UK Supreme Court rules representative action for group data protection claim was “doomed to fail”

The UK Supreme Court handed down a unanimous judgment yesterday in the high-profile Lloyd v Google case, ruling in Google’s favour that the opt-out representative action brought on behalf of up to 4.4 million Apple iPhone users for alleged loss of control of personal data was “doomed to fail”. This is an important decision, not only because of its significance for data protection claims, but also for the future of class actions in England & Wales.

In overturning the previous Court of Appeal decision (which you can read about here), Lord Leggatt ruled that this “innovative” attempt to use the representative action procedure could not succeed, because compensation for the alleged data protection breaches was of a kind that would need to be individually assessed. He rejected the claimant’s argument that compensation could be awarded for “loss of control” of data alone, without proving any financial loss or distress to an individual claimant.

However, the judgment countenances the possibility of a representative action being used to bring both opt-out and opt-in class actions, and contains interesting obiter comments about how damages could be assessed in representative actions.

Background to the case

In May 2017, Richard Lloyd, a former director of “Which?”, issued a claim against Google alleging that, between 2011 and 2012, it breached the Data Protection Act 1998 (DPA 1998) by its collection and use of internet browser data of over 4 million Apple iPhone users in England & Wales, without the necessary user consent.

Mr Lloyd brought the claim as a representative action under rule 19.6 of the Civil Procedure Rules. This rule allows a claimant to issue proceedings on behalf of a wider class if all individuals in that class have the “same interest”. Mr Lloyd sought damages representing a standard “tariff” of £750 for each person whose data privacy rights were infringed, or alternatively “user damages” to reflect what would have been paid to each user to give up their rights.

The claimant required the Court’s permission to serve proceedings on Google in the US (i.e. outside this jurisdiction); the application for permission was opposed by Google on the grounds that the claim had no real prospect of success. In this context, the Court had to consider whether:

• damages can be awarded under the DPA 1998 for “loss of control” of data, absent proof of any financial loss or distress; and
• the claim could viably proceed as a representative action (on behalf of other iPhone users).

The High Court ruled in favour of Google on both these issues, deciding that breaching the DPA 1998 did not in itself give rise to compensation and that the “same interest” test could not be met, because the extent of the infringement and the impact it had on individual users will have greatly varied. However, the Court of Appeal overturned the decision in a unanimous judgment.

What did the Supreme Court decide?

“Loss of control” is not in itself a head of loss under the DPA 1998. Section 13 of the DPA 1998 does not provide a right to compensation for “loss of control” of data (or any other breach of the DPA 1998), unless it is proven that the contravention has caused material damage or distress to the individual concerned. The damage claimed and the contravention of the DPA 1998 cannot be one and the same. The Court also found that “user damages” were not available under the DPA 1998.

The Supreme Court considered that relevant factors in assessing quantum of damages in a data privacy claim would include: (1) the duration of time for which data was unlawfully processed; (2) the quantity of data unlawfully processed; (3) whether any sensitive or private data was processed; and (4) what use was made of the data, including any commercial benefit.

The Supreme Court offered guidance on the principles governing the use of the representative action procedure, having reviewed both UK and Commonwealth authorities on the issue. The Court suggested that “the same interest” requirement for representative actions should be interpreted as requiring individuals’ claims to raise common issues and for there to be no conflict of interest between them. This does not preclude divergent interests, amongst class members. Lord Leggatt noted that if advancing the case of class members affected by the issue would not prejudice the position of others, there is no reason in principle why all should not be represented by the same person. 

The judgment discusses factors that the Court should consider in exercising its discretion as to whether to allow a claim to proceed as a representative action. It also makes clear that the Court has discretion as to whether to grant a representative action as an “opt-out” (or opt-in) claim. Represented individuals will not face any costs risks (unless the Court specifically orders that), unlike a litigation funder of a representative action.

In obiter commentary, the judgment offers clarity on how the Court envisages damages being assessed in viable representative actions. Where the entitlement to damages can be calculated on a “top down” basis which is common to all members of the class, a representative action might be the appropriate vehicle for the whole action. Otherwise, the Supreme Court noted that it may be possible to adopt a two-stage “bifurcated process”, where common issues of fact or law are first decided through a representative claim, and then any issues requiring individual determination (including quantifying loss), are dealt with at a subsequent stage. The Supreme Court commented that if this had been proposed in the present case, it “could see no legitimate objection” to such an approach.

What is interesting about the Supreme Court decision?

This judgment poses significant hurdles for representative actions brought on behalf of a group for breaches of the DPA 1998. It also shuts the door to claims for breach of “loss of control” under the DPA 1998 where there has been no distinct financial loss or distress suffered.

The judgment offers extensive commentary on the different mechanisms currently available to claimants in England & Wales to bring class actions, although important questions remain as to how it will be applied in practice. As part of this discussion, the Supreme Court confirms that in principle it would be possible to use the representative action procedure to bring an opt-out (or an opt-in) class action. A repeated theme of the judgment is that, although Mr Lloyd’s attempt in this case had failed, courts should have discretion to apply the representative action procedure flexibly, in order to ensure that the overriding objective of dealing with cases justly and at proportionate cost is met.

In his obiter remarks, Lord Leggatt goes as far as to discuss how a representative action could not only be used where damages will be common to all members of a class, but also as the first part of a two-stage process to establish common issues of law or fact in a representative action, before damages are assessed on an individual level at a second stage. In this case, Mr Lloyd submitted that a two-stage process of this nature would not be economically viable.

We will be discussing with our clients the possible consequences of this guidance and appropriate risk management. 

The judgment may also have implications for other forms of class action, including competition damages collective proceedings pursuant to the Consumer Rights Act 2015. Recent class certification decisions in such cases have suggested that a class representative seeking aggregate class-wide damages on an opt-out basis need not show that individual claims forming part of the collective proceedings satisfy the normal tort law requirements of material loss and causation. The reasoning of the Supreme Court in Lloyd v Google that “without proof of these matters, a claim for damages cannot succeed” may apply equally to collective proceedings, casting doubt on those recent certification decisions.