search and Google Analytics had disseminated copyrighted, confidential and personal material. He sued Google UK, Google Ireland and Google LLC, advancing copyright, confidence, privacy, data-protection and tort claims. Google UK applied to strike out the claim or obtain summary judgment, contending that it did not provide or operate the relevant services and was the wrong defendant. The other defendants agreed in principle to directions allowing amended particulars.

The court considered whether the existing pleading disclosed reasonable grounds, whether amendment should be permitted, and whether the evidence gave the claimant a realistic prospect of establishing liability against Google UK.

1. Disposition. The claim against Google UK was struck out under CPR r. 3.4(2)(a), and summary judgment was also granted in its favour. No further opportunity to amend against Google UK was allowed.
2. The existing claim was unreasonably vague and unparticularised. It referred repeatedly to “the Defendants” without explaining Google UK’s role, the duty allegedly breached, or the primary facts from which any relevant inference could be drawn. A claimant cannot rely on high-level allegations against multiple defendants while leaving each defendant’s alleged liability unidentified.
3. For summary judgment, the question was whether the claim had a realistic, rather than fanciful, prospect of success. The court could evaluate the evidence, but had to avoid a mini-trial and consider evidence reasonably expected to be available at trial. The extensive regulatory material did not address Google UK, and there was no evidence that Google UK provided Google Search, Google Analytics or Google Ads, or processed the claimant’s data.
4. Google Spain concerned the parent company’s responsibility under the Directive where processing occurred in the context of the activities of its establishment. It did not treat the subsidiary as the data controller or make subsidiaries liable for processing falling within the parent’s responsibility. The decision therefore did not establish a viable GDPR claim against Google UK.
5. Separate corporate personality could not be displaced by evidence of common control, shared premises or personnel. Nor could liability as a joint tortfeasor be inferred from corporate structure, complexity, facilitation or profit. The claimant identified no primary facts showing substantial assistance pursuant to a common design.
6. The speculative possibility that servers or further evidence might exist did not create a triable issue. Since both the original pleading and the June 2021 draft failed to set out a proper case against Google UK, another amendment would cause further costs without a realistic prospect of curing the defect.